Feedback on AttachContentPlugin

-- MeredithLesly - 13 Jul 2006

This Plugin used to be CacheContentPlugin.

-- PeterThoeny - 13 Jul 2006

See also Codev.PalettablePatternSkin.

-- ArthurClemens - 12 Jul 2006

Meredith,

Thanks for posting this plugin. I think it will be very useful with the BibtexPlugin.

And I second Lynnwood's suggestion of hiding the text during view. Attached (to CacheContentPluginDev) is a diff of my first pass. Ideally, I think the show/hide on view function could be set as a parameter to STARTCACHE.

One other concern: is there as simple way to prevent edit collisions? e.g. If one person edits the attachment using edit, and a second person uploads an attachment of the same name later, the uploaded edits will be lost on the next topic save. Is there a way to block attachment uploads for CACHEd files?

-- ScottHoge - 13 Jul 2006

The plugin topic AttachContentPlugin in svn is still a stub.

-- ArthurClemens - 15 Jul 2006

Does the version in svn actually work? On my site the variables are not expanded, and nothing is attached.

-- ArthurClemens - 15 Jul 2006

Meredith had changed syntax from STARTATTACH to ATTACH.

-- ArthurClemens - 19 Jul 2006

Brainstorming idea: would it be possible to save the topic contents that is INCLUDEd? That way we would be able to grab a webpage at a certain moment in time.

Perhaps with a save button, or a save handler that is called at onload?

• I actually took a shot at something like this once (HowToSnapshotRenderedPages), but my implementation ended up pretty hack-ish. Would like to see this feature done cleanly also. -- SteffenPoulsen - 20 Jul 2006

-- ArthurClemens - 19 Jul 2006

EmbedTopicPlugin is related.

-- MartinCleaver - 20 Jul 2006

This is not a fault of this plugin per se, but rather of TWiki's handling of tags and parameters in general.

I'd have wanted:

%ATTACH{foo2.txt}%
3
4
%ENDATTACH{}%

to have the same effect as:

%ATTACH{"foo2.txt"}%
3
4
%ENDATTACH%

It's in the handling - it ought to be centralised.

-- MartinCleaver - 20 Jul 2006

Actually, it is up to the handler to parse the parameter properly with TWiki::Func::extractNameValuePair( $param );. See TWikiFuncDotPm

-- PeterThoeny - 20 Jul 2006

It appears this plugin was never uploaded to twiki.org, syncing from SVN.

I seem to get default property values for attached files in my installation ("0.1 K - 01 Jan 1970 - 01:00"), perhaps extend the attachment save logic to send along actual values from the attached file? (I will do it if OK with you Meredith).

-- SteffenPoulsen - 20 Jul 2006

Actually, I use TWikiFuncDotPm to get the attributes instead of repeated calls to extractNameValuePair, so that things are done the same as in tag handlers.

-- MeredithLesly - 20 Jul 2006

SP, that's a bug, then. Obvously I'm not handling the case of no file name passed in, which isn't a good thing.

-- MeredithLesly - 20 Jul 2006

This plugin has a contact author first policy but I am going to break that policy because...

• The plugin has a major security problem. If you use it now - uninstall it now and wait for my update.
• The plugin has a very likely race condition problem
• The plugin leaves a mess in its work area.

I am addressing all 3 in an update of the plugin. Still fighting with some other details which may be an error in core

-- KennethLavrsen - 18 Oct 2006

A safer version has been uploaded.

• The plugin will no longer allow filenames like ../../../evilscript.pl - it now simple throws away anything before the last / or \.
• The plugin calls some of the same code that it used to protect normal attachments. This also means appending .txt to certain filenames. If it is important to protect normal attachments, it is equally important to protect those made by this plugin.
• The Plugin now cleans up the mess it makes in its work area.
• The plugin generates a pseudo random filename as a temporary file. Before there was a race condition. If two edited the same topic OR just two topics where the filename used with this plugin was the same, one of them would get wrong data in the attachment. Now there is a 1/1000000000 chance that this happens.
• I have extended the number of tags that the plugin does not include in the attachment. It now also strips nops and square bracket links. I needed that for my use. If the KEEPPARS is set to 1, this is disabled. This extension should not affect any CSS.

I hope this makes the plugin both safer to use and more useful. I use it to generate the man page for my Motion project based on a TWiki page that fetches info from 200 different Twiki topics.

-- KennethLavrsen - 19 Oct 2006

Thanks Kenneth for fixing the security hole! I alerted TWikiDevMailingList and all site owners I could find via Google.

-- PeterThoeny - 19 Oct 2006

A couple of ideas:

• Remove the leading newline. I doubt that most people expect the leading newline. A user can always add one by placing an extra newline after STARTATTACH
• How about an option to automatically generate zip and/or tar.gz files? Syntax could be something like %ATTACH_ARCHIVE{ "foo.tar.gz" archive="file1.txt, file2.txt, file3.css"}%

-- TroyGoodson - 19 Oct 2006

It might also be cool to be able to set KEEPPARS as an option to STARTATTACH.

-- TroyGoodson - 19 Oct 2006

This is going to be a feature request list

• Keep the comment once it has been set (now it is changed back to Generated by AttachContentPlugin each time).
• (mentioned above) Have wget functionality and save INCLUDED contents as a file (after the onload handler)

-- ArthurClemens - 19 Oct 2006

Seems like I could use that plug-in although the fact that "...the attachment can get out of synch..." sounds scary. Would it be possible to have AttachContentPlugin refresh the topic content according to the attachment upon editing? That should prevent data lose.

-- StephaneLenclud - 12 Mar 2007

The generated attachment will contain rendered content. No way you can convert that back into TML.

-- ArthurClemens - 12 Mar 2007

But I don't want to convert it back to TML. I was looking for a plug-in allowing on the fly attachment edition that's how I ended up looking at AttachContentPlugin. Maybe I should just use AttachContentPlugin to create an EditAttachmentPlugin? Perhaps the proper way to do that is to implement a twiki/bin/attachedit script but that seems to be more maintenance work in respect to skin integration than to have a standard plug-in that would just make use of the standard edit.

-- StephaneLenclud - 13 Mar 2007

Stephane - where do you have the out of sync from? Each time you save the topic the attachment is updated. Unless you manually upload another attachment of the same name it is always in sync.

Troy I never noticed the leading newline. I will remove that next time I touch this plugin.

-- KennethLavrsen - 13 Mar 2007

That's exactly my problem Kenneth. I would like to be able to edit text attachment rather than attaching the content.

-- StephaneLenclud - 14 Mar 2007

I think the STARTATTACH content ENDATTACH tags on the page should be removed on normal page view. If people want them to be displayed they can be put inside verbatim.

I also want to add web and topic parameters so files can be attached to a different topic. And a comment parameter to add a custom comment text.

-- ArthurClemens - 13 Apr 2007

Is there any way to have the contents displayed in verbatim mode without the STARTATTACH and ENDATTACH tags being displayed?

-- DiabJerius - 23 Jul 2007

Just tried an install on 4.2 and the plugin is doing nothing. I've double checked permissions are all set. Even the test instance does not seem to work and I'm not getting any text in the debug.txt log either. I might go ahead and search/open support for this one.

-- RedByer - 11 May 2008

It might be something specific to your installation. I have been using it on 4.2 with success.

-- ArthurClemens - 12 May 2008

Arthur, The problem I'm having (with TWiki and Plugins in general actually) is figuring out how to debug issues like this. For all I know the plugin is looking for some directory or failing authentication or something weird. I've tried creating a the work_dir directory it asks for, and I've double checked permissions -- still can't seem to get it to do anything (no files attached, no sign of work). Do you have any other ideas or places to look? Is there a way to see where it is getting hung up?

-- RedByer - 16 May 2008

Is this attachment dead? I am trying to use it and get an error message that it can only be called with the method = post. It seems like there are no new versions anymore...

-- IngoFechtel - 2011-12-20

Oh, apparently it has not been tested well for TWiki-5.x. Could you please file a bug report at TWikibug:AttachContentPlugin stating details to reproduce the error?

-- PeterThoeny - 2011-12-20

There is now an alternative to this plugin: IfThenActionPlugin has a then-action called attachsection to attach the content of a named section as a file attachment.

-- Peter Thoeny - 2015-05-29