From 5bffd9883de02807817838cd840a5293b6b908ac Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Thu, 2 Aug 2012 20:47:09 +0100
Subject: [PATCH 01/75] [feature/attach-dl] Added links to the templates

PHPBB3-11042
---
 phpBB/language/en/common.php                        | 2 ++
 phpBB/styles/prosilver/template/viewtopic_body.html | 6 +++++-
 phpBB/viewtopic.php                                 | 8 ++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/phpBB/language/en/common.php b/phpBB/language/en/common.php
index 33d39c3e99..61749046c4 100644
--- a/phpBB/language/en/common.php
+++ b/phpBB/language/en/common.php
@@ -161,6 +161,8 @@ $lang = array_merge($lang, array(
 	'DISPLAY_MESSAGES'		=> 'Display messages from previous',
 	'DISPLAY_POSTS'			=> 'Display posts from previous',
 	'DISPLAY_TOPICS'		=> 'Display topics from previous',
+	'DOWNLOAD_ALL'			=> 'Download all',
+	'DOWNLOAD_ALL_ATTACH'	=> 'Download all attachments',
 	'DOWNLOADED'			=> 'Downloaded',
 	'DOWNLOADING_FILE'		=> 'Downloading file',
 	'DOWNLOAD_COUNTS'		=> array(
diff --git a/phpBB/styles/prosilver/template/viewtopic_body.html b/phpBB/styles/prosilver/template/viewtopic_body.html
index cfbf0969d9..d27d653907 100644
--- a/phpBB/styles/prosilver/template/viewtopic_body.html
+++ b/phpBB/styles/prosilver/template/viewtopic_body.html
@@ -45,6 +45,10 @@
 		</div>
 	<!-- ENDIF -->
 
+	<!-- IF S_HAS_ATTACHMENTS -->
+		<span>[ <a href="{U_DL_ALL_LINK}">{L_DOWNLOAD_ALL_ATTACH}</a> ]</span>
+	<!-- ENDIF -->
+
 	<!-- IF .pagination or TOTAL_POSTS -->
 		<div class="pagination">
 			<!-- IF U_VIEW_UNREAD_POST and not S_IS_BOT --><a href="{U_VIEW_UNREAD_POST}">{L_VIEW_UNREAD_POST}</a> &bull; <!-- ENDIF -->{TOTAL_POSTS} &bull; 
@@ -157,7 +161,7 @@
 
 			<!-- IF postrow.S_HAS_ATTACHMENTS -->
 				<dl class="attachbox">
-					<dt>{L_ATTACHMENTS}</dt>
+					<dt>{L_ATTACHMENTS}<!-- IF postrow.S_MULTIPLE_ATTACH --> [ <a href="{postrow.U_DL_ALL_LINK}">{L_DOWNLOAD_ALL}</a> ]<!-- ENDIF --></dt>
 					<!-- BEGIN attachment -->
 						<dd>{postrow.attachment.DISPLAY_ATTACHMENT}</dd>
 					<!-- END attachment -->
diff --git a/phpBB/viewtopic.php b/phpBB/viewtopic.php
index b6df14d42d..fce1be7784 100644
--- a/phpBB/viewtopic.php
+++ b/phpBB/viewtopic.php
@@ -1314,6 +1314,11 @@ if (sizeof($attach_list))
 	}
 }
 
+$template->assign_vars(array(
+	'S_HAS_ATTACHMENTS' => !empty($attachments),
+	'U_DL_ALL_LINK' => append_sid("{$phpbb_root_path}download/file.$phpEx", "topic_id=$topic_id"),
+));
+
 // Instantiate BBCode if need be
 if ($bbcode_bitfield !== '')
 {
@@ -1556,6 +1561,7 @@ for ($i = 0, $end = sizeof($post_list); $i < $end; ++$i)
 		'POSTER_ID'			=> $poster_id,
 
 		'S_HAS_ATTACHMENTS'	=> (!empty($attachments[$row['post_id']])) ? true : false,
+		'S_MULTIPLE_ATTACH'	=> !empty($attachments[$row['post_id']]) && sizeof($attachments[$row['post_id']]) > 1,
 		'S_POST_UNAPPROVED'	=> ($row['post_approved']) ? false : true,
 		'S_POST_REPORTED'	=> ($row['post_reported'] && $auth->acl_get('m_report', $forum_id)) ? true : false,
 		'S_DISPLAY_NOTICE'	=> $display_notice && $row['post_attachment'],
@@ -1567,6 +1573,8 @@ for ($i = 0, $end = sizeof($post_list); $i < $end; ++$i)
 
 		'S_IGNORE_POST'		=> ($row['hide_post']) ? true : false,
 		'L_IGNORE_POST'		=> ($row['hide_post']) ? sprintf($user->lang['POST_BY_FOE'], get_username_string('full', $poster_id, $row['username'], $row['user_colour'], $row['post_username']), '<a href="' . $viewtopic_url . "&amp;p={$row['post_id']}&amp;view=show#p{$row['post_id']}" . '">', '</a>') : '',
+
+		'U_DL_ALL_LINK'		=> append_sid("{$phpbb_root_path}download/file.$phpEx", 'post_id=' . $row['post_id']),
 	);
 
 	if (isset($cp_row['row']) && sizeof($cp_row['row']))

From ee7d9614c07c3961d62edbd0e8bf5ef1e2d75ff8 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Sat, 4 Aug 2012 13:18:20 +0100
Subject: [PATCH 02/75] [feature/attach-dl] Downloading all attachments fully
 implemented

Added a function to list all available archiving methods and integrated
it with the prosilver style.

Heavy modifications to download/file.php to support archiving and
downloading of multiple files at once.

PHPBB3-11042
---
 phpBB/download/file.php                       | 289 +++++++++++++-----
 phpBB/includes/functions_display.php          |  30 ++
 .../prosilver/template/viewtopic_body.html    |  23 +-
 phpBB/styles/prosilver/theme/content.css      |  23 ++
 phpBB/viewtopic.php                           |  16 +-
 5 files changed, 307 insertions(+), 74 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index c01b0789de..243d276607 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -132,8 +132,12 @@ if (isset($_GET['avatar']))
 // implicit else: we are not in avatar mode
 include($phpbb_root_path . 'common.' . $phpEx);
 require($phpbb_root_path . 'includes/functions_download' . '.' . $phpEx);
+require($phpbb_root_path . 'includes/functions_compress.' . $phpEx);
 
 $download_id = request_var('id', 0);
+$topic_id = $request->variable('topic_id', 0);
+$post_id = $request->variable('post_id', 0);
+$archive = $request->variable('archive', '.tar');
 $mode = request_var('mode', '');
 $thumbnail = request_var('t', false);
 
@@ -142,7 +146,7 @@ $user->session_begin(false);
 $auth->acl($user->data);
 $user->setup('viewtopic');
 
-if (!$download_id)
+if (!$download_id && !$post_id && !$topic_id)
 {
 	send_status_line(404, 'Not Found');
 	trigger_error('NO_ATTACHMENT_SELECTED');
@@ -154,20 +158,62 @@ if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
 	trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
 }
 
-$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
-	FROM ' . ATTACHMENTS_TABLE . "
-	WHERE attach_id = $download_id";
-$result = $db->sql_query_limit($sql, 1);
-$attachment = $db->sql_fetchrow($result);
-$db->sql_freeresult($result);
+$attachment = false;
+$attachments = false;
 
-if (!$attachment)
+if ($download_id)
+{
+	$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
+		FROM ' . ATTACHMENTS_TABLE . "
+		WHERE attach_id = $download_id";
+	$result = $db->sql_query_limit($sql, 1);
+	$attachment = $db->sql_fetchrow($result);
+	$db->sql_freeresult($result);
+}
+
+if ($topic_id)
+{
+	$sql = "
+		SELECT attach_id, in_message, post_msg_id, extension, is_orphan, a.poster_id, filetime
+		FROM " . POSTS_TABLE . " p, " . ATTACHMENTS_TABLE . " a
+		WHERE p.topic_id = $topic_id
+		AND p.post_attachment = 1
+		AND a.post_msg_id = p.post_id
+	";
+	$result = $db->sql_query($sql);
+
+	while ($row = $db->sql_fetchrow($result))
+	{
+		$attachments[] = $row;
+	}
+
+	$db->sql_freeresult($result);
+}
+
+if ($post_id)
+{
+	$sql = "
+		SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
+		FROM " . ATTACHMENTS_TABLE . "
+		WHERE post_msg_id = $post_id
+	";
+	$result = $db->sql_query($sql);
+
+	while ($row = $db->sql_fetchrow($result))
+	{
+		$attachments[] = $row;
+	}
+
+	$db->sql_freeresult($result);
+}
+
+if (!$attachment && !$attachments)
 {
 	send_status_line(404, 'Not Found');
 	trigger_error('ERROR_NO_ATTACHMENT');
 }
 
-if ((!$attachment['in_message'] && !$config['allow_attachments']) || ($attachment['in_message'] && !$config['allow_pm_attach']))
+if ($attachment && ((!$attachment['in_message'] && !$config['allow_attachments']) || ($attachment['in_message'] && !$config['allow_pm_attach'])))
 {
 	send_status_line(404, 'Not Found');
 	trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
@@ -175,7 +221,7 @@ if ((!$attachment['in_message'] && !$config['allow_attachments']) || ($attachmen
 
 $row = array();
 
-if ($attachment['is_orphan'])
+if ($attachment && $attachment['is_orphan'])
 {
 	// We allow admins having attachment permissions to see orphan attachments...
 	$own_attachment = ($auth->acl_get('a_attach') || $attachment['poster_id'] == $user->data['user_id']) ? true : false;
@@ -191,13 +237,26 @@ if ($attachment['is_orphan'])
 }
 else
 {
-	if (!$attachment['in_message'])
+	if ($attachments || ($attachment && !$attachment['in_message']))
 	{
-		//
-		$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
-			FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f
-			WHERE p.post_id = ' . $attachment['post_msg_id'] . '
-				AND p.forum_id = f.forum_id';
+		if ($download_id || $post_id)
+		{
+			$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
+				FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f
+				WHERE p.post_id = ' . (($attachment) ? $attachment['post_msg_id'] : $post_id) . '
+					AND p.forum_id = f.forum_id';
+		}
+
+		if ($topic_id)
+		{
+			$sql = "
+				SELECT t.forum_id, f.forum_password, f.parent_id
+				FROM " . TOPICS_TABLE . " t, " . FORUMS_TABLE . " f
+				WHERE t.topic_id = $topic_id
+				AND t.forum_id = f.forum_id
+			";
+		}
+		
 		$result = $db->sql_query_limit($sql, 1);
 		$row = $db->sql_fetchrow($result);
 		$db->sql_freeresult($result);
@@ -252,8 +311,24 @@ else
 	}
 
 	// disallowed?
-	$extensions = array();
-	if (!extension_allowed($row['forum_id'], $attachment['extension'], $extensions))
+	$extensions = $cache->obtain_attach_extensions($row['forum_id']);
+
+	if ($attachments)
+	{
+		// Remove attachments with disallowed extensions
+		$new_ary = array();
+		foreach ($attachments as $attach)
+		{
+			if (isset($extensions['_allowed_'][$attach['extension']]))
+			{
+				$new_ary[] = $attach;
+			}
+		}
+
+		$attachments = $new_ary;
+	}
+
+	if (($attachments && empty($attachments)) || ($attachment && !isset($extensions['_allowed_'][$attachment['extension']])))
 	{
 		send_status_line(404, 'Forbidden');
 		trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension']));
@@ -266,71 +341,147 @@ if (!download_allowed())
 	trigger_error($user->lang['LINKAGE_FORBIDDEN']);
 }
 
-$download_mode = (int) $extensions[$attachment['extension']]['download_mode'];
+if ($attachments && sizeof($attachments) < 2)
+{
+	$attachments = false;
+	$attachment = $attachments[0];
+}
+
+if ($attachment)
+{
+	$download_mode = (int) $extensions[$attachment['extension']]['download_mode'];
+}
 
 // Fetching filename here to prevent sniffing of filename
-$sql = 'SELECT attach_id, is_orphan, in_message, post_msg_id, extension, physical_filename, real_filename, mimetype, filesize, filetime
-	FROM ' . ATTACHMENTS_TABLE . "
-	WHERE attach_id = $download_id";
-$result = $db->sql_query_limit($sql, 1);
-$attachment = $db->sql_fetchrow($result);
-$db->sql_freeresult($result);
+if ($attachment)
+{
+	$sql = 'SELECT attach_id, is_orphan, in_message, post_msg_id, extension, physical_filename, real_filename, mimetype, filesize, filetime
+		FROM ' . ATTACHMENTS_TABLE . "
+		WHERE attach_id = $download_id";
+	$result = $db->sql_query_limit($sql, 1);
+	$attachment = $db->sql_fetchrow($result);
+	$db->sql_freeresult($result);
+}
 
-if (!$attachment)
+if ($attachments)
+{
+	$attach_ids = array();
+	foreach ($attachments as $attach)
+	{
+		$attach_ids[] = $attach['attach_id'];
+	}
+	$attach_ids = implode(',', $attach_ids);
+
+	$sql = "
+		SELECT attach_id, is_orphan, in_message, post_msg_id, extension, physical_filename, real_filename, mimetype, filesize, filetime
+		FROM " . ATTACHMENTS_TABLE . "
+		WHERE attach_id IN ($attach_ids)
+	";
+	$result = $db->sql_query($sql);
+	$attachments = array();
+
+	while ($row = $db->sql_fetchrow($result))
+	{
+		$attachments[] = $row;
+	}
+
+	$db->sql_freeresult($result);
+}
+
+if (!$attachment && empty($attachments))
 {
 	send_status_line(404, 'Not Found');
 	trigger_error('ERROR_NO_ATTACHMENT');
 }
 
-$attachment['physical_filename'] = utf8_basename($attachment['physical_filename']);
-$display_cat = $extensions[$attachment['extension']]['display_cat'];
+if ($attachment)
+{
+	$attachment['physical_filename'] = utf8_basename($attachment['physical_filename']);
+	$display_cat = $extensions[$attachment['extension']]['display_cat'];
 
-if (($display_cat == ATTACHMENT_CATEGORY_IMAGE || $display_cat == ATTACHMENT_CATEGORY_THUMB) && !$user->optionget('viewimg'))
-{
-	$display_cat = ATTACHMENT_CATEGORY_NONE;
-}
-
-if ($display_cat == ATTACHMENT_CATEGORY_FLASH && !$user->optionget('viewflash'))
-{
-	$display_cat = ATTACHMENT_CATEGORY_NONE;
-}
-
-if ($thumbnail)
-{
-	$attachment['physical_filename'] = 'thumb_' . $attachment['physical_filename'];
-}
-else if (($display_cat == ATTACHMENT_CATEGORY_NONE/* || $display_cat == ATTACHMENT_CATEGORY_IMAGE*/) && !$attachment['is_orphan'] && !phpbb_http_byte_range($attachment['filesize']))
-{
-	// Update download count
-	$sql = 'UPDATE ' . ATTACHMENTS_TABLE . '
-		SET download_count = download_count + 1
-		WHERE attach_id = ' . $attachment['attach_id'];
-	$db->sql_query($sql);
-}
-
-if ($display_cat == ATTACHMENT_CATEGORY_IMAGE && $mode === 'view' && (strpos($attachment['mimetype'], 'image') === 0) && ((strpos(strtolower($user->browser), 'msie') !== false) && (strpos(strtolower($user->browser), 'msie 8.0') === false)))
-{
-	wrap_img_in_html(append_sid($phpbb_root_path . 'download/file.' . $phpEx, 'id=' . $attachment['attach_id']), $attachment['real_filename']);
-	file_gc();
-}
-else
-{
-	// Determine the 'presenting'-method
-	if ($download_mode == PHYSICAL_LINK)
+	if (($display_cat == ATTACHMENT_CATEGORY_IMAGE || $display_cat == ATTACHMENT_CATEGORY_THUMB) && !$user->optionget('viewimg'))
 	{
-		// This presenting method should no longer be used
-		if (!@is_dir($phpbb_root_path . $config['upload_path']))
-		{
-			send_status_line(500, 'Internal Server Error');
-			trigger_error($user->lang['PHYSICAL_DOWNLOAD_NOT_POSSIBLE']);
-		}
+		$display_cat = ATTACHMENT_CATEGORY_NONE;
+	}
 
-		redirect($phpbb_root_path . $config['upload_path'] . '/' . $attachment['physical_filename']);
+	if ($display_cat == ATTACHMENT_CATEGORY_FLASH && !$user->optionget('viewflash'))
+	{
+		$display_cat = ATTACHMENT_CATEGORY_NONE;
+	}
+
+	if ($thumbnail)
+	{
+		$attachment['physical_filename'] = 'thumb_' . $attachment['physical_filename'];
+	}
+	else if (($display_cat == ATTACHMENT_CATEGORY_NONE/* || $display_cat == ATTACHMENT_CATEGORY_IMAGE*/) && !$attachment['is_orphan'] && !phpbb_http_byte_range($attachment['filesize']))
+	{
+		// Update download count
+		$sql = 'UPDATE ' . ATTACHMENTS_TABLE . '
+			SET download_count = download_count + 1
+			WHERE attach_id = ' . $attachment['attach_id'];
+		$db->sql_query($sql);
+	}
+
+	if ($display_cat == ATTACHMENT_CATEGORY_IMAGE && $mode === 'view' && (strpos($attachment['mimetype'], 'image') === 0) && ((strpos(strtolower($user->browser), 'msie') !== false) && (strpos(strtolower($user->browser), 'msie 8.0') === false)))
+	{
+		wrap_img_in_html(append_sid($phpbb_root_path . 'download/file.' . $phpEx, 'id=' . $attachment['attach_id']), $attachment['real_filename']);
 		file_gc();
 	}
 	else
 	{
-		send_file_to_browser($attachment, $config['upload_path'], $display_cat);
-		file_gc();
+		// Determine the 'presenting'-method
+		if ($download_mode == PHYSICAL_LINK)
+		{
+			// This presenting method should no longer be used
+			if (!@is_dir($phpbb_root_path . $config['upload_path']))
+			{
+				send_status_line(500, 'Internal Server Error');
+				trigger_error($user->lang['PHYSICAL_DOWNLOAD_NOT_POSSIBLE']);
+			}
+
+			redirect($phpbb_root_path . $config['upload_path'] . '/' . $attachment['physical_filename']);
+			file_gc();
+		}
+		else
+		{
+			send_file_to_browser($attachment, $config['upload_path'], $display_cat);
+			file_gc();
+		}
 	}
 }
+
+if ($attachments)
+{
+	$sql = "
+		UPDATE " . ATTACHMENTS_TABLE . "
+		SET download_count = download_count + 1
+		WHERE attach_id IN ($attach_ids)
+	";
+	$db->sql_query($sql);
+
+	if (!in_array($archive, compress::methods()))
+	{
+		$archive = '.tar';
+	}
+
+	$store_name = 'att_' . time() . '_' . unique_id();
+	$archive_name = 'attachments';
+
+	if ($archive === '.zip')
+	{
+		$compress = new compress_zip('w', "{$phpbb_root_path}store/{$store_name}{$archive}");
+	}
+	else
+	{
+		$compress = new compress_tar('w', "{$phpbb_root_path}store/{$store_name}{$archive}", $archive);
+	}
+
+	foreach ($attachments as $attach)
+	{
+		$compress->add_custom_file("{$phpbb_root_path}files/{$attach['physical_filename']}", $attach['real_filename']);
+	}
+
+	$compress->close();
+	$compress->download($store_name, $archive_name);
+	file_gc();
+}
diff --git a/phpBB/includes/functions_display.php b/phpBB/includes/functions_display.php
index a1ff7a1f99..a99d2353ed 100644
--- a/phpBB/includes/functions_display.php
+++ b/phpBB/includes/functions_display.php
@@ -1285,3 +1285,33 @@ function get_user_avatar($avatar, $avatar_type, $avatar_width, $avatar_height, $
 	$avatar_img .= $avatar;
 	return '<img src="' . (str_replace(' ', '%20', $avatar_img)) . '" width="' . $avatar_width . '" height="' . $avatar_height . '" alt="' . ((!empty($user->lang[$alt])) ? $user->lang[$alt] : $alt) . '" />';
 }
+
+/**
+* Generate a list of archive types available for compressing attachments
+*
+* @param string $param_key Either topic_id or post_id
+* @param string $param_val The value of the topic or post id
+* @param string $phpbb_root_path The root path of the phpBB installation
+* @param string $phpEx The PHP extension
+*
+* @return array Array containing the link and the type of compression
+*/
+function gen_download_links($param_key, $param_val, $phpbb_root_path, $phpEx)
+{
+	$methods = compress::methods();
+	$links = array();
+
+	foreach ($methods as $method)
+	{
+		$type = array_pop(explode('.', $method));
+		$params = array('archive' => $method);
+		$params[$param_key] = $param_val;
+
+		$links[] = array(
+			'LINK' => append_sid("{$phpbb_root_path}download/file.$phpEx", $params),
+			'TYPE' => $type,
+		);
+	}
+
+	return $links;
+}
diff --git a/phpBB/styles/prosilver/template/viewtopic_body.html b/phpBB/styles/prosilver/template/viewtopic_body.html
index d27d653907..57afa55a36 100644
--- a/phpBB/styles/prosilver/template/viewtopic_body.html
+++ b/phpBB/styles/prosilver/template/viewtopic_body.html
@@ -46,7 +46,14 @@
 	<!-- ENDIF -->
 
 	<!-- IF S_HAS_ATTACHMENTS -->
-		<span>[ <a href="{U_DL_ALL_LINK}">{L_DOWNLOAD_ALL_ATTACH}</a> ]</span>
+		<div class="dl_links">
+			<strong>{L_DOWNLOAD_ALL_ATTACH}:</strong>
+			<ul>
+			<!-- BEGIN dl_method -->
+				<li>[ <a href="{dl_method.LINK}">{dl_method.TYPE}</a> ]</li>
+			<!-- END dl_method -->
+			</ul>
+		</div>
 	<!-- ENDIF -->
 
 	<!-- IF .pagination or TOTAL_POSTS -->
@@ -161,7 +168,19 @@
 
 			<!-- IF postrow.S_HAS_ATTACHMENTS -->
 				<dl class="attachbox">
-					<dt>{L_ATTACHMENTS}<!-- IF postrow.S_MULTIPLE_ATTACH --> [ <a href="{postrow.U_DL_ALL_LINK}">{L_DOWNLOAD_ALL}</a> ]<!-- ENDIF --></dt>
+					<dt>
+						{L_ATTACHMENTS}
+						<!-- IF postrow.S_MULTIPLE_ATTACH -->
+							<div class="dl_links">
+								<strong>{L_DOWNLOAD_ALL}:</strong>
+								<ul>
+								<!-- BEGIN dl_method -->
+									<li>[ <a href="{postrow.dl_method.LINK}">{postrow.dl_method.TYPE}</a> ]</li>
+								<!-- END dl_method -->
+								</ul>
+							</div>
+						<!-- ENDIF -->
+					</dt>
 					<!-- BEGIN attachment -->
 						<dd>{postrow.attachment.DISPLAY_ATTACHMENT}</dd>
 					<!-- END attachment -->
diff --git a/phpBB/styles/prosilver/theme/content.css b/phpBB/styles/prosilver/theme/content.css
index 60903911dd..b6012f8a63 100644
--- a/phpBB/styles/prosilver/theme/content.css
+++ b/phpBB/styles/prosilver/theme/content.css
@@ -702,3 +702,26 @@ dl.pmlist dd {
 	margin-left: 61% !important;
 	margin-bottom: 2px;
 }
+
+.topic-actions div.dl_links {
+	padding: 10px 0 0 10px;
+}
+
+div.dl_links {
+	display: inline-block;
+	text-transform: none;
+}
+
+.dl_links strong {
+	font-weight: bold;
+}
+
+.dl_links ul {
+	list-style-type: none;
+	margin: 0;
+	display: inline-block;
+}
+
+.dl_links li {
+	display: inline-block;
+}
diff --git a/phpBB/viewtopic.php b/phpBB/viewtopic.php
index fce1be7784..1199fc4d14 100644
--- a/phpBB/viewtopic.php
+++ b/phpBB/viewtopic.php
@@ -15,6 +15,7 @@ $phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './';
 $phpEx = substr(strrchr(__FILE__, '.'), 1);
 include($phpbb_root_path . 'common.' . $phpEx);
 include($phpbb_root_path . 'includes/functions_display.' . $phpEx);
+include($phpbb_root_path . 'includes/functions_compress.' . $phpEx);
 include($phpbb_root_path . 'includes/bbcode.' . $phpEx);
 
 // Start session management
@@ -1316,9 +1317,14 @@ if (sizeof($attach_list))
 
 $template->assign_vars(array(
 	'S_HAS_ATTACHMENTS' => !empty($attachments),
-	'U_DL_ALL_LINK' => append_sid("{$phpbb_root_path}download/file.$phpEx", "topic_id=$topic_id"),
 ));
 
+$methods = gen_download_links('topic_id', $topic_id, $phpbb_root_path, $phpEx);
+foreach ($methods as $method)
+{
+	$template->assign_block_vars('dl_method', $method);
+}
+
 // Instantiate BBCode if need be
 if ($bbcode_bitfield !== '')
 {
@@ -1573,8 +1579,6 @@ for ($i = 0, $end = sizeof($post_list); $i < $end; ++$i)
 
 		'S_IGNORE_POST'		=> ($row['hide_post']) ? true : false,
 		'L_IGNORE_POST'		=> ($row['hide_post']) ? sprintf($user->lang['POST_BY_FOE'], get_username_string('full', $poster_id, $row['username'], $row['user_colour'], $row['post_username']), '<a href="' . $viewtopic_url . "&amp;p={$row['post_id']}&amp;view=show#p{$row['post_id']}" . '">', '</a>') : '',
-
-		'U_DL_ALL_LINK'		=> append_sid("{$phpbb_root_path}download/file.$phpEx", 'post_id=' . $row['post_id']),
 	);
 
 	if (isset($cp_row['row']) && sizeof($cp_row['row']))
@@ -1602,6 +1606,12 @@ for ($i = 0, $end = sizeof($post_list); $i < $end; ++$i)
 				'DISPLAY_ATTACHMENT'	=> $attachment)
 			);
 		}
+
+		$methods = gen_download_links('post_id', $row['post_id'], $phpbb_root_path, $phpEx);
+		foreach ($methods as $method)
+		{
+			$template->assign_block_vars('postrow.dl_method', $method);
+		}
 	}
 
 	$prev_post_id = $row['post_id'];

From bbdbff1ab39ddffc0c1adcc9cf1f16093cc891e9 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Sat, 4 Aug 2012 13:57:26 +0100
Subject: [PATCH 03/75] [feature/attach-dl] Modified SQL query format and used
 sql_in_set

PHPBB3-11042
---
 phpBB/download/file.php | 41 +++++++++++++++--------------------------
 1 file changed, 15 insertions(+), 26 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 243d276607..25fd9945ec 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -173,13 +173,11 @@ if ($download_id)
 
 if ($topic_id)
 {
-	$sql = "
-		SELECT attach_id, in_message, post_msg_id, extension, is_orphan, a.poster_id, filetime
-		FROM " . POSTS_TABLE . " p, " . ATTACHMENTS_TABLE . " a
+	$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, a.poster_id, filetime
+		FROM ' . POSTS_TABLE . ' p, ' . ATTACHMENTS_TABLE . " a
 		WHERE p.topic_id = $topic_id
-		AND p.post_attachment = 1
-		AND a.post_msg_id = p.post_id
-	";
+			AND p.post_attachment = 1
+			AND a.post_msg_id = p.post_id";
 	$result = $db->sql_query($sql);
 
 	while ($row = $db->sql_fetchrow($result))
@@ -192,11 +190,9 @@ if ($topic_id)
 
 if ($post_id)
 {
-	$sql = "
-		SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
-		FROM " . ATTACHMENTS_TABLE . "
-		WHERE post_msg_id = $post_id
-	";
+	$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
+		FROM ' . ATTACHMENTS_TABLE . "
+		WHERE post_msg_id = $post_id";
 	$result = $db->sql_query($sql);
 
 	while ($row = $db->sql_fetchrow($result))
@@ -249,12 +245,10 @@ else
 
 		if ($topic_id)
 		{
-			$sql = "
-				SELECT t.forum_id, f.forum_password, f.parent_id
-				FROM " . TOPICS_TABLE . " t, " . FORUMS_TABLE . " f
+			$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
+				FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
 				WHERE t.topic_id = $topic_id
-				AND t.forum_id = f.forum_id
-			";
+					AND t.forum_id = f.forum_id";
 		}
 		
 		$result = $db->sql_query_limit($sql, 1);
@@ -370,13 +364,10 @@ if ($attachments)
 	{
 		$attach_ids[] = $attach['attach_id'];
 	}
-	$attach_ids = implode(',', $attach_ids);
 
-	$sql = "
-		SELECT attach_id, is_orphan, in_message, post_msg_id, extension, physical_filename, real_filename, mimetype, filesize, filetime
-		FROM " . ATTACHMENTS_TABLE . "
-		WHERE attach_id IN ($attach_ids)
-	";
+	$sql = 'SELECT attach_id, is_orphan, in_message, post_msg_id, extension, physical_filename, real_filename, mimetype, filesize, filetime
+		FROM ' . ATTACHMENTS_TABLE . '
+		WHERE ' . $db->sql_in_set('attach_id', $attach_ids);
 	$result = $db->sql_query($sql);
 	$attachments = array();
 
@@ -452,11 +443,9 @@ if ($attachment)
 
 if ($attachments)
 {
-	$sql = "
-		UPDATE " . ATTACHMENTS_TABLE . "
+	$sql = 'UPDATE ' . ATTACHMENTS_TABLE . '
 		SET download_count = download_count + 1
-		WHERE attach_id IN ($attach_ids)
-	";
+		WHERE ' . $db->sql_in_set('attach_id', $attach_ids);
 	$db->sql_query($sql);
 
 	if (!in_array($archive, compress::methods()))

From 18d7210a11b4d98c50ad55bb427c8cd2cc14a2f1 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Sat, 4 Aug 2012 13:58:50 +0100
Subject: [PATCH 04/75] [feature/attach-dl] Prefixed gen_download_links with
 phpbb_

PHPBB3-11042
---
 phpBB/includes/functions_display.php | 2 +-
 phpBB/viewtopic.php                  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/phpBB/includes/functions_display.php b/phpBB/includes/functions_display.php
index a99d2353ed..6164885732 100644
--- a/phpBB/includes/functions_display.php
+++ b/phpBB/includes/functions_display.php
@@ -1296,7 +1296,7 @@ function get_user_avatar($avatar, $avatar_type, $avatar_width, $avatar_height, $
 *
 * @return array Array containing the link and the type of compression
 */
-function gen_download_links($param_key, $param_val, $phpbb_root_path, $phpEx)
+function phpbb_gen_download_links($param_key, $param_val, $phpbb_root_path, $phpEx)
 {
 	$methods = compress::methods();
 	$links = array();
diff --git a/phpBB/viewtopic.php b/phpBB/viewtopic.php
index 1199fc4d14..a4d7c8baa1 100644
--- a/phpBB/viewtopic.php
+++ b/phpBB/viewtopic.php
@@ -1319,7 +1319,7 @@ $template->assign_vars(array(
 	'S_HAS_ATTACHMENTS' => !empty($attachments),
 ));
 
-$methods = gen_download_links('topic_id', $topic_id, $phpbb_root_path, $phpEx);
+$methods = phpbb_gen_download_links('topic_id', $topic_id, $phpbb_root_path, $phpEx);
 foreach ($methods as $method)
 {
 	$template->assign_block_vars('dl_method', $method);
@@ -1607,7 +1607,7 @@ for ($i = 0, $end = sizeof($post_list); $i < $end; ++$i)
 			);
 		}
 
-		$methods = gen_download_links('post_id', $row['post_id'], $phpbb_root_path, $phpEx);
+		$methods = phpbb_gen_download_links('post_id', $row['post_id'], $phpbb_root_path, $phpEx);
 		foreach ($methods as $method)
 		{
 			$template->assign_block_vars('postrow.dl_method', $method);

From 0cad61efbf5292e61c8ad73f7aa334854ecee25c Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Sat, 4 Aug 2012 14:08:49 +0100
Subject: [PATCH 05/75] [feature/attach-dl] Added table prefix to columns

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 25fd9945ec..2346f9357c 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -173,7 +173,7 @@ if ($download_id)
 
 if ($topic_id)
 {
-	$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, a.poster_id, filetime
+	$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
 		FROM ' . POSTS_TABLE . ' p, ' . ATTACHMENTS_TABLE . " a
 		WHERE p.topic_id = $topic_id
 			AND p.post_attachment = 1

From 20a2ceccbdbb47229750735bfcdf2a5d05353d95 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Sat, 4 Aug 2012 14:10:26 +0100
Subject: [PATCH 06/75] [feature/attach-dl] Initialised arrays if they're used

PHPBB3-11042
---
 phpBB/download/file.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 2346f9357c..f360132b0f 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -158,8 +158,8 @@ if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
 	trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
 }
 
-$attachment = false;
-$attachments = false;
+$attachment = ($download_id) ? array() : false;
+$attachments = ($topic_id || $post_id) ? array() : false;
 
 if ($download_id)
 {

From ed1435d04093132b751e940937e7f4f4b0687031 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Sat, 4 Aug 2012 14:48:07 +0100
Subject: [PATCH 07/75] [feature/attach-dl] Added function for incrementing
 download counter

PHPBB3-11042
---
 phpBB/download/file.php               | 10 ++--------
 phpBB/includes/functions_download.php | 21 +++++++++++++++++++++
 2 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index f360132b0f..cec4aa55b3 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -407,10 +407,7 @@ if ($attachment)
 	else if (($display_cat == ATTACHMENT_CATEGORY_NONE/* || $display_cat == ATTACHMENT_CATEGORY_IMAGE*/) && !$attachment['is_orphan'] && !phpbb_http_byte_range($attachment['filesize']))
 	{
 		// Update download count
-		$sql = 'UPDATE ' . ATTACHMENTS_TABLE . '
-			SET download_count = download_count + 1
-			WHERE attach_id = ' . $attachment['attach_id'];
-		$db->sql_query($sql);
+		phpbb_increment_downloads($db, $attachment['attach_id']);
 	}
 
 	if ($display_cat == ATTACHMENT_CATEGORY_IMAGE && $mode === 'view' && (strpos($attachment['mimetype'], 'image') === 0) && ((strpos(strtolower($user->browser), 'msie') !== false) && (strpos(strtolower($user->browser), 'msie 8.0') === false)))
@@ -443,10 +440,7 @@ if ($attachment)
 
 if ($attachments)
 {
-	$sql = 'UPDATE ' . ATTACHMENTS_TABLE . '
-		SET download_count = download_count + 1
-		WHERE ' . $db->sql_in_set('attach_id', $attach_ids);
-	$db->sql_query($sql);
+	phpbb_increment_downloads($db, $attach_ids);
 
 	if (!in_array($archive, compress::methods()))
 	{
diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index 1486113013..b01712357d 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -592,3 +592,24 @@ function phpbb_parse_range_request($request_array, $filesize)
 		);
 	}
 }
+
+/**
+* Increments the download count of all provided attachments
+*
+* @param dbal $db The database object
+* @param array|int $ids The attach_id of each attachment
+*
+* @return null
+*/
+function phpbb_increment_downloads($db, $ids)
+{
+	if (!is_array($ids))
+	{
+		$ids = array($ids);
+	}
+
+	$sql = 'UPDATE ' . ATTACHMENTS_TABLE . '
+		SET download_count = download_count + 1
+		WHERE ' . $db->sql_in_set('attach_id', $ids);
+	$db->sql_query($sql);
+}

From 50af76da7db5e1719349b3b5e89610b82aa9cbc6 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Sat, 4 Aug 2012 14:51:11 +0100
Subject: [PATCH 08/75] [feature/attach-dl] Ensure only one operation is
 performed

PHPBB3-11042
---
 phpBB/download/file.php | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index cec4aa55b3..8108b0dee1 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -141,6 +141,18 @@ $archive = $request->variable('archive', '.tar');
 $mode = request_var('mode', '');
 $thumbnail = request_var('t', false);
 
+// Ensure we're only performing one operation
+if ($download_id)
+{
+	$topic_id = false;
+	$post_id = false;
+}
+
+if ($post_id)
+{
+	$topic_id = false;
+}
+
 // Start session management, do not update session page.
 $user->session_begin(false);
 $auth->acl($user->data);

From 16ec660e769360a8cd7063ea083487486051101f Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Sat, 4 Aug 2012 15:29:26 +0100
Subject: [PATCH 09/75] [feature/attach-dl] Added a function for checking
 allowed extensions

PHPBB3-11042
---
 phpBB/download/file.php               | 24 +++++++++---------------
 phpBB/includes/functions_download.php | 23 +++++++++++++++++++++++
 2 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 8108b0dee1..6dfa1d7297 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -318,26 +318,20 @@ else
 
 	// disallowed?
 	$extensions = $cache->obtain_attach_extensions($row['forum_id']);
-
-	if ($attachments)
+	if ($attachment)
 	{
-		// Remove attachments with disallowed extensions
-		$new_ary = array();
-		foreach ($attachments as $attach)
-		{
-			if (isset($extensions['_allowed_'][$attach['extension']]))
-			{
-				$new_ary[] = $attach;
-			}
-		}
-
-		$attachments = $new_ary;
+		$ary = array($attachment);
+	}
+	else
+	{
+		$ary = &$attachments;
 	}
 
-	if (($attachments && empty($attachments)) || ($attachment && !isset($extensions['_allowed_'][$attachment['extension']])))
+	if (!phpbb_check_attach_extensions($extensions, $ary))
 	{
 		send_status_line(404, 'Forbidden');
-		trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension']));
+		$ext = ($attachment) ? $attachment['extension'] : $attachments[0]['extension'];
+		trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $ext));
 	}
 }
 
diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index b01712357d..7d21147ab5 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -613,3 +613,26 @@ function phpbb_increment_downloads($db, $ids)
 		WHERE ' . $db->sql_in_set('attach_id', $ids);
 	$db->sql_query($sql);
 }
+
+/**
+* Checks every attachment to see if it has an allowed extension
+*
+* @param array $extensions As generated by phpbb_cache_service::obtain_attach_extensions
+* @param array &$attachments An array of attachments to check
+*
+* @return bool Whether any of the attachments had allowed extensions
+*/
+function phpbb_check_attach_extensions($extensions, &$attachments)
+{
+	$new_ary = array();
+	foreach ($attachments as $attach)
+	{
+		if (isset($extensions['_allowed_'][$attach['extension']]))
+		{
+			$new_ary[] = $attach;
+		}
+	}
+
+	$attachments = $new_ary;
+	return !empty($attachments);
+}

From aa87258cc6503f4c9b2f64a69614b4e5f2a21da5 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Sat, 4 Aug 2012 15:44:10 +0100
Subject: [PATCH 10/75] [feature/attach-dl] Used sql_fetchrowset

PHPBB3-11042
---
 phpBB/download/file.php | 25 ++++++-------------------
 1 file changed, 6 insertions(+), 19 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 6dfa1d7297..28a89b2374 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -190,13 +190,9 @@ if ($topic_id)
 		WHERE p.topic_id = $topic_id
 			AND p.post_attachment = 1
 			AND a.post_msg_id = p.post_id";
+
 	$result = $db->sql_query($sql);
-
-	while ($row = $db->sql_fetchrow($result))
-	{
-		$attachments[] = $row;
-	}
-
+	$attachments = $db->sql_fetchrowset($result);
 	$db->sql_freeresult($result);
 }
 
@@ -205,13 +201,9 @@ if ($post_id)
 	$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
 		FROM ' . ATTACHMENTS_TABLE . "
 		WHERE post_msg_id = $post_id";
+
 	$result = $db->sql_query($sql);
-
-	while ($row = $db->sql_fetchrow($result))
-	{
-		$attachments[] = $row;
-	}
-
+	$attachments = $db->sql_fetchrowset($result);
 	$db->sql_freeresult($result);
 }
 
@@ -374,14 +366,9 @@ if ($attachments)
 	$sql = 'SELECT attach_id, is_orphan, in_message, post_msg_id, extension, physical_filename, real_filename, mimetype, filesize, filetime
 		FROM ' . ATTACHMENTS_TABLE . '
 		WHERE ' . $db->sql_in_set('attach_id', $attach_ids);
+
 	$result = $db->sql_query($sql);
-	$attachments = array();
-
-	while ($row = $db->sql_fetchrow($result))
-	{
-		$attachments[] = $row;
-	}
-
+	$attachments = $db->sql_fetchrowset($result);
 	$db->sql_freeresult($result);
 }
 

From 155b584a68f21d88c5011a3bb3ec9bb118c9c1ca Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Sat, 4 Aug 2012 15:58:58 +0100
Subject: [PATCH 11/75] [feature/attach-dl] Only include compress class when
 needed

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 28a89b2374..6332095df8 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -132,7 +132,6 @@ if (isset($_GET['avatar']))
 // implicit else: we are not in avatar mode
 include($phpbb_root_path . 'common.' . $phpEx);
 require($phpbb_root_path . 'includes/functions_download' . '.' . $phpEx);
-require($phpbb_root_path . 'includes/functions_compress.' . $phpEx);
 
 $download_id = request_var('id', 0);
 $topic_id = $request->variable('topic_id', 0);
@@ -433,6 +432,7 @@ if ($attachment)
 
 if ($attachments)
 {
+	require_once $phpbb_root_path . 'includes/functions_compress.' . $phpEx;
 	phpbb_increment_downloads($db, $attach_ids);
 
 	if (!in_array($archive, compress::methods()))

From 3fe8344104d867a0ce5ec2ba9eebddf7cdc9f143 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 00:07:22 +0200
Subject: [PATCH 12/75] [feature/attach-dl] Use "else if" for precedence in
 case of multiple arguments.

PHPBB3-11042
---
 phpBB/download/file.php | 36 ++++++++++++------------------------
 1 file changed, 12 insertions(+), 24 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 6332095df8..d8ee4082a5 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -140,18 +140,6 @@ $archive = $request->variable('archive', '.tar');
 $mode = request_var('mode', '');
 $thumbnail = request_var('t', false);
 
-// Ensure we're only performing one operation
-if ($download_id)
-{
-	$topic_id = false;
-	$post_id = false;
-}
-
-if ($post_id)
-{
-	$topic_id = false;
-}
-
 // Start session management, do not update session page.
 $user->session_begin(false);
 $auth->acl($user->data);
@@ -172,6 +160,8 @@ if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
 $attachment = ($download_id) ? array() : false;
 $attachments = ($topic_id || $post_id) ? array() : false;
 
+// If multiple arguments are provided, the precedence is as follows:
+// $download_id, $post_id, $topic_id
 if ($download_id)
 {
 	$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
@@ -181,8 +171,17 @@ if ($download_id)
 	$attachment = $db->sql_fetchrow($result);
 	$db->sql_freeresult($result);
 }
+else if ($post_id)
+{
+	$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
+		FROM ' . ATTACHMENTS_TABLE . "
+		WHERE post_msg_id = $post_id";
 
-if ($topic_id)
+	$result = $db->sql_query($sql);
+	$attachments = $db->sql_fetchrowset($result);
+	$db->sql_freeresult($result);
+}
+else if ($topic_id)
 {
 	$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
 		FROM ' . POSTS_TABLE . ' p, ' . ATTACHMENTS_TABLE . " a
@@ -195,17 +194,6 @@ if ($topic_id)
 	$db->sql_freeresult($result);
 }
 
-if ($post_id)
-{
-	$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
-		FROM ' . ATTACHMENTS_TABLE . "
-		WHERE post_msg_id = $post_id";
-
-	$result = $db->sql_query($sql);
-	$attachments = $db->sql_fetchrowset($result);
-	$db->sql_freeresult($result);
-}
-
 if (!$attachment && !$attachments)
 {
 	send_status_line(404, 'Not Found');

From 2d32164fb074e12f12a38cc41f424611551d9573 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 00:10:24 +0200
Subject: [PATCH 13/75] [feature/attach-dl] Remove unnecessary LIMIT from
 primary key query.

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index d8ee4082a5..f540869a1e 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -167,7 +167,7 @@ if ($download_id)
 	$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
 		FROM ' . ATTACHMENTS_TABLE . "
 		WHERE attach_id = $download_id";
-	$result = $db->sql_query_limit($sql, 1);
+	$result = $db->sql_query($sql);
 	$attachment = $db->sql_fetchrow($result);
 	$db->sql_freeresult($result);
 }

From 862502aacd36918ba9c9d5524e625c02a3830897 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 00:31:18 +0200
Subject: [PATCH 14/75] [feature/attach-dl] Use table aliases in all three
 cases.

PHPBB3-11042
---
 phpBB/download/file.php | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index f540869a1e..bd96ad02f7 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -164,18 +164,18 @@ $attachments = ($topic_id || $post_id) ? array() : false;
 // $download_id, $post_id, $topic_id
 if ($download_id)
 {
-	$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
-		FROM ' . ATTACHMENTS_TABLE . "
-		WHERE attach_id = $download_id";
+	$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
+		FROM ' . ATTACHMENTS_TABLE . " a
+		WHERE a.attach_id = $download_id";
 	$result = $db->sql_query($sql);
 	$attachment = $db->sql_fetchrow($result);
 	$db->sql_freeresult($result);
 }
 else if ($post_id)
 {
-	$sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime
-		FROM ' . ATTACHMENTS_TABLE . "
-		WHERE post_msg_id = $post_id";
+	$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
+		FROM ' . ATTACHMENTS_TABLE . " a
+		WHERE a.post_msg_id = $post_id";
 
 	$result = $db->sql_query($sql);
 	$attachments = $db->sql_fetchrowset($result);

From 5986676f4dd59f9b5c69a37ee392575d7f7f0375 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 00:33:23 +0200
Subject: [PATCH 15/75] [feature/attach-dl] Exploit the "if ... else if ..."
 for the error message.

Use an "else" statement instead of checking everything at the top.

PHPBB3-11042
---
 phpBB/download/file.php | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index bd96ad02f7..bddd6a27aa 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -145,12 +145,6 @@ $user->session_begin(false);
 $auth->acl($user->data);
 $user->setup('viewtopic');
 
-if (!$download_id && !$post_id && !$topic_id)
-{
-	send_status_line(404, 'Not Found');
-	trigger_error('NO_ATTACHMENT_SELECTED');
-}
-
 if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
 {
 	send_status_line(404, 'Not Found');
@@ -193,6 +187,11 @@ else if ($topic_id)
 	$attachments = $db->sql_fetchrowset($result);
 	$db->sql_freeresult($result);
 }
+else
+{
+	send_status_line(404, 'Not Found');
+	trigger_error('NO_ATTACHMENT_SELECTED');
+}
 
 if (!$attachment && !$attachments)
 {

From 56cd7e54756b743e1e2f7587fe574c1a2c395add Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 01:03:32 +0200
Subject: [PATCH 16/75] [feature/attach-dl] Store query result always in
 $attachments first.

PHPBB3-11042
---
 phpBB/download/file.php | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index bddd6a27aa..e50c4e18b2 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -151,9 +151,6 @@ if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
 	trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
 }
 
-$attachment = ($download_id) ? array() : false;
-$attachments = ($topic_id || $post_id) ? array() : false;
-
 // If multiple arguments are provided, the precedence is as follows:
 // $download_id, $post_id, $topic_id
 if ($download_id)
@@ -162,7 +159,7 @@ if ($download_id)
 		FROM ' . ATTACHMENTS_TABLE . " a
 		WHERE a.attach_id = $download_id";
 	$result = $db->sql_query($sql);
-	$attachment = $db->sql_fetchrow($result);
+	$attachments = $db->sql_fetchrowset($result);
 	$db->sql_freeresult($result);
 }
 else if ($post_id)
@@ -193,11 +190,15 @@ else
 	trigger_error('NO_ATTACHMENT_SELECTED');
 }
 
-if (!$attachment && !$attachments)
+if (empty($attachments))
 {
 	send_status_line(404, 'Not Found');
 	trigger_error('ERROR_NO_ATTACHMENT');
 }
+else if ($download_id)
+{
+	$attachment = current($attachments);
+}
 
 if ($attachment && ((!$attachment['in_message'] && !$config['allow_attachments']) || ($attachment['in_message'] && !$config['allow_pm_attach'])))
 {

From 940b9e0658348be7c66b7f5375f086f2d370abb2 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 01:12:19 +0200
Subject: [PATCH 17/75] [feature/attach-dl] Combine download_id and post_id
 queries.

PHPBB3-11042
---
 phpBB/download/file.php | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index e50c4e18b2..0978f93402 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -153,21 +153,11 @@ if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
 
 // If multiple arguments are provided, the precedence is as follows:
 // $download_id, $post_id, $topic_id
-if ($download_id)
+if ($download_id || $post_id)
 {
 	$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
-		FROM ' . ATTACHMENTS_TABLE . " a
-		WHERE a.attach_id = $download_id";
-	$result = $db->sql_query($sql);
-	$attachments = $db->sql_fetchrowset($result);
-	$db->sql_freeresult($result);
-}
-else if ($post_id)
-{
-	$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
-		FROM ' . ATTACHMENTS_TABLE . " a
-		WHERE a.post_msg_id = $post_id";
-
+		FROM ' . ATTACHMENTS_TABLE . ' a
+		WHERE ' . ($download_id ? "a.attach_id = $download_id" : "a.post_msg_id = $post_id");
 	$result = $db->sql_query($sql);
 	$attachments = $db->sql_fetchrowset($result);
 	$db->sql_freeresult($result);
@@ -179,7 +169,6 @@ else if ($topic_id)
 		WHERE p.topic_id = $topic_id
 			AND p.post_attachment = 1
 			AND a.post_msg_id = p.post_id";
-
 	$result = $db->sql_query($sql);
 	$attachments = $db->sql_fetchrowset($result);
 	$db->sql_freeresult($result);

From 87c822b79448bf375bc76c383d7d9a3606074b19 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 01:47:25 +0200
Subject: [PATCH 18/75] [feature/attach-dl] Also merge topic_id query.
 a.topic_id can be used.

PHPBB3-11042
---
 phpBB/download/file.php | 37 ++++++++++++++++++++++---------------
 1 file changed, 22 insertions(+), 15 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 0978f93402..75ff708b16 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -151,24 +151,31 @@ if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
 	trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
 }
 
-// If multiple arguments are provided, the precedence is as follows:
-// $download_id, $post_id, $topic_id
-if ($download_id || $post_id)
+if ($download_id || $post_id || $topic_id)
 {
 	$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
 		FROM ' . ATTACHMENTS_TABLE . ' a
-		WHERE ' . ($download_id ? "a.attach_id = $download_id" : "a.post_msg_id = $post_id");
-	$result = $db->sql_query($sql);
-	$attachments = $db->sql_fetchrowset($result);
-	$db->sql_freeresult($result);
-}
-else if ($topic_id)
-{
-	$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
-		FROM ' . POSTS_TABLE . ' p, ' . ATTACHMENTS_TABLE . " a
-		WHERE p.topic_id = $topic_id
-			AND p.post_attachment = 1
-			AND a.post_msg_id = p.post_id";
+		WHERE ';
+
+	switch (true)
+	{
+		default:
+		case $download_id:
+			// Attachment id (only 1 attachment)
+			$sql .= "a.attach_id = $download_id";
+		break;
+
+		case $post_id:
+			// Post id or private message id (multiple attachments)
+			$sql .= "a.post_msg_id = $post_id";
+		break;
+
+		case $topic_id:
+			// Topic id (multiple attachments)
+			$sql .= "a.topic_id = $topic_id";
+		break;
+	}
+
 	$result = $db->sql_query($sql);
 	$attachments = $db->sql_fetchrowset($result);
 	$db->sql_freeresult($result);

From 60d382df4c9ce50447b07abf04ed97a6319b14b0 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 02:10:15 +0200
Subject: [PATCH 19/75] [feature/attach-dl] Putting some old code under "else
 if ($download_id)".

PHPBB3-11042
---
 phpBB/download/file.php | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 75ff708b16..4f6bc6738c 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -193,13 +193,19 @@ if (empty($attachments))
 }
 else if ($download_id)
 {
+	// sizeof($attachments) == 1
 	$attachment = current($attachments);
-}
 
-if ($attachment && ((!$attachment['in_message'] && !$config['allow_attachments']) || ($attachment['in_message'] && !$config['allow_pm_attach'])))
+	// in_message = 1 means it's in a private message
+	if (!$attachment['in_message'] && !$config['allow_attachments'] || $attachment['in_message'] && !$config['allow_pm_attach'])
+	{
+		send_status_line(404, 'Not Found');
+		trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
+	}
+}
+else
 {
-	send_status_line(404, 'Not Found');
-	trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
+	// sizeof($attachments) > 1
 }
 
 $row = array();

From ecab0212f8dbea04cd9a9a34a597db246a5290cd Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 02:36:20 +0200
Subject: [PATCH 20/75] [feature/attach-dl] Putting more old code under "else
 if ($download_id)".

PHPBB3-11042
---
 phpBB/download/file.php | 193 ++++++++++++++++++++++------------------
 1 file changed, 106 insertions(+), 87 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 4f6bc6738c..67f315dd2f 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -196,123 +196,142 @@ else if ($download_id)
 	// sizeof($attachments) == 1
 	$attachment = current($attachments);
 
-	// in_message = 1 means it's in a private message
 	if (!$attachment['in_message'] && !$config['allow_attachments'] || $attachment['in_message'] && !$config['allow_pm_attach'])
 	{
 		send_status_line(404, 'Not Found');
 		trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
 	}
-}
-else
-{
-	// sizeof($attachments) > 1
-}
 
-$row = array();
-
-if ($attachment && $attachment['is_orphan'])
-{
-	// We allow admins having attachment permissions to see orphan attachments...
-	$own_attachment = ($auth->acl_get('a_attach') || $attachment['poster_id'] == $user->data['user_id']) ? true : false;
-
-	if (!$own_attachment || ($attachment['in_message'] && !$auth->acl_get('u_pm_download')) || (!$attachment['in_message'] && !$auth->acl_get('u_download')))
+	if ($attachment['is_orphan'])
 	{
-		send_status_line(404, 'Not Found');
-		trigger_error('ERROR_NO_ATTACHMENT');
+		// We allow admins having attachment permissions to see orphan attachments...
+		$own_attachment = ($auth->acl_get('a_attach') || $attachment['poster_id'] == $user->data['user_id']) ? true : false;
+
+		if (!$own_attachment || ($attachment['in_message'] && !$auth->acl_get('u_pm_download')) || (!$attachment['in_message'] && !$auth->acl_get('u_download')))
+		{
+			send_status_line(404, 'Not Found');
+			trigger_error('ERROR_NO_ATTACHMENT');
+		}
+
+		// Obtain all extensions...
+		$extensions = $cache->obtain_attach_extensions(true);
 	}
-
-	// Obtain all extensions...
-	$extensions = $cache->obtain_attach_extensions(true);
-}
-else
-{
-	if ($attachments || ($attachment && !$attachment['in_message']))
+	else
 	{
-		if ($download_id || $post_id)
+		if (!$attachment['in_message'])
 		{
 			$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
 				FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f
-				WHERE p.post_id = ' . (($attachment) ? $attachment['post_msg_id'] : $post_id) . '
-					AND p.forum_id = f.forum_id';
-		}
+				WHERE p.post_id = ' . $attachment['post_msg_id'] . '
+				AND p.forum_id = f.forum_id';
+			$result = $db->sql_query_limit($sql, 1);
+			$row = $db->sql_fetchrow($result);
+			$db->sql_freeresult($result);
 
-		if ($topic_id)
-		{
-			$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
-				FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
-				WHERE t.topic_id = $topic_id
-					AND t.forum_id = f.forum_id";
-		}
-		
-		$result = $db->sql_query_limit($sql, 1);
-		$row = $db->sql_fetchrow($result);
-		$db->sql_freeresult($result);
+			$f_download = $auth->acl_get('f_download', $row['forum_id']);
 
-		$f_download = $auth->acl_get('f_download', $row['forum_id']);
-
-		if ($auth->acl_get('u_download') && $f_download)
-		{
-			if ($row && $row['forum_password'])
+			if ($auth->acl_get('u_download') && $f_download)
 			{
-				// Do something else ... ?
-				login_forum_box($row);
+				if ($row && $row['forum_password'])
+				{
+					// Do something else ... ?
+					login_forum_box($row);
+				}
+			}
+			else
+			{
+				send_status_line(403, 'Forbidden');
+				trigger_error('SORRY_AUTH_VIEW_ATTACH');
 			}
 		}
 		else
 		{
-			send_status_line(403, 'Forbidden');
-			trigger_error('SORRY_AUTH_VIEW_ATTACH');
-		}
-	}
-	else
-	{
-		$row['forum_id'] = false;
-		if (!$auth->acl_get('u_pm_download'))
-		{
-			send_status_line(403, 'Forbidden');
-			trigger_error('SORRY_AUTH_VIEW_ATTACH');
-		}
-
-		// Check if the attachment is within the users scope...
-		$sql = 'SELECT user_id, author_id
-			FROM ' . PRIVMSGS_TO_TABLE . '
-			WHERE msg_id = ' . $attachment['post_msg_id'];
-		$result = $db->sql_query($sql);
-
-		$allowed = false;
-		while ($user_row = $db->sql_fetchrow($result))
-		{
-			if ($user->data['user_id'] == $user_row['user_id'] || $user->data['user_id'] == $user_row['author_id'])
+			// Attachment is in a private message.
+			$row['forum_id'] = false;
+			if (!$auth->acl_get('u_pm_download'))
 			{
-				$allowed = true;
-				break;
+				send_status_line(403, 'Forbidden');
+				trigger_error('SORRY_AUTH_VIEW_ATTACH');
+			}
+
+			// Check if the attachment is within the users scope...
+			$sql = 'SELECT user_id, author_id
+				FROM ' . PRIVMSGS_TO_TABLE . '
+				WHERE msg_id = ' . $attachment['post_msg_id'];
+			$result = $db->sql_query($sql);
+
+			$allowed = false;
+			while ($user_row = $db->sql_fetchrow($result))
+			{
+				if ($user->data['user_id'] == $user_row['user_id'] || $user->data['user_id'] == $user_row['author_id'])
+				{
+					$allowed = true;
+					break;
+				}
+			}
+			$db->sql_freeresult($result);
+
+			if (!$allowed)
+			{
+				send_status_line(403, 'Forbidden');
+				trigger_error('ERROR_NO_ATTACHMENT');
 			}
 		}
-		$db->sql_freeresult($result);
 
-		if (!$allowed)
+		// disallowed?
+		$extensions = $cache->obtain_attach_extensions($row['forum_id']);
+		if ($attachment)
 		{
-			send_status_line(403, 'Forbidden');
-			trigger_error('ERROR_NO_ATTACHMENT');
+			$ary = array($attachment);
+		}
+		else
+		{
+			$ary = &$attachments;
+		}
+
+		if (!phpbb_check_attach_extensions($extensions, $ary))
+		{
+			send_status_line(404, 'Forbidden');
+			trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension']));
 		}
 	}
-
-	// disallowed?
-	$extensions = $cache->obtain_attach_extensions($row['forum_id']);
-	if ($attachment)
+}
+else
+{
+	// sizeof($attachments) > 1
+	if ($post_id)
 	{
-		$ary = array($attachment);
+		$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
+			FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f
+			WHERE p.post_id = ' . (($attachment) ? $attachment['post_msg_id'] : $post_id) . '
+				AND p.forum_id = f.forum_id';
+	}
+	else if ($topic_id)
+	{
+		$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
+			FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
+			WHERE t.topic_id = $topic_id
+				AND t.forum_id = f.forum_id";
+	}
+
+	$result = $db->sql_query_limit($sql, 1);
+	$row = $db->sql_fetchrow($result);
+	$db->sql_freeresult($result);
+
+	$f_download = $auth->acl_get('f_download', $row['forum_id']);
+
+	if ($auth->acl_get('u_download') && $f_download)
+	{
+		if ($row && $row['forum_password'])
+		{
+			// Do something else ... ?
+			login_forum_box($row);
+		}
 	}
 	else
 	{
-		$ary = &$attachments;
-	}
-
-	if (!phpbb_check_attach_extensions($extensions, $ary))
-	{
-		send_status_line(404, 'Forbidden');
-		$ext = ($attachment) ? $attachment['extension'] : $attachments[0]['extension'];
-		trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $ext));
+		send_status_line(403, 'Forbidden');
+		trigger_error('SORRY_AUTH_VIEW_ATTACH');
 	}
 }
 

From b6d4ee4244602183f99d57ee154757cd68c7eb75 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 02:37:08 +0200
Subject: [PATCH 21/75] [feature/attach-dl] Move !download_allowed() check up.

PHPBB3-11042
---
 phpBB/download/file.php | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 67f315dd2f..23e8327a22 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -191,6 +191,11 @@ if (empty($attachments))
 	send_status_line(404, 'Not Found');
 	trigger_error('ERROR_NO_ATTACHMENT');
 }
+else if (!download_allowed())
+{
+	send_status_line(403, 'Forbidden');
+	trigger_error($user->lang['LINKAGE_FORBIDDEN']);
+}
 else if ($download_id)
 {
 	// sizeof($attachments) == 1
@@ -335,12 +340,6 @@ else
 	}
 }
 
-if (!download_allowed())
-{
-	send_status_line(403, 'Forbidden');
-	trigger_error($user->lang['LINKAGE_FORBIDDEN']);
-}
-
 if ($attachments && sizeof($attachments) < 2)
 {
 	$attachments = false;

From bba348d68a3114c3c6cad6f1d92855084ce8fa64 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 02:47:18 +0200
Subject: [PATCH 22/75] [feature/attach-dl] phpbb_check_attach_extensions: Get
 rid of pass-by-reference

PHPBB3-11042
---
 phpBB/download/file.php               | 11 ++---------
 phpBB/includes/functions_download.php | 17 ++++++++---------
 2 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 23e8327a22..7044400f90 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -285,16 +285,9 @@ else if ($download_id)
 
 		// disallowed?
 		$extensions = $cache->obtain_attach_extensions($row['forum_id']);
-		if ($attachment)
-		{
-			$ary = array($attachment);
-		}
-		else
-		{
-			$ary = &$attachments;
-		}
 
-		if (!phpbb_check_attach_extensions($extensions, $ary))
+		$attachments_filtered = phpbb_filter_disallowed_extensions($extensions, array($attachment));
+		if (empty($attachments_filtered))
 		{
 			send_status_line(404, 'Forbidden');
 			trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension']));
diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index 7d21147ab5..74c8be5f7b 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -618,21 +618,20 @@ function phpbb_increment_downloads($db, $ids)
 * Checks every attachment to see if it has an allowed extension
 *
 * @param array $extensions As generated by phpbb_cache_service::obtain_attach_extensions
-* @param array &$attachments An array of attachments to check
+* @param array $attachments An array of attachment row to check
 *
-* @return bool Whether any of the attachments had allowed extensions
+* @return array Array of attachment rows with allowed extension
 */
-function phpbb_check_attach_extensions($extensions, &$attachments)
+function phpbb_filter_disallowed_extensions($extensions, $attachments)
 {
-	$new_ary = array();
-	foreach ($attachments as $attach)
+	$result = array();
+	foreach ($attachments as $row)
 	{
-		if (isset($extensions['_allowed_'][$attach['extension']]))
+		if (isset($extensions['_allowed_'][$row['extension']]))
 		{
-			$new_ary[] = $attach;
+			$result[] = $row;
 		}
 	}
 
-	$attachments = $new_ary;
-	return !empty($attachments);
+	return $result;
 }

From 89c102a744ba9ea3eafefd47fd375342bcf6bbe4 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 02:48:49 +0200
Subject: [PATCH 23/75] [feature/attach-dl] phpbb_filter_disallowed_extensions:
 Preserve array keys.

PHPBB3-11042
---
 phpBB/includes/functions_download.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index 74c8be5f7b..8453469e83 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -625,11 +625,11 @@ function phpbb_increment_downloads($db, $ids)
 function phpbb_filter_disallowed_extensions($extensions, $attachments)
 {
 	$result = array();
-	foreach ($attachments as $row)
+	foreach ($attachments as $key => $row)
 	{
 		if (isset($extensions['_allowed_'][$row['extension']]))
 		{
-			$result[] = $row;
+			$result[$key] = $row;
 		}
 	}
 

From 058bf77a397aa49d1dfc76d95b2c2fde124cf984 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 7 Aug 2012 12:00:10 +0100
Subject: [PATCH 24/75] [feature/attach-dl] Moved functions_compress include

PHPBB3-11042
---
 phpBB/viewtopic.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/viewtopic.php b/phpBB/viewtopic.php
index a4d7c8baa1..a65944742e 100644
--- a/phpBB/viewtopic.php
+++ b/phpBB/viewtopic.php
@@ -15,7 +15,6 @@ $phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './';
 $phpEx = substr(strrchr(__FILE__, '.'), 1);
 include($phpbb_root_path . 'common.' . $phpEx);
 include($phpbb_root_path . 'includes/functions_display.' . $phpEx);
-include($phpbb_root_path . 'includes/functions_compress.' . $phpEx);
 include($phpbb_root_path . 'includes/bbcode.' . $phpEx);
 
 // Start session management
@@ -1319,6 +1318,7 @@ $template->assign_vars(array(
 	'S_HAS_ATTACHMENTS' => !empty($attachments),
 ));
 
+require_once $phpbb_root_path . 'includes/functions_compress.' . $phpEx;
 $methods = phpbb_gen_download_links('topic_id', $topic_id, $phpbb_root_path, $phpEx);
 foreach ($methods as $method)
 {

From 3d68a6953e4a63708379e6ed14f46d97f383bfa4 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 7 Aug 2012 12:03:47 +0100
Subject: [PATCH 25/75] [feature/attach-dl] Moved download links to bottom of
 topic

PHPBB3-11042
---
 .../prosilver/template/viewtopic_body.html    | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/phpBB/styles/prosilver/template/viewtopic_body.html b/phpBB/styles/prosilver/template/viewtopic_body.html
index 57afa55a36..d2dbe8a581 100644
--- a/phpBB/styles/prosilver/template/viewtopic_body.html
+++ b/phpBB/styles/prosilver/template/viewtopic_body.html
@@ -45,17 +45,6 @@
 		</div>
 	<!-- ENDIF -->
 
-	<!-- IF S_HAS_ATTACHMENTS -->
-		<div class="dl_links">
-			<strong>{L_DOWNLOAD_ALL_ATTACH}:</strong>
-			<ul>
-			<!-- BEGIN dl_method -->
-				<li>[ <a href="{dl_method.LINK}">{dl_method.TYPE}</a> ]</li>
-			<!-- END dl_method -->
-			</ul>
-		</div>
-	<!-- ENDIF -->
-
 	<!-- IF .pagination or TOTAL_POSTS -->
 		<div class="pagination">
 			<!-- IF U_VIEW_UNREAD_POST and not S_IS_BOT --><a href="{U_VIEW_UNREAD_POST}">{L_VIEW_UNREAD_POST}</a> &bull; <!-- ENDIF -->{TOTAL_POSTS} &bull; 
@@ -279,6 +268,17 @@
 	<!-- ENDIF -->
 	</div>
 
+	<!-- IF S_HAS_ATTACHMENTS -->
+		<div class="dl_links">
+			<strong>{L_DOWNLOAD_ALL_ATTACH}:</strong>
+			<ul>
+			<!-- BEGIN dl_method -->
+				<li>[ <a href="{dl_method.LINK}">{dl_method.TYPE}</a> ]</li>
+			<!-- END dl_method -->
+			</ul>
+		</div>
+	<!-- ENDIF -->
+
 	<!-- IF .pagination or TOTAL_POSTS -->
 		<div class="pagination">
 			{TOTAL_POSTS} &bull; 

From 8a8f48528ad9d314d2a1f289951d3c931ee672b8 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 13:40:53 +0200
Subject: [PATCH 26/75] [feature/attach-dl] Correct comment for post_id and
 topic_id case.

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 7044400f90..11e61972b5 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -296,7 +296,7 @@ else if ($download_id)
 }
 else
 {
-	// sizeof($attachments) > 1
+	// sizeof($attachments) >= 1
 	if ($post_id)
 	{
 		$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id

From d6e8fbf94ad0f2a8ef5513dc8db4660a7b490027 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 13:43:31 +0200
Subject: [PATCH 27/75] [feature/attach-dl] Remove extra loop over attachments
 to get primary keys.

PHPBB3-11042
---
 phpBB/download/file.php | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 11e61972b5..c300df0235 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -151,6 +151,7 @@ if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
 	trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
 }
 
+$attachment_ids = array();
 if ($download_id || $post_id || $topic_id)
 {
 	$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
@@ -177,7 +178,13 @@ if ($download_id || $post_id || $topic_id)
 	}
 
 	$result = $db->sql_query($sql);
-	$attachments = $db->sql_fetchrowset($result);
+	while ($row = $db->sql_fetchrow($result))
+	{
+		$attachment_id = (int) $row['attach_id'];
+
+		$attachment_ids[$attachment_id] = $attachment_id;
+		$attachments[$attachment_id] = $row;
+	}
 	$db->sql_freeresult($result);
 }
 else
@@ -357,15 +364,9 @@ if ($attachment)
 
 if ($attachments)
 {
-	$attach_ids = array();
-	foreach ($attachments as $attach)
-	{
-		$attach_ids[] = $attach['attach_id'];
-	}
-
 	$sql = 'SELECT attach_id, is_orphan, in_message, post_msg_id, extension, physical_filename, real_filename, mimetype, filesize, filetime
 		FROM ' . ATTACHMENTS_TABLE . '
-		WHERE ' . $db->sql_in_set('attach_id', $attach_ids);
+		WHERE ' . $db->sql_in_set('attach_id', $attachment_ids);
 
 	$result = $db->sql_query($sql);
 	$attachments = $db->sql_fetchrowset($result);
@@ -434,7 +435,7 @@ if ($attachment)
 if ($attachments)
 {
 	require_once $phpbb_root_path . 'includes/functions_compress.' . $phpEx;
-	phpbb_increment_downloads($db, $attach_ids);
+	phpbb_increment_downloads($db, $attachment_ids);
 
 	if (!in_array($archive, compress::methods()))
 	{

From 4b06a220af23dd8888a9e7501348170746663458 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 13:51:07 +0200
Subject: [PATCH 28/75] [feature/attach-dl] Use extension_allowed() again.

PHPBB3-11042
---
 phpBB/download/file.php               |  7 ++-----
 phpBB/includes/functions_download.php | 22 ----------------------
 2 files changed, 2 insertions(+), 27 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index c300df0235..b1a376155d 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -290,11 +290,8 @@ else if ($download_id)
 			}
 		}
 
-		// disallowed?
-		$extensions = $cache->obtain_attach_extensions($row['forum_id']);
-
-		$attachments_filtered = phpbb_filter_disallowed_extensions($extensions, array($attachment));
-		if (empty($attachments_filtered))
+		$extensions = array();
+		if (!extension_allowed($row['forum_id'], $attachment['extension'], $extensions))
 		{
 			send_status_line(404, 'Forbidden');
 			trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension']));
diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index 8453469e83..b01712357d 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -613,25 +613,3 @@ function phpbb_increment_downloads($db, $ids)
 		WHERE ' . $db->sql_in_set('attach_id', $ids);
 	$db->sql_query($sql);
 }
-
-/**
-* Checks every attachment to see if it has an allowed extension
-*
-* @param array $extensions As generated by phpbb_cache_service::obtain_attach_extensions
-* @param array $attachments An array of attachment row to check
-*
-* @return array Array of attachment rows with allowed extension
-*/
-function phpbb_filter_disallowed_extensions($extensions, $attachments)
-{
-	$result = array();
-	foreach ($attachments as $key => $row)
-	{
-		if (isset($extensions['_allowed_'][$row['extension']]))
-		{
-			$result[$key] = $row;
-		}
-	}
-
-	return $result;
-}

From 3de4a7e78d2420bf14675ba4c8f66d15f191885f Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 16:55:31 +0200
Subject: [PATCH 29/75] [feature/attach-dl] Also initialise $attachments as an
 array.

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index b1a376155d..7e04fa2551 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -151,7 +151,7 @@ if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
 	trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
 }
 
-$attachment_ids = array();
+$attachments = $attachment_ids = array();
 if ($download_id || $post_id || $topic_id)
 {
 	$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime

From 8d914e05ae8cb98fcf70f48651728f41ba7da7fa Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Tue, 7 Aug 2012 17:03:46 +0200
Subject: [PATCH 30/75] [feature/attach-dl] Get rid of unnecessary if block.
 Refactor switch block.

PHPBB3-11042
---
 phpBB/download/file.php | 62 +++++++++++++++++++----------------------
 1 file changed, 28 insertions(+), 34 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 7e04fa2551..f9c611fa96 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -151,41 +151,20 @@ if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
 	trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');
 }
 
-$attachments = $attachment_ids = array();
-if ($download_id || $post_id || $topic_id)
+if ($download_id)
 {
-	$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
-		FROM ' . ATTACHMENTS_TABLE . ' a
-		WHERE ';
-
-	switch (true)
-	{
-		default:
-		case $download_id:
-			// Attachment id (only 1 attachment)
-			$sql .= "a.attach_id = $download_id";
-		break;
-
-		case $post_id:
-			// Post id or private message id (multiple attachments)
-			$sql .= "a.post_msg_id = $post_id";
-		break;
-
-		case $topic_id:
-			// Topic id (multiple attachments)
-			$sql .= "a.topic_id = $topic_id";
-		break;
-	}
-
-	$result = $db->sql_query($sql);
-	while ($row = $db->sql_fetchrow($result))
-	{
-		$attachment_id = (int) $row['attach_id'];
-
-		$attachment_ids[$attachment_id] = $attachment_id;
-		$attachments[$attachment_id] = $row;
-	}
-	$db->sql_freeresult($result);
+	// Attachment id (only 1 attachment)
+	$sql_where = "a.attach_id = $download_id";
+}
+else if ($post_id)
+{
+	// Post id or private message id (multiple attachments)
+	$sql_where = "a.post_msg_id = $post_id";
+}
+else if ($topic_id)
+{
+	// Topic id (multiple attachments)
+	$sql_where = "a.topic_id = $topic_id";
 }
 else
 {
@@ -193,6 +172,21 @@ else
 	trigger_error('NO_ATTACHMENT_SELECTED');
 }
 
+$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
+	FROM ' . ATTACHMENTS_TABLE . " a
+	WHERE $sql_where";
+$result = $db->sql_query($sql);
+
+$attachments = $attachment_ids = array();
+while ($row = $db->sql_fetchrow($result))
+{
+	$attachment_id = (int) $row['attach_id'];
+
+	$attachment_ids[$attachment_id] = $attachment_id;
+	$attachments[$attachment_id] = $row;
+}
+$db->sql_freeresult($result);
+
 if (empty($attachments))
 {
 	send_status_line(404, 'Not Found');

From a0bc902612b4d29846ed21712f54c0f57150bed8 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 7 Aug 2012 16:56:13 +0100
Subject: [PATCH 31/75] [feature/attach-dl] Removed superfluous ternary
 statement

PHPBB3-11042
---
 phpBB/download/file.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index f9c611fa96..047248adf1 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -298,9 +298,9 @@ else
 	if ($post_id)
 	{
 		$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
-			FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f
-			WHERE p.post_id = ' . (($attachment) ? $attachment['post_msg_id'] : $post_id) . '
-				AND p.forum_id = f.forum_id';
+			FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . " f
+			WHERE p.post_id = $post_id
+				AND p.forum_id = f.forum_id";
 	}
 	else if ($topic_id)
 	{

From 773c513ac0a0d3b580462a5eec2f65782f26b3c3 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 7 Aug 2012 16:59:57 +0100
Subject: [PATCH 32/75] [feature/attach-dl] Moved include of compress class
 inside function

PHPBB3-11042
---
 phpBB/includes/functions_display.php | 5 +++++
 phpBB/viewtopic.php                  | 1 -
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/phpBB/includes/functions_display.php b/phpBB/includes/functions_display.php
index 6164885732..1f541a7733 100644
--- a/phpBB/includes/functions_display.php
+++ b/phpBB/includes/functions_display.php
@@ -1298,6 +1298,11 @@ function get_user_avatar($avatar, $avatar_type, $avatar_width, $avatar_height, $
 */
 function phpbb_gen_download_links($param_key, $param_val, $phpbb_root_path, $phpEx)
 {
+	if (!class_exists('compress'))
+	{
+		require $phpbb_root_path . 'includes/functions_compress.' . $phpEx;
+	}
+
 	$methods = compress::methods();
 	$links = array();
 
diff --git a/phpBB/viewtopic.php b/phpBB/viewtopic.php
index a65944742e..9f044e0a89 100644
--- a/phpBB/viewtopic.php
+++ b/phpBB/viewtopic.php
@@ -1318,7 +1318,6 @@ $template->assign_vars(array(
 	'S_HAS_ATTACHMENTS' => !empty($attachments),
 ));
 
-require_once $phpbb_root_path . 'includes/functions_compress.' . $phpEx;
 $methods = phpbb_gen_download_links('topic_id', $topic_id, $phpbb_root_path, $phpEx);
 foreach ($methods as $method)
 {

From 10f0fc07136e08a83b75a8c5ac3e4da28a513084 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 7 Aug 2012 18:19:58 +0100
Subject: [PATCH 33/75] [feature/attach-dl] Added identifiers to attachment
 archive name

Attachment archives now include the post/topic id and the subject.
Attachments downloaded from a topic are prefixed with their post
id.

PHPBB3-11042
---
 phpBB/download/file.php | 43 +++++++++++++++++++++++++++++++++++++++--
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 047248adf1..ae44641852 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -426,6 +426,7 @@ if ($attachment)
 if ($attachments)
 {
 	require_once $phpbb_root_path . 'includes/functions_compress.' . $phpEx;
+	require_once $phpbb_root_path . 'includes/functions_upload.' . $phpEx;
 	phpbb_increment_downloads($db, $attachment_ids);
 
 	if (!in_array($archive, compress::methods()))
@@ -433,8 +434,40 @@ if ($attachments)
 		$archive = '.tar';
 	}
 
+	if ($post_id)
+	{
+		$sql = 'SELECT `post_subject`
+		FROM ' . POSTS_TABLE . "
+		WHERE post_id = $post_id";
+	}
+	else
+	{
+		$sql = 'SELECT `topic_title`
+		FROM ' . TOPICS_TABLE . "
+		WHERE topic_id = $topic_id";
+	}
+
+	$result = $db->sql_query($sql);
+	$row = $db->sql_fetchrow($result);
+	$db->sql_freeresult($result);
+
+	$filespec = new filespec(array(
+		'tmp_name' => '',
+		'size' => 0,
+		'name' => ($post_id) ? $row['post_subject'] : $row['topic_title'],
+		'type' => '',
+	));
+	$filespec->clean_filename('real');
+	$suffix = '_' . (($post_id) ? $post_id : $topic_id) . '_' . $filespec->realname;
+
+	// Remove trailing full stop
+	if (strrpos($suffix, '.') === strlen($suffix) - 1)
+	{
+		$suffix = substr($suffix, 0, strlen($suffix) - 1);
+	}
+
 	$store_name = 'att_' . time() . '_' . unique_id();
-	$archive_name = 'attachments';
+	$archive_name = 'attachments' . $suffix;
 
 	if ($archive === '.zip')
 	{
@@ -447,7 +480,13 @@ if ($attachments)
 
 	foreach ($attachments as $attach)
 	{
-		$compress->add_custom_file("{$phpbb_root_path}files/{$attach['physical_filename']}", $attach['real_filename']);
+		$prefix = '';
+		if ($topic_id)
+		{
+			$prefix = $attach['post_msg_id'] . '_';
+		}
+
+		$compress->add_custom_file("{$phpbb_root_path}files/{$attach['physical_filename']}", "{$prefix}{$attach['real_filename']}");
 	}
 
 	$compress->close();

From c4655b32f35d5cd0c7637f33162c190786a48c4b Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 7 Aug 2012 18:21:29 +0100
Subject: [PATCH 34/75] [feature/attach-dl] Fixed a bug with single attachments

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index ae44641852..4b19348bac 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -333,8 +333,8 @@ else
 
 if ($attachments && sizeof($attachments) < 2)
 {
+	$attachment = current($attachments);
 	$attachments = false;
-	$attachment = $attachments[0];
 }
 
 if ($attachment)

From f0804f2db65b14b98a77e75f9dae243f2c613b86 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 7 Aug 2012 19:24:13 +0100
Subject: [PATCH 35/75] [feature/attach-dl] Manually clean the topic title/post
 subject

PHPBB3-11042
---
 phpBB/download/file.php | 20 +++++---------------
 1 file changed, 5 insertions(+), 15 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 4b19348bac..d79deadace 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -426,7 +426,6 @@ if ($attachment)
 if ($attachments)
 {
 	require_once $phpbb_root_path . 'includes/functions_compress.' . $phpEx;
-	require_once $phpbb_root_path . 'includes/functions_upload.' . $phpEx;
 	phpbb_increment_downloads($db, $attachment_ids);
 
 	if (!in_array($archive, compress::methods()))
@@ -451,20 +450,11 @@ if ($attachments)
 	$row = $db->sql_fetchrow($result);
 	$db->sql_freeresult($result);
 
-	$filespec = new filespec(array(
-		'tmp_name' => '',
-		'size' => 0,
-		'name' => ($post_id) ? $row['post_subject'] : $row['topic_title'],
-		'type' => '',
-	));
-	$filespec->clean_filename('real');
-	$suffix = '_' . (($post_id) ? $post_id : $topic_id) . '_' . $filespec->realname;
-
-	// Remove trailing full stop
-	if (strrpos($suffix, '.') === strlen($suffix) - 1)
-	{
-		$suffix = substr($suffix, 0, strlen($suffix) - 1);
-	}
+	$bad_chars = array("'", "\\", ' ', '/', ':', '*', '?', '"', '<', '>', '|');
+	$clean_name = ($post_id) ? $row['post_subject'] : $row['topic_title'];
+	$clean_name = rawurlencode(str_replace($bad_chars, '_', strtolower($clean_name)));
+	$clean_name = preg_replace("/%(\w{2})/", '_', $clean_name);
+	$suffix = '_' . (($post_id) ? $post_id : $topic_id) . '_' . $clean_name;
 
 	$store_name = 'att_' . time() . '_' . unique_id();
 	$archive_name = 'attachments' . $suffix;

From a7694dd512cbecd3732419ed4acae2c18ad0cd94 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 01:54:41 +0200
Subject: [PATCH 36/75] [feature/attach-dl] Get rid of second query. Fetch all
 required info at once.

PHPBB3-11042
---
 phpBB/download/file.php | 40 +++++++---------------------------------
 1 file changed, 7 insertions(+), 33 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index d79deadace..6887030a2b 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -154,17 +154,17 @@ if (!$config['allow_attachments'] && !$config['allow_pm_attach'])
 if ($download_id)
 {
 	// Attachment id (only 1 attachment)
-	$sql_where = "a.attach_id = $download_id";
+	$sql_where = "attach_id = $download_id";
 }
 else if ($post_id)
 {
 	// Post id or private message id (multiple attachments)
-	$sql_where = "a.post_msg_id = $post_id";
+	$sql_where = "post_msg_id = $post_id";
 }
 else if ($topic_id)
 {
 	// Topic id (multiple attachments)
-	$sql_where = "a.topic_id = $topic_id";
+	$sql_where = "topic_id = $topic_id";
 }
 else
 {
@@ -172,8 +172,8 @@ else
 	trigger_error('NO_ATTACHMENT_SELECTED');
 }
 
-$sql = 'SELECT a.attach_id, a.in_message, a.post_msg_id, a.extension, a.is_orphan, a.poster_id, a.filetime
-	FROM ' . ATTACHMENTS_TABLE . " a
+$sql = 'SELECT attach_id, post_msg_id, in_message, is_orphan, physical_filename, real_filename, extension, mimetype, filesize, filetime
+	FROM ' . ATTACHMENTS_TABLE . "
 	WHERE $sql_where";
 $result = $db->sql_query($sql);
 
@@ -291,6 +291,8 @@ else if ($download_id)
 			trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension']));
 		}
 	}
+
+	
 }
 else
 {
@@ -342,34 +344,6 @@ if ($attachment)
 	$download_mode = (int) $extensions[$attachment['extension']]['download_mode'];
 }
 
-// Fetching filename here to prevent sniffing of filename
-if ($attachment)
-{
-	$sql = 'SELECT attach_id, is_orphan, in_message, post_msg_id, extension, physical_filename, real_filename, mimetype, filesize, filetime
-		FROM ' . ATTACHMENTS_TABLE . "
-		WHERE attach_id = $download_id";
-	$result = $db->sql_query_limit($sql, 1);
-	$attachment = $db->sql_fetchrow($result);
-	$db->sql_freeresult($result);
-}
-
-if ($attachments)
-{
-	$sql = 'SELECT attach_id, is_orphan, in_message, post_msg_id, extension, physical_filename, real_filename, mimetype, filesize, filetime
-		FROM ' . ATTACHMENTS_TABLE . '
-		WHERE ' . $db->sql_in_set('attach_id', $attachment_ids);
-
-	$result = $db->sql_query($sql);
-	$attachments = $db->sql_fetchrowset($result);
-	$db->sql_freeresult($result);
-}
-
-if (!$attachment && empty($attachments))
-{
-	send_status_line(404, 'Not Found');
-	trigger_error('ERROR_NO_ATTACHMENT');
-}
-
 if ($attachment)
 {
 	$attachment['physical_filename'] = utf8_basename($attachment['physical_filename']);

From 8f3c1d8ea1c396881129cae729505d0a702a6151 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 02:00:39 +0200
Subject: [PATCH 37/75] [feature/attach-dl] Refactor the remaining code into
 their sections.

Refactor the remaining code into their sections instead of checking things
over and over again.

PHPBB3-11042
---
 phpBB/download/file.php | 91 +++++++++++++++++------------------------
 1 file changed, 37 insertions(+), 54 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 6887030a2b..4dd592a2f6 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -292,60 +292,8 @@ else if ($download_id)
 		}
 	}
 
-	
-}
-else
-{
-	// sizeof($attachments) >= 1
-	if ($post_id)
-	{
-		$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
-			FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . " f
-			WHERE p.post_id = $post_id
-				AND p.forum_id = f.forum_id";
-	}
-	else if ($topic_id)
-	{
-		$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
-			FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
-			WHERE t.topic_id = $topic_id
-				AND t.forum_id = f.forum_id";
-	}
-
-	$result = $db->sql_query_limit($sql, 1);
-	$row = $db->sql_fetchrow($result);
-	$db->sql_freeresult($result);
-
-	$f_download = $auth->acl_get('f_download', $row['forum_id']);
-
-	if ($auth->acl_get('u_download') && $f_download)
-	{
-		if ($row && $row['forum_password'])
-		{
-			// Do something else ... ?
-			login_forum_box($row);
-		}
-	}
-	else
-	{
-		send_status_line(403, 'Forbidden');
-		trigger_error('SORRY_AUTH_VIEW_ATTACH');
-	}
-}
-
-if ($attachments && sizeof($attachments) < 2)
-{
-	$attachment = current($attachments);
-	$attachments = false;
-}
-
-if ($attachment)
-{
 	$download_mode = (int) $extensions[$attachment['extension']]['download_mode'];
-}
 
-if ($attachment)
-{
 	$attachment['physical_filename'] = utf8_basename($attachment['physical_filename']);
 	$display_cat = $extensions[$attachment['extension']]['display_cat'];
 
@@ -396,9 +344,44 @@ if ($attachment)
 		}
 	}
 }
-
-if ($attachments)
+else
 {
+	// sizeof($attachments) >= 1
+	if ($post_id)
+	{
+		$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
+			FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . " f
+			WHERE p.post_id = $post_id
+				AND p.forum_id = f.forum_id";
+	}
+	else if ($topic_id)
+	{
+		$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
+			FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
+			WHERE t.topic_id = $topic_id
+				AND t.forum_id = f.forum_id";
+	}
+
+	$result = $db->sql_query_limit($sql, 1);
+	$row = $db->sql_fetchrow($result);
+	$db->sql_freeresult($result);
+
+	$f_download = $auth->acl_get('f_download', $row['forum_id']);
+
+	if ($auth->acl_get('u_download') && $f_download)
+	{
+		if ($row && $row['forum_password'])
+		{
+			// Do something else ... ?
+			login_forum_box($row);
+		}
+	}
+	else
+	{
+		send_status_line(403, 'Forbidden');
+		trigger_error('SORRY_AUTH_VIEW_ATTACH');
+	}
+
 	require_once $phpbb_root_path . 'includes/functions_compress.' . $phpEx;
 	phpbb_increment_downloads($db, $attachment_ids);
 

From aa6effbb0c597b8ac5c81df7d8c8a543173b53b6 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 02:04:39 +0200
Subject: [PATCH 38/75] [feature/attach-dl] Remove backticks from SQL query.

PHPBB3-11042
---
 phpBB/download/file.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 4dd592a2f6..e710928bec 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -392,13 +392,13 @@ else
 
 	if ($post_id)
 	{
-		$sql = 'SELECT `post_subject`
+		$sql = 'SELECT post_subject
 		FROM ' . POSTS_TABLE . "
 		WHERE post_id = $post_id";
 	}
 	else
 	{
-		$sql = 'SELECT `topic_title`
+		$sql = 'SELECT topic_title
 		FROM ' . TOPICS_TABLE . "
 		WHERE topic_id = $topic_id";
 	}

From c221294fb21e19f483972a4672636dc355b34888 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 02:06:27 +0200
Subject: [PATCH 39/75] [feature/attach-dl] Remove commented statement.

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index e710928bec..5bb7770bdf 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -311,7 +311,7 @@ else if ($download_id)
 	{
 		$attachment['physical_filename'] = 'thumb_' . $attachment['physical_filename'];
 	}
-	else if (($display_cat == ATTACHMENT_CATEGORY_NONE/* || $display_cat == ATTACHMENT_CATEGORY_IMAGE*/) && !$attachment['is_orphan'] && !phpbb_http_byte_range($attachment['filesize']))
+	else if ($display_cat == ATTACHMENT_CATEGORY_NONE && !$attachment['is_orphan'] && !phpbb_http_byte_range($attachment['filesize']))
 	{
 		// Update download count
 		phpbb_increment_downloads($db, $attachment['attach_id']);

From dd43af0ab66e14f152d7add4dbb5b07d68ec6150 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 02:08:04 +0200
Subject: [PATCH 40/75] [feature/attach-dl] Make sure physical_filename is
 basenamed everywhere.

PHPBB3-11042
---
 phpBB/download/file.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 5bb7770bdf..35c940dd61 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -182,6 +182,8 @@ while ($row = $db->sql_fetchrow($result))
 {
 	$attachment_id = (int) $row['attach_id'];
 
+	$row['physical_filename'] = utf8_basename($row['physical_filename']);
+
 	$attachment_ids[$attachment_id] = $attachment_id;
 	$attachments[$attachment_id] = $row;
 }
@@ -293,8 +295,6 @@ else if ($download_id)
 	}
 
 	$download_mode = (int) $extensions[$attachment['extension']]['download_mode'];
-
-	$attachment['physical_filename'] = utf8_basename($attachment['physical_filename']);
 	$display_cat = $extensions[$attachment['extension']]['display_cat'];
 
 	if (($display_cat == ATTACHMENT_CATEGORY_IMAGE || $display_cat == ATTACHMENT_CATEGORY_THUMB) && !$user->optionget('viewimg'))

From 0226bc43dd2048bb2d90e55c3036b53e50d2288b Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 02:13:28 +0200
Subject: [PATCH 41/75] [feature/attach-dl] Fix query indentation.

PHPBB3-11042
---
 phpBB/download/file.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 35c940dd61..d31c33b781 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -393,14 +393,14 @@ else
 	if ($post_id)
 	{
 		$sql = 'SELECT post_subject
-		FROM ' . POSTS_TABLE . "
-		WHERE post_id = $post_id";
+			FROM ' . POSTS_TABLE . "
+			WHERE post_id = $post_id";
 	}
 	else
 	{
 		$sql = 'SELECT topic_title
-		FROM ' . TOPICS_TABLE . "
-		WHERE topic_id = $topic_id";
+			FROM ' . TOPICS_TABLE . "
+			WHERE topic_id = $topic_id";
 	}
 
 	$result = $db->sql_query($sql);

From 93f630e9b18ec1540654a371f0214ab50b271998 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 02:28:07 +0200
Subject: [PATCH 42/75] [feature/attach-dl] Do not fetch orphaned attachments
 when downloading archives

PHPBB3-11042
---
 phpBB/download/file.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index d31c33b781..e0e7e48f69 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -159,12 +159,12 @@ if ($download_id)
 else if ($post_id)
 {
 	// Post id or private message id (multiple attachments)
-	$sql_where = "post_msg_id = $post_id";
+	$sql_where = "post_msg_id = $post_id AND is_orphan = 0";
 }
 else if ($topic_id)
 {
 	// Topic id (multiple attachments)
-	$sql_where = "topic_id = $topic_id";
+	$sql_where = "topic_id = $topic_id AND is_orphan = 0";
 }
 else
 {

From 11129a5950d2241ab7921517d7755df6098947a2 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 02:29:27 +0200
Subject: [PATCH 43/75] [feature/attach-dl] Use class_exists/require instead of
 require_once.

PHPBB3-11042
---
 phpBB/download/file.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index e0e7e48f69..e6afb4f2ae 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -382,9 +382,13 @@ else
 		trigger_error('SORRY_AUTH_VIEW_ATTACH');
 	}
 
-	require_once $phpbb_root_path . 'includes/functions_compress.' . $phpEx;
 	phpbb_increment_downloads($db, $attachment_ids);
 
+	if (!class_exists('compress'))
+	{
+		require $phpbb_root_path . 'includes/functions_compress.' . $phpEx;
+	}
+
 	if (!in_array($archive, compress::methods()))
 	{
 		$archive = '.tar';

From 9b7b794beb8d5acc71f1b6d3f60ba5e22c70c17f Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 03:02:00 +0200
Subject: [PATCH 44/75] [feature/attach-dl] Exploit topic_id of attachment =>
 no posts table query

PHPBB3-11042
---
 phpBB/download/file.php | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index e6afb4f2ae..5db57c3f9c 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -172,7 +172,7 @@ else
 	trigger_error('NO_ATTACHMENT_SELECTED');
 }
 
-$sql = 'SELECT attach_id, post_msg_id, in_message, is_orphan, physical_filename, real_filename, extension, mimetype, filesize, filetime
+$sql = 'SELECT attach_id, post_msg_id, topic_id, in_message, is_orphan, physical_filename, real_filename, extension, mimetype, filesize, filetime
 	FROM ' . ATTACHMENTS_TABLE . "
 	WHERE $sql_where";
 $result = $db->sql_query($sql);
@@ -189,6 +189,9 @@ while ($row = $db->sql_fetchrow($result))
 }
 $db->sql_freeresult($result);
 
+// Make $attachment the first of the attachments we fetched.
+$attachment = current($attachments);
+
 if (empty($attachments))
 {
 	send_status_line(404, 'Not Found');
@@ -202,7 +205,6 @@ else if (!download_allowed())
 else if ($download_id)
 {
 	// sizeof($attachments) == 1
-	$attachment = current($attachments);
 
 	if (!$attachment['in_message'] && !$config['allow_attachments'] || $attachment['in_message'] && !$config['allow_pm_attach'])
 	{
@@ -347,21 +349,11 @@ else if ($download_id)
 else
 {
 	// sizeof($attachments) >= 1
-	if ($post_id)
-	{
-		$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
-			FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . " f
-			WHERE p.post_id = $post_id
-				AND p.forum_id = f.forum_id";
-	}
-	else if ($topic_id)
-	{
-		$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
-			FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
-			WHERE t.topic_id = $topic_id
-				AND t.forum_id = f.forum_id";
-	}
 
+	$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
+		FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
+		WHERE t.topic_id = " . (int) $attachment['topic_id'] . "
+			AND t.forum_id = f.forum_id";
 	$result = $db->sql_query_limit($sql, 1);
 	$row = $db->sql_fetchrow($result);
 	$db->sql_freeresult($result);

From 7bd81cd0cd088ba13648f293fb738060f221a8de Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 03:06:14 +0200
Subject: [PATCH 45/75] [feature/attach-dl] Move logic for passworded forums to
 a function.

PHPBB3-11042
---
 phpBB/download/file.php               | 49 ++-------------------------
 phpBB/includes/functions_download.php | 25 ++++++++++++++
 2 files changed, 27 insertions(+), 47 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 5db57c3f9c..db71052707 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -230,29 +230,7 @@ else if ($download_id)
 	{
 		if (!$attachment['in_message'])
 		{
-			$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
-				FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f
-				WHERE p.post_id = ' . $attachment['post_msg_id'] . '
-				AND p.forum_id = f.forum_id';
-			$result = $db->sql_query_limit($sql, 1);
-			$row = $db->sql_fetchrow($result);
-			$db->sql_freeresult($result);
-
-			$f_download = $auth->acl_get('f_download', $row['forum_id']);
-
-			if ($auth->acl_get('u_download') && $f_download)
-			{
-				if ($row && $row['forum_password'])
-				{
-					// Do something else ... ?
-					login_forum_box($row);
-				}
-			}
-			else
-			{
-				send_status_line(403, 'Forbidden');
-				trigger_error('SORRY_AUTH_VIEW_ATTACH');
-			}
+			phpbb_download_handle_passworded_forum($db, $auth, $attachment['topic_id']);
 		}
 		else
 		{
@@ -350,30 +328,7 @@ else
 {
 	// sizeof($attachments) >= 1
 
-	$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
-		FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
-		WHERE t.topic_id = " . (int) $attachment['topic_id'] . "
-			AND t.forum_id = f.forum_id";
-	$result = $db->sql_query_limit($sql, 1);
-	$row = $db->sql_fetchrow($result);
-	$db->sql_freeresult($result);
-
-	$f_download = $auth->acl_get('f_download', $row['forum_id']);
-
-	if ($auth->acl_get('u_download') && $f_download)
-	{
-		if ($row && $row['forum_password'])
-		{
-			// Do something else ... ?
-			login_forum_box($row);
-		}
-	}
-	else
-	{
-		send_status_line(403, 'Forbidden');
-		trigger_error('SORRY_AUTH_VIEW_ATTACH');
-	}
-
+	phpbb_download_handle_passworded_forum($db, $auth, $attachment['topic_id']);
 	phpbb_increment_downloads($db, $attachment_ids);
 
 	if (!class_exists('compress'))
diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index b01712357d..4299ed47c5 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -613,3 +613,28 @@ function phpbb_increment_downloads($db, $ids)
 		WHERE ' . $db->sql_in_set('attach_id', $ids);
 	$db->sql_query($sql);
 }
+
+function phpbb_download_handle_passworded_forum($db, $auth, $topic_id)
+{
+	$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
+		FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
+		WHERE t.topic_id = " . (int) $topic_id . "
+			AND t.forum_id = f.forum_id";
+	$result = $db->sql_query_limit($sql, 1);
+	$row = $db->sql_fetchrow($result);
+	$db->sql_freeresult($result);
+
+	if ($auth->acl_get('u_download') && $auth->acl_get('f_download', $row['forum_id']))
+	{
+		if ($row && $row['forum_password'])
+		{
+			// Do something else ... ?
+			login_forum_box($row);
+		}
+	}
+	else
+	{
+		send_status_line(403, 'Forbidden');
+		trigger_error('SORRY_AUTH_VIEW_ATTACH');
+	}
+}

From e5a3bc03b492a573291e2a241b1ed9bcffc19a02 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 03:14:55 +0200
Subject: [PATCH 46/75] [feature/attach-dl] Consider that post_id can mean
 private message id as well.

PHPBB3-11042
---
 phpBB/download/file.php | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index db71052707..13494b12f4 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -343,9 +343,18 @@ else
 
 	if ($post_id)
 	{
-		$sql = 'SELECT post_subject
-			FROM ' . POSTS_TABLE . "
-			WHERE post_id = $post_id";
+		if ($attachment['in_message'])
+		{
+			$sql = 'SELECT message_subject
+				FROM ' . PRIVMSGS_TABLE . "
+				WHERE msg_id = $post_id";
+		}
+		else
+		{
+			$sql = 'SELECT post_subject
+				FROM ' . POSTS_TABLE . "
+				WHERE post_id = $post_id";
+		}
 	}
 	else
 	{
@@ -359,7 +368,7 @@ else
 	$db->sql_freeresult($result);
 
 	$bad_chars = array("'", "\\", ' ', '/', ':', '*', '?', '"', '<', '>', '|');
-	$clean_name = ($post_id) ? $row['post_subject'] : $row['topic_title'];
+	$clean_name = current($row);
 	$clean_name = rawurlencode(str_replace($bad_chars, '_', strtolower($clean_name)));
 	$clean_name = preg_replace("/%(\w{2})/", '_', $clean_name);
 	$suffix = '_' . (($post_id) ? $post_id : $topic_id) . '_' . $clean_name;

From ccb0baa20ab4727a970381f601c5e4740e0bbc8f Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 03:24:15 +0200
Subject: [PATCH 47/75] [feature/attach-dl] Increase download counters closely
 before streaming archive

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 13494b12f4..c9fcf67101 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -329,7 +329,6 @@ else
 	// sizeof($attachments) >= 1
 
 	phpbb_download_handle_passworded_forum($db, $auth, $attachment['topic_id']);
-	phpbb_increment_downloads($db, $attachment_ids);
 
 	if (!class_exists('compress'))
 	{
@@ -397,6 +396,7 @@ else
 	}
 
 	$compress->close();
+	phpbb_increment_downloads($db, $attachment_ids);
 	$compress->download($store_name, $archive_name);
 	file_gc();
 }

From 62305bec6dbb660eaa51f629de2f70341df12666 Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 03:26:30 +0200
Subject: [PATCH 48/75] [feature/attach-dl] Send 404 if we get empty row from
 privmsg|posts|topic table

PHPBB3-11042
---
 phpBB/download/file.php | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index c9fcf67101..282708f846 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -366,6 +366,12 @@ else
 	$row = $db->sql_fetchrow($result);
 	$db->sql_freeresult($result);
 
+	if (empty($row))
+	{
+		send_status_line(404, 'Not Found');
+		trigger_error('ERROR_NO_ATTACHMENT');
+	}
+
 	$bad_chars = array("'", "\\", ' ', '/', ':', '*', '?', '"', '<', '>', '|');
 	$clean_name = current($row);
 	$clean_name = rawurlencode(str_replace($bad_chars, '_', strtolower($clean_name)));

From 6dd0bd0bcec357ed82b9fe3dbaf6816d6f22d9ce Mon Sep 17 00:00:00 2001
From: Andreas Fischer <bantu@phpbb.com>
Date: Fri, 10 Aug 2012 03:29:47 +0200
Subject: [PATCH 49/75] [feature/attach-dl] Do not check for passworted forum
 when it's a PM.

PHPBB3-11042
---
 phpBB/download/file.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 282708f846..c4d6c26152 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -327,8 +327,10 @@ else if ($download_id)
 else
 {
 	// sizeof($attachments) >= 1
-
-	phpbb_download_handle_passworded_forum($db, $auth, $attachment['topic_id']);
+	if (!$attachment['in_message'])
+	{
+		phpbb_download_handle_passworded_forum($db, $auth, $attachment['topic_id']);
+	}
 
 	if (!class_exists('compress'))
 	{

From dd7be79fc33e38f5517dfca9041c03212440dd96 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Fri, 10 Aug 2012 13:08:12 +0100
Subject: [PATCH 50/75] [feature/attach-dl] Removed strtolower and added
 comments

PHPBB3-11042
---
 phpBB/download/file.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index c4d6c26152..a5d7eada3f 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -376,7 +376,11 @@ else
 
 	$bad_chars = array("'", "\\", ' ', '/', ':', '*', '?', '"', '<', '>', '|');
 	$clean_name = current($row);
-	$clean_name = rawurlencode(str_replace($bad_chars, '_', strtolower($clean_name)));
+
+	// rawurlencode to convert any potentially 'bad' characters that we missed
+	$clean_name = rawurlencode(str_replace($bad_chars, '_', $clean_name));
+
+	// Turn the %xx entities created by rawurlencode to _
 	$clean_name = preg_replace("/%(\w{2})/", '_', $clean_name);
 	$suffix = '_' . (($post_id) ? $post_id : $topic_id) . '_' . $clean_name;
 

From 6da47555e040468e582ea73c501197d99689d07d Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Fri, 10 Aug 2012 13:13:13 +0100
Subject: [PATCH 51/75] [feature/attach-dl] Remove the archive after it's
 downloaded

PHPBB3-11042
---
 phpBB/download/file.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index a5d7eada3f..cd365767c2 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -410,5 +410,6 @@ else
 	$compress->close();
 	phpbb_increment_downloads($db, $attachment_ids);
 	$compress->download($store_name, $archive_name);
+	unlink("{$phpbb_root_path}store/{$store_name}{$archive}");
 	file_gc();
 }

From e8830c3369dbd4b25a4798eeb3fe2c7834825c42 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 11:36:16 +0100
Subject: [PATCH 52/75] [feature/attach-dl] Added docblock for renamed
 download_check_forum_auth

PHPBB3-11042
---
 phpBB/download/file.php               |  4 ++--
 phpBB/includes/functions_download.php | 11 ++++++++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index cd365767c2..1aeaceb824 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -230,7 +230,7 @@ else if ($download_id)
 	{
 		if (!$attachment['in_message'])
 		{
-			phpbb_download_handle_passworded_forum($db, $auth, $attachment['topic_id']);
+			phpbb_download_check_forum_auth($db, $auth, $attachment['topic_id']);
 		}
 		else
 		{
@@ -329,7 +329,7 @@ else
 	// sizeof($attachments) >= 1
 	if (!$attachment['in_message'])
 	{
-		phpbb_download_handle_passworded_forum($db, $auth, $attachment['topic_id']);
+		phpbb_download_check_forum_auth($db, $auth, $attachment['topic_id']);
 	}
 
 	if (!class_exists('compress'))
diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index 4299ed47c5..22f217909c 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -614,7 +614,16 @@ function phpbb_increment_downloads($db, $ids)
 	$db->sql_query($sql);
 }
 
-function phpbb_download_handle_passworded_forum($db, $auth, $topic_id)
+/**
+* Checks that the user has permission to download attachments from the forum
+*
+* @param dbal $db The database object
+* @param phpbb_auth $auth The authentication object
+* @param int $topic_id The id of the topic that we are downloading from
+*
+* @return null
+*/
+function phpbb_download_check_forum_auth($db, $auth, $topic_id)
 {
 	$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
 		FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f

From 20ecd046daf660a7cb5ae7079cea9a6ed26c9bab Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 11:42:23 +0100
Subject: [PATCH 53/75] [feature/attach-dl] Moved filename cleaning into own
 function

PHPBB3-11042
---
 phpBB/download/file.php               |  9 +--------
 phpBB/includes/functions_download.php | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 1aeaceb824..4a89aca3e6 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -374,14 +374,7 @@ else
 		trigger_error('ERROR_NO_ATTACHMENT');
 	}
 
-	$bad_chars = array("'", "\\", ' ', '/', ':', '*', '?', '"', '<', '>', '|');
-	$clean_name = current($row);
-
-	// rawurlencode to convert any potentially 'bad' characters that we missed
-	$clean_name = rawurlencode(str_replace($bad_chars, '_', $clean_name));
-
-	// Turn the %xx entities created by rawurlencode to _
-	$clean_name = preg_replace("/%(\w{2})/", '_', $clean_name);
+	$clean_name = phpbb_download_clean_filename(current($row));
 	$suffix = '_' . (($post_id) ? $post_id : $topic_id) . '_' . $clean_name;
 
 	$store_name = 'att_' . time() . '_' . unique_id();
diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index 22f217909c..f866c6bbfb 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -647,3 +647,24 @@ function phpbb_download_check_forum_auth($db, $auth, $topic_id)
 		trigger_error('SORRY_AUTH_VIEW_ATTACH');
 	}
 }
+
+/**
+* Cleans a filename of any characters that could potentially cause a problem on
+* a user's filesystem.
+*
+* @param string $filename The filename to clean
+*
+* @return string The cleaned filename
+*/
+function phpbb_download_clean_filename($filename)
+{
+	$bad_chars = array("'", "\\", ' ', '/', ':', '*', '?', '"', '<', '>', '|');
+
+	// rawurlencode to convert any potentially 'bad' characters that we missed
+	$filename = rawurlencode(str_replace($bad_chars, '_', $filename));
+
+	// Turn the %xx entities created by rawurlencode to _
+	$filename = preg_replace("/%(\w{2})/", '_', $filename);
+
+	return $filename;
+}

From d08c1c23dc0a2e9acebf309b3b2ff4dd88fbc901 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 12:03:07 +0100
Subject: [PATCH 54/75] [feature/attach-dl] Remove attachments that have
 invalid extensions

PHPBB3-11042
---
 phpBB/download/file.php | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 4a89aca3e6..0c3e0f5521 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -352,14 +352,14 @@ else
 		}
 		else
 		{
-			$sql = 'SELECT post_subject
+			$sql = 'SELECT post_subject, forum_id
 				FROM ' . POSTS_TABLE . "
 				WHERE post_id = $post_id";
 		}
 	}
 	else
 	{
-		$sql = 'SELECT topic_title
+		$sql = 'SELECT topic_title, forum_id
 			FROM ' . TOPICS_TABLE . "
 			WHERE topic_id = $topic_id";
 	}
@@ -389,8 +389,19 @@ else
 		$compress = new compress_tar('w', "{$phpbb_root_path}store/{$store_name}{$archive}", $archive);
 	}
 
+	$extensions = array();
+	$count = 0;
+	$forum_id = ($attachment['in_message']) ? false : $row['forum_id'];
+	$disallowed = array();
+
 	foreach ($attachments as $attach)
 	{
+		if (!extension_allowed($forum_id, $attach['extension'], $extensions))
+		{
+			$disallowed[$attach['extension']] = 1;
+			continue;
+		}
+		
 		$prefix = '';
 		if ($topic_id)
 		{
@@ -398,11 +409,26 @@ else
 		}
 
 		$compress->add_custom_file("{$phpbb_root_path}files/{$attach['physical_filename']}", "{$prefix}{$attach['real_filename']}");
+		$count++;
 	}
 
 	$compress->close();
-	phpbb_increment_downloads($db, $attachment_ids);
-	$compress->download($store_name, $archive_name);
+
+	if ($count > 0)
+	{
+		phpbb_increment_downloads($db, $attachment_ids);
+		$compress->download($store_name, $archive_name);
+	}
+
 	unlink("{$phpbb_root_path}store/{$store_name}{$archive}");
+
+	if ($count < 1)
+	{
+		// None of the attachments had a valid a extension
+		$disallowed = implode(', ', array_keys($disallowed));
+		send_status_line(404, 'Forbidden');
+		trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $disallowed));
+	}
+
 	file_gc();
 }

From b05f36b19759eae3d6e60558355698d457df5b31 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 12:03:59 +0100
Subject: [PATCH 55/75] [feature/attach-dl] Removed limit

PHPBB3-11042
---
 phpBB/includes/functions_download.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index f866c6bbfb..14d39806b9 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -629,7 +629,7 @@ function phpbb_download_check_forum_auth($db, $auth, $topic_id)
 		FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f
 		WHERE t.topic_id = " . (int) $topic_id . "
 			AND t.forum_id = f.forum_id";
-	$result = $db->sql_query_limit($sql, 1);
+	$result = $db->sql_query($sql);
 	$row = $db->sql_fetchrow($result);
 	$db->sql_freeresult($result);
 

From b96c72c156b5fd207ef0b1d1b55df037df688976 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 12:47:10 +0100
Subject: [PATCH 56/75] [feature/attach-dl] Moved PM authentication handling
 into own function

PHPBB3-11042
---
 phpBB/download/file.php               | 33 +++--------------
 phpBB/includes/functions_download.php | 51 +++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 28 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 0c3e0f5521..d000fc49d2 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -236,34 +236,7 @@ else if ($download_id)
 		{
 			// Attachment is in a private message.
 			$row['forum_id'] = false;
-			if (!$auth->acl_get('u_pm_download'))
-			{
-				send_status_line(403, 'Forbidden');
-				trigger_error('SORRY_AUTH_VIEW_ATTACH');
-			}
-
-			// Check if the attachment is within the users scope...
-			$sql = 'SELECT user_id, author_id
-				FROM ' . PRIVMSGS_TO_TABLE . '
-				WHERE msg_id = ' . $attachment['post_msg_id'];
-			$result = $db->sql_query($sql);
-
-			$allowed = false;
-			while ($user_row = $db->sql_fetchrow($result))
-			{
-				if ($user->data['user_id'] == $user_row['user_id'] || $user->data['user_id'] == $user_row['author_id'])
-				{
-					$allowed = true;
-					break;
-				}
-			}
-			$db->sql_freeresult($result);
-
-			if (!$allowed)
-			{
-				send_status_line(403, 'Forbidden');
-				trigger_error('ERROR_NO_ATTACHMENT');
-			}
+			phpbb_download_handle_pm_auth($db, $auth, $user->data['user_id'], $attachment['post_msg_id']);
 		}
 
 		$extensions = array();
@@ -331,6 +304,10 @@ else
 	{
 		phpbb_download_check_forum_auth($db, $auth, $attachment['topic_id']);
 	}
+	else
+	{
+		phpbb_download_handle_pm_auth($db, $auth, $user->data['user_id'], $attachment['post_msg_id']);
+	}
 
 	if (!class_exists('compress'))
 	{
diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index 14d39806b9..ac5e5ddd7e 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -648,6 +648,57 @@ function phpbb_download_check_forum_auth($db, $auth, $topic_id)
 	}
 }
 
+/**
+* Handles authentication when downloading attachments from PMs
+*
+* @param dbal $db The database object
+* @param phpbb_auth $auth The authentication object
+* @param int $user_id The user id
+* @param int $msg_id The id of the PM that we are downloading from
+*
+* @return null
+*/
+function phpbb_download_handle_pm_auth($db, $auth, $user_id, $msg_id)
+{
+	if (!$auth->acl_get('u_pm_download'))
+	{
+		send_status_line(403, 'Forbidden');
+		trigger_error('SORRY_AUTH_VIEW_ATTACH');
+	}
+
+	$allowed = phpbb_download_check_pm_auth($db, $user_id, $msg_id);
+
+	if (!$allowed)
+	{
+		send_status_line(403, 'Forbidden');
+		trigger_error('ERROR_NO_ATTACHMENT');
+	}
+}
+
+/**
+* Checks whether a user can download from a particular PM
+*
+* @param dbal $db The database object
+* @param int $user_id The user id
+* @param int $msg_id The id of the PM that we are downloading from
+*
+* @return bool Whether the user is allowed to download from that PM or not
+*/
+function phpbb_download_check_pm_auth($db, $user_id, $msg_id)
+{
+	// Check if the attachment is within the users scope...
+	$sql = 'SELECT user_id, author_id
+		FROM ' . PRIVMSGS_TO_TABLE . '
+		WHERE msg_id = ' . $msg_id . "
+			AND user_id = $user_id
+			OR author_id = $user_id";
+	$result = $db->sql_query_limit($sql, 1);
+	$allowed = $db->sql_fetchrow($result);
+	$db->sql_freeresult($result);
+
+	return $allowed;
+}
+
 /**
 * Cleans a filename of any characters that could potentially cause a problem on
 * a user's filesystem.

From 003f8b514bc1345b95859ced087f90fdf87b3b7a Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 12:49:56 +0100
Subject: [PATCH 57/75] [feature/attach-dl] Renamed to
 phpbb_download_handle_forum_auth

PHPBB3-11042
---
 phpBB/download/file.php               | 4 ++--
 phpBB/includes/functions_download.php | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index d000fc49d2..94dbb9bb51 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -230,7 +230,7 @@ else if ($download_id)
 	{
 		if (!$attachment['in_message'])
 		{
-			phpbb_download_check_forum_auth($db, $auth, $attachment['topic_id']);
+			phpbb_download_handle_forum_auth($db, $auth, $attachment['topic_id']);
 		}
 		else
 		{
@@ -302,7 +302,7 @@ else
 	// sizeof($attachments) >= 1
 	if (!$attachment['in_message'])
 	{
-		phpbb_download_check_forum_auth($db, $auth, $attachment['topic_id']);
+		phpbb_download_handle_forum_auth($db, $auth, $attachment['topic_id']);
 	}
 	else
 	{
diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index ac5e5ddd7e..ed2f598429 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -615,7 +615,7 @@ function phpbb_increment_downloads($db, $ids)
 }
 
 /**
-* Checks that the user has permission to download attachments from the forum
+* Handles authentication when downloading attachments from a post or topic
 *
 * @param dbal $db The database object
 * @param phpbb_auth $auth The authentication object
@@ -623,7 +623,7 @@ function phpbb_increment_downloads($db, $ids)
 *
 * @return null
 */
-function phpbb_download_check_forum_auth($db, $auth, $topic_id)
+function phpbb_download_handle_forum_auth($db, $auth, $topic_id)
 {
 	$sql = 'SELECT t.forum_id, f.forum_password, f.parent_id
 		FROM ' . TOPICS_TABLE . ' t, ' . FORUMS_TABLE . " f

From 5c9b3208f5095c585548e9882c322e40d0f8883e Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 13:02:12 +0100
Subject: [PATCH 58/75] [feature/attach-dl] Removed reliance on current($row)

PHPBB3-11042
---
 phpBB/download/file.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 94dbb9bb51..15fcd5c9db 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -323,20 +323,20 @@ else
 	{
 		if ($attachment['in_message'])
 		{
-			$sql = 'SELECT message_subject
+			$sql = 'SELECT message_subject AS attach_subject
 				FROM ' . PRIVMSGS_TABLE . "
 				WHERE msg_id = $post_id";
 		}
 		else
 		{
-			$sql = 'SELECT post_subject, forum_id
+			$sql = 'SELECT post_subject AS attach_subject, forum_id
 				FROM ' . POSTS_TABLE . "
 				WHERE post_id = $post_id";
 		}
 	}
 	else
 	{
-		$sql = 'SELECT topic_title, forum_id
+		$sql = 'SELECT topic_title AS attach_subject, forum_id
 			FROM ' . TOPICS_TABLE . "
 			WHERE topic_id = $topic_id";
 	}
@@ -351,7 +351,7 @@ else
 		trigger_error('ERROR_NO_ATTACHMENT');
 	}
 
-	$clean_name = phpbb_download_clean_filename(current($row));
+	$clean_name = phpbb_download_clean_filename($row['attach_subject']);
 	$suffix = '_' . (($post_id) ? $post_id : $topic_id) . '_' . $clean_name;
 
 	$store_name = 'att_' . time() . '_' . unique_id();

From 39676d513e653132916b9c0cf6c9cc6ee5ebe96a Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 13:19:56 +0100
Subject: [PATCH 59/75] [feature/attach-dl] Added multiple attachment downloads
 to PMs

PHPBB3-11042
---
 phpBB/includes/ucp/ucp_pm_viewmessage.php     |  7 ++++++
 .../template/ucp_pm_viewmessage.html          | 24 ++++++++++++++-----
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/phpBB/includes/ucp/ucp_pm_viewmessage.php b/phpBB/includes/ucp/ucp_pm_viewmessage.php
index c55e8850a6..16fa7d630e 100644
--- a/phpBB/includes/ucp/ucp_pm_viewmessage.php
+++ b/phpBB/includes/ucp/ucp_pm_viewmessage.php
@@ -257,6 +257,7 @@ function view_message($id, $mode, $folder_id, $msg_id, $folder, $message_row)
 		'U_PM_ACTION'		=> $url . '&amp;mode=compose&amp;f=' . $folder_id . '&amp;p=' . $message_row['msg_id'],
 
 		'S_HAS_ATTACHMENTS'	=> (sizeof($attachments)) ? true : false,
+		'S_HAS_MULTIPLE_ATTACHMENTS' => (sizeof($attachments) > 1),
 		'S_DISPLAY_NOTICE'	=> $display_notice && $message_row['message_attachment'],
 		'S_AUTHOR_DELETED'	=> ($author_id == ANONYMOUS) ? true : false,
 		'S_SPECIAL_FOLDER'	=> in_array($folder_id, array(PRIVMSGS_NO_BOX, PRIVMSGS_OUTBOX)),
@@ -282,6 +283,12 @@ function view_message($id, $mode, $folder_id, $msg_id, $folder, $message_row)
 	// Display not already displayed Attachments for this post, we already parsed them. ;)
 	if (isset($attachments) && sizeof($attachments))
 	{
+		$methods = phpbb_gen_download_links('post_id', $msg_id, $phpbb_root_path, $phpEx);
+		foreach ($methods as $method)
+		{
+			$template->assign_block_vars('dl_method', $method);
+		}
+	
 		foreach ($attachments as $attachment)
 		{
 			$template->assign_block_vars('attachment', array(
diff --git a/phpBB/styles/prosilver/template/ucp_pm_viewmessage.html b/phpBB/styles/prosilver/template/ucp_pm_viewmessage.html
index 2e7a7c4ac9..b022bcd979 100644
--- a/phpBB/styles/prosilver/template/ucp_pm_viewmessage.html
+++ b/phpBB/styles/prosilver/template/ucp_pm_viewmessage.html
@@ -41,12 +41,24 @@
 		<div class="content">{MESSAGE}</div>
 
 		<!-- IF S_HAS_ATTACHMENTS -->
-		<dl class="attachbox">
-			<dt>{L_ATTACHMENTS}</dt>
-			<!-- BEGIN attachment -->
-			<dd>{attachment.DISPLAY_ATTACHMENT}</dd>
-			<!-- END attachment -->
-		</dl>
+			<dl class="attachbox">
+				<dt>
+					{L_ATTACHMENTS}
+					<!-- IF S_HAS_MULTIPLE_ATTACHMENTS -->
+						<div class="dl_links">
+							<strong>{L_DOWNLOAD_ALL}:</strong>
+							<ul>
+							<!-- BEGIN dl_method -->
+								<li>[ <a href="{dl_method.LINK}">{dl_method.TYPE}</a> ]</li>
+							<!-- END dl_method -->
+							</ul>
+						</div>
+					<!-- ENDIF -->
+				</dt>
+				<!-- BEGIN attachment -->
+					<dd>{attachment.DISPLAY_ATTACHMENT}</dd>
+				<!-- END attachment -->
+			</dl>
 		<!-- ENDIF -->
 
 		<!-- IF S_DISPLAY_NOTICE -->

From ef2e7ca79142ddfe2c23e6f84cbe87c30e9bb33b Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 13:23:21 +0100
Subject: [PATCH 60/75] [feature/attach-dl] Removed need for array_keys()

PHPBB3-11042
---
 phpBB/download/file.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 15fcd5c9db..e658715483 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -375,7 +375,7 @@ else
 	{
 		if (!extension_allowed($forum_id, $attach['extension'], $extensions))
 		{
-			$disallowed[$attach['extension']] = 1;
+			$disallowed[$attach['extension']] = $attach['extension'];
 			continue;
 		}
 		
@@ -402,7 +402,7 @@ else
 	if ($count < 1)
 	{
 		// None of the attachments had a valid a extension
-		$disallowed = implode(', ', array_keys($disallowed));
+		$disallowed = implode(', ', $disallowed);
 		send_status_line(404, 'Forbidden');
 		trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $disallowed));
 	}

From be27afa1c7b13eae0bc7c4e70433ddced4af31b4 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 13:24:02 +0100
Subject: [PATCH 61/75] [feature/attach-dl] Removed sprintf() use

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index e658715483..58b99fc4ef 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -404,7 +404,7 @@ else
 		// None of the attachments had a valid a extension
 		$disallowed = implode(', ', $disallowed);
 		send_status_line(404, 'Forbidden');
-		trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $disallowed));
+		trigger_error($user->lang('EXTENSION_DISABLED_AFTER_POSTING', $disallowed));
 	}
 
 	file_gc();

From c4b28a393624e99c82834e1b793b66f129f098de Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 13:24:59 +0100
Subject: [PATCH 62/75] [feature/attach-dl] Renamed $count to $files_added

PHPBB3-11042
---
 phpBB/download/file.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 58b99fc4ef..e21aec5ee7 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -367,7 +367,7 @@ else
 	}
 
 	$extensions = array();
-	$count = 0;
+	$files_added = 0;
 	$forum_id = ($attachment['in_message']) ? false : $row['forum_id'];
 	$disallowed = array();
 
@@ -386,12 +386,12 @@ else
 		}
 
 		$compress->add_custom_file("{$phpbb_root_path}files/{$attach['physical_filename']}", "{$prefix}{$attach['real_filename']}");
-		$count++;
+		$file_added++;
 	}
 
 	$compress->close();
 
-	if ($count > 0)
+	if ($files_added > 0)
 	{
 		phpbb_increment_downloads($db, $attachment_ids);
 		$compress->download($store_name, $archive_name);
@@ -399,7 +399,7 @@ else
 
 	unlink("{$phpbb_root_path}store/{$store_name}{$archive}");
 
-	if ($count < 1)
+	if ($files_added < 1)
 	{
 		// None of the attachments had a valid a extension
 		$disallowed = implode(', ', $disallowed);

From 2bcff6982afc1dac1b7a590c4de04d69e4cf187c Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 13:26:03 +0100
Subject: [PATCH 63/75] [feature/attach-dl] Used COMMA_SEPARATOR instead of
 actual comma

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index e21aec5ee7..d33e1723ca 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -402,7 +402,7 @@ else
 	if ($files_added < 1)
 	{
 		// None of the attachments had a valid a extension
-		$disallowed = implode(', ', $disallowed);
+		$disallowed = implode($user->lang['COMMA_SEPARATOR'], $disallowed);
 		send_status_line(404, 'Forbidden');
 		trigger_error($user->lang('EXTENSION_DISABLED_AFTER_POSTING', $disallowed));
 	}

From c6449b48255bcb60de271114c008df724f78d82c Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 13:31:33 +0100
Subject: [PATCH 64/75] [feature/attach-dl] Added $archive_path

PHPBB3-11042
---
 phpBB/download/file.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index d33e1723ca..8342ed0d61 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -356,14 +356,15 @@ else
 
 	$store_name = 'att_' . time() . '_' . unique_id();
 	$archive_name = 'attachments' . $suffix;
+	$archive_path = "{$phpbb_root_path}store/{$store_name}{$archive}";
 
 	if ($archive === '.zip')
 	{
-		$compress = new compress_zip('w', "{$phpbb_root_path}store/{$store_name}{$archive}");
+		$compress = new compress_zip('w', $archive_path);
 	}
 	else
 	{
-		$compress = new compress_tar('w', "{$phpbb_root_path}store/{$store_name}{$archive}", $archive);
+		$compress = new compress_tar('w', $archive_path, $archive);
 	}
 
 	$extensions = array();
@@ -397,7 +398,7 @@ else
 		$compress->download($store_name, $archive_name);
 	}
 
-	unlink("{$phpbb_root_path}store/{$store_name}{$archive}");
+	unlink($archive_path);
 
 	if ($files_added < 1)
 	{

From 9729fa9a3e6fbc559156ccd2b83b64b73e4b0194 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Tue, 14 Aug 2012 14:43:36 +0100
Subject: [PATCH 65/75] [feature/attach-dl] Cast variables to int

PHPBB3-11042
---
 phpBB/includes/functions_download.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index ed2f598429..0be12aa617 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -689,9 +689,9 @@ function phpbb_download_check_pm_auth($db, $user_id, $msg_id)
 	// Check if the attachment is within the users scope...
 	$sql = 'SELECT user_id, author_id
 		FROM ' . PRIVMSGS_TO_TABLE . '
-		WHERE msg_id = ' . $msg_id . "
-			AND user_id = $user_id
-			OR author_id = $user_id";
+		WHERE msg_id = ' . (int) $msg_id . '
+			AND user_id = ' . (int) $user_id . '
+			OR author_id = ' . (int) $user_id;
 	$result = $db->sql_query_limit($sql, 1);
 	$allowed = $db->sql_fetchrow($result);
 	$db->sql_freeresult($result);

From bf3f381c7c964e5de3d87c539dec9886e4226f7b Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Wed, 15 Aug 2012 06:01:06 +0800
Subject: [PATCH 66/75] [feature/attach-dl] Swapped the order of an if
 statement

PHPBB3-11042
---
 phpBB/download/file.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 8342ed0d61..2ee77926ed 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -300,13 +300,13 @@ else if ($download_id)
 else
 {
 	// sizeof($attachments) >= 1
-	if (!$attachment['in_message'])
+	if ($attachment['in_message'])
 	{
-		phpbb_download_handle_forum_auth($db, $auth, $attachment['topic_id']);
+		phpbb_download_handle_pm_auth($db, $auth, $user->data['user_id'], $attachment['post_msg_id']);
 	}
 	else
 	{
-		phpbb_download_handle_pm_auth($db, $auth, $user->data['user_id'], $attachment['post_msg_id']);
+		phpbb_download_handle_forum_auth($db, $auth, $attachment['topic_id']);
 	}
 
 	if (!class_exists('compress'))

From 6376cfe76604ebaab62f80dbddfc677d298a2f05 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Wed, 15 Aug 2012 06:04:12 +0800
Subject: [PATCH 67/75] [feature/attach-dl] Moved definition of $archive_name

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 2ee77926ed..8643ae9e28 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -353,9 +353,9 @@ else
 
 	$clean_name = phpbb_download_clean_filename($row['attach_subject']);
 	$suffix = '_' . (($post_id) ? $post_id : $topic_id) . '_' . $clean_name;
+	$archive_name = 'attachments' . $suffix;
 
 	$store_name = 'att_' . time() . '_' . unique_id();
-	$archive_name = 'attachments' . $suffix;
 	$archive_path = "{$phpbb_root_path}store/{$store_name}{$archive}";
 
 	if ($archive === '.zip')

From 617a5132d8603936376185954a30a6272b2384e5 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Wed, 15 Aug 2012 06:05:31 +0800
Subject: [PATCH 68/75] [feature/attach-dl] Fixed $file_added to $files_added

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 8643ae9e28..939dbe81f7 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -387,7 +387,7 @@ else
 		}
 
 		$compress->add_custom_file("{$phpbb_root_path}files/{$attach['physical_filename']}", "{$prefix}{$attach['real_filename']}");
-		$file_added++;
+		$files_added++;
 	}
 
 	$compress->close();

From f6e8d938cb4fcd0bee2340033328f2f7cfade232 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Wed, 15 Aug 2012 06:06:28 +0800
Subject: [PATCH 69/75] [feature/attch-dl] $forum_id cast to int

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 939dbe81f7..170998d5e1 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -369,7 +369,7 @@ else
 
 	$extensions = array();
 	$files_added = 0;
-	$forum_id = ($attachment['in_message']) ? false : $row['forum_id'];
+	$forum_id = ($attachment['in_message']) ? false : (int) $row['forum_id'];
 	$disallowed = array();
 
 	foreach ($attachments as $attach)

From 5827250a94e38d9b637ed8ae9e9c4a584223cc31 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Wed, 15 Aug 2012 06:08:18 +0800
Subject: [PATCH 70/75] [feature/attach-dl] Fixed the logic in an sql statement

PHPBB3-11042
---
 phpBB/includes/functions_download.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index 0be12aa617..182fce222b 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -690,8 +690,10 @@ function phpbb_download_check_pm_auth($db, $user_id, $msg_id)
 	$sql = 'SELECT user_id, author_id
 		FROM ' . PRIVMSGS_TO_TABLE . '
 		WHERE msg_id = ' . (int) $msg_id . '
-			AND user_id = ' . (int) $user_id . '
-			OR author_id = ' . (int) $user_id;
+			AND (
+				user_id = ' . (int) $user_id . '
+				OR author_id = ' . (int) $user_id . '
+			)';
 	$result = $db->sql_query_limit($sql, 1);
 	$allowed = $db->sql_fetchrow($result);
 	$db->sql_freeresult($result);

From 227ae48255f7bfb2dd4387c83df3af5320102615 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Wed, 15 Aug 2012 06:10:53 +0800
Subject: [PATCH 71/75] [feature/attach-dl] Optimised an sql query

PHPBB3-11042
---
 phpBB/includes/functions_download.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index 182fce222b..b6371dbecc 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -687,7 +687,7 @@ function phpbb_download_handle_pm_auth($db, $auth, $user_id, $msg_id)
 function phpbb_download_check_pm_auth($db, $user_id, $msg_id)
 {
 	// Check if the attachment is within the users scope...
-	$sql = 'SELECT user_id, author_id
+	$sql = 'SELECT msg_id
 		FROM ' . PRIVMSGS_TO_TABLE . '
 		WHERE msg_id = ' . (int) $msg_id . '
 			AND (
@@ -695,7 +695,7 @@ function phpbb_download_check_pm_auth($db, $user_id, $msg_id)
 				OR author_id = ' . (int) $user_id . '
 			)';
 	$result = $db->sql_query_limit($sql, 1);
-	$allowed = $db->sql_fetchrow($result);
+	$allowed = (bool) $db->sql_fetchfield('msg_id');
 	$db->sql_freeresult($result);
 
 	return $allowed;

From 884a213d55bfbe06b3c3d63f4596a9a52801a399 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Wed, 15 Aug 2012 06:11:30 +0800
Subject: [PATCH 72/75] [feature/attach-dl] Fixed a comment

PHPBB3-11042
---
 phpBB/download/file.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 170998d5e1..701405f3d4 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -402,7 +402,7 @@ else
 
 	if ($files_added < 1)
 	{
-		// None of the attachments had a valid a extension
+		// None of the attachments had a valid extension
 		$disallowed = implode($user->lang['COMMA_SEPARATOR'], $disallowed);
 		send_status_line(404, 'Forbidden');
 		trigger_error($user->lang('EXTENSION_DISABLED_AFTER_POSTING', $disallowed));

From 53aadd60a66c813db90aa1d54e649384679f2614 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Fri, 17 Aug 2012 16:16:02 +0100
Subject: [PATCH 73/75] [feature/attach-dl] Renamed $post_id to $post_msg_id

PHPBB3-11042
---
 phpBB/download/file.php                   | 14 +++++++-------
 phpBB/includes/ucp/ucp_pm_viewmessage.php |  2 +-
 phpBB/viewtopic.php                       |  2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 701405f3d4..5563e34cda 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -135,7 +135,7 @@ require($phpbb_root_path . 'includes/functions_download' . '.' . $phpEx);
 
 $download_id = request_var('id', 0);
 $topic_id = $request->variable('topic_id', 0);
-$post_id = $request->variable('post_id', 0);
+$post_msg_id = $request->variable('post_msg_id', 0);
 $archive = $request->variable('archive', '.tar');
 $mode = request_var('mode', '');
 $thumbnail = request_var('t', false);
@@ -156,10 +156,10 @@ if ($download_id)
 	// Attachment id (only 1 attachment)
 	$sql_where = "attach_id = $download_id";
 }
-else if ($post_id)
+else if ($post_msg_id)
 {
 	// Post id or private message id (multiple attachments)
-	$sql_where = "post_msg_id = $post_id AND is_orphan = 0";
+	$sql_where = "post_msg_id = $post_msg_id AND is_orphan = 0";
 }
 else if ($topic_id)
 {
@@ -319,19 +319,19 @@ else
 		$archive = '.tar';
 	}
 
-	if ($post_id)
+	if ($post_msg_id)
 	{
 		if ($attachment['in_message'])
 		{
 			$sql = 'SELECT message_subject AS attach_subject
 				FROM ' . PRIVMSGS_TABLE . "
-				WHERE msg_id = $post_id";
+				WHERE msg_id = $post_msg_id";
 		}
 		else
 		{
 			$sql = 'SELECT post_subject AS attach_subject, forum_id
 				FROM ' . POSTS_TABLE . "
-				WHERE post_id = $post_id";
+				WHERE post_id = $post_msg_id";
 		}
 	}
 	else
@@ -352,7 +352,7 @@ else
 	}
 
 	$clean_name = phpbb_download_clean_filename($row['attach_subject']);
-	$suffix = '_' . (($post_id) ? $post_id : $topic_id) . '_' . $clean_name;
+	$suffix = '_' . (($post_msg_id) ? $post_msg_id : $topic_id) . '_' . $clean_name;
 	$archive_name = 'attachments' . $suffix;
 
 	$store_name = 'att_' . time() . '_' . unique_id();
diff --git a/phpBB/includes/ucp/ucp_pm_viewmessage.php b/phpBB/includes/ucp/ucp_pm_viewmessage.php
index 16fa7d630e..27111f9c9a 100644
--- a/phpBB/includes/ucp/ucp_pm_viewmessage.php
+++ b/phpBB/includes/ucp/ucp_pm_viewmessage.php
@@ -283,7 +283,7 @@ function view_message($id, $mode, $folder_id, $msg_id, $folder, $message_row)
 	// Display not already displayed Attachments for this post, we already parsed them. ;)
 	if (isset($attachments) && sizeof($attachments))
 	{
-		$methods = phpbb_gen_download_links('post_id', $msg_id, $phpbb_root_path, $phpEx);
+		$methods = phpbb_gen_download_links('post_msg_id', $msg_id, $phpbb_root_path, $phpEx);
 		foreach ($methods as $method)
 		{
 			$template->assign_block_vars('dl_method', $method);
diff --git a/phpBB/viewtopic.php b/phpBB/viewtopic.php
index 9f044e0a89..41566219b9 100644
--- a/phpBB/viewtopic.php
+++ b/phpBB/viewtopic.php
@@ -1606,7 +1606,7 @@ for ($i = 0, $end = sizeof($post_list); $i < $end; ++$i)
 			);
 		}
 
-		$methods = phpbb_gen_download_links('post_id', $row['post_id'], $phpbb_root_path, $phpEx);
+		$methods = phpbb_gen_download_links('post_msg_id', $row['post_id'], $phpbb_root_path, $phpEx);
 		foreach ($methods as $method)
 		{
 			$template->assign_block_vars('postrow.dl_method', $method);

From b1239f1c1aca6a96ed3b470e1d386ec1d1024de7 Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Mon, 20 Aug 2012 21:47:29 +0100
Subject: [PATCH 74/75] [feature/attach-dl] Changed $files_added checks

PHPBB3-11042
---
 phpBB/download/file.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/phpBB/download/file.php b/phpBB/download/file.php
index 5563e34cda..b56d729a7b 100644
--- a/phpBB/download/file.php
+++ b/phpBB/download/file.php
@@ -392,7 +392,7 @@ else
 
 	$compress->close();
 
-	if ($files_added > 0)
+	if ($files_added)
 	{
 		phpbb_increment_downloads($db, $attachment_ids);
 		$compress->download($store_name, $archive_name);
@@ -400,7 +400,7 @@ else
 
 	unlink($archive_path);
 
-	if ($files_added < 1)
+	if (!$files_added)
 	{
 		// None of the attachments had a valid extension
 		$disallowed = implode($user->lang['COMMA_SEPARATOR'], $disallowed);

From e1a4aa3ea255874660d31e13c0b4cadc8993ef4f Mon Sep 17 00:00:00 2001
From: Fyorl <gaelreth@gmail.com>
Date: Mon, 20 Aug 2012 21:52:42 +0100
Subject: [PATCH 75/75] [feature/attach-dl] Removed the use of some
 abbreviations

PHPBB3-11042
---
 phpBB/language/en/common.php                        | 2 +-
 phpBB/styles/prosilver/template/viewtopic_body.html | 4 ++--
 phpBB/viewtopic.php                                 | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/phpBB/language/en/common.php b/phpBB/language/en/common.php
index 61749046c4..e6022e3b79 100644
--- a/phpBB/language/en/common.php
+++ b/phpBB/language/en/common.php
@@ -162,7 +162,7 @@ $lang = array_merge($lang, array(
 	'DISPLAY_POSTS'			=> 'Display posts from previous',
 	'DISPLAY_TOPICS'		=> 'Display topics from previous',
 	'DOWNLOAD_ALL'			=> 'Download all',
-	'DOWNLOAD_ALL_ATTACH'	=> 'Download all attachments',
+	'DOWNLOAD_ALL_ATTACHMENTS'	=> 'Download all attachments',
 	'DOWNLOADED'			=> 'Downloaded',
 	'DOWNLOADING_FILE'		=> 'Downloading file',
 	'DOWNLOAD_COUNTS'		=> array(
diff --git a/phpBB/styles/prosilver/template/viewtopic_body.html b/phpBB/styles/prosilver/template/viewtopic_body.html
index d2dbe8a581..4534dc5bcc 100644
--- a/phpBB/styles/prosilver/template/viewtopic_body.html
+++ b/phpBB/styles/prosilver/template/viewtopic_body.html
@@ -159,7 +159,7 @@
 				<dl class="attachbox">
 					<dt>
 						{L_ATTACHMENTS}
-						<!-- IF postrow.S_MULTIPLE_ATTACH -->
+						<!-- IF postrow.S_MULTIPLE_ATTACHMENTS -->
 							<div class="dl_links">
 								<strong>{L_DOWNLOAD_ALL}:</strong>
 								<ul>
@@ -270,7 +270,7 @@
 
 	<!-- IF S_HAS_ATTACHMENTS -->
 		<div class="dl_links">
-			<strong>{L_DOWNLOAD_ALL_ATTACH}:</strong>
+			<strong>{L_DOWNLOAD_ALL_ATTACHMENTS}:</strong>
 			<ul>
 			<!-- BEGIN dl_method -->
 				<li>[ <a href="{dl_method.LINK}">{dl_method.TYPE}</a> ]</li>
diff --git a/phpBB/viewtopic.php b/phpBB/viewtopic.php
index 41566219b9..036f70e729 100644
--- a/phpBB/viewtopic.php
+++ b/phpBB/viewtopic.php
@@ -1566,7 +1566,7 @@ for ($i = 0, $end = sizeof($post_list); $i < $end; ++$i)
 		'POSTER_ID'			=> $poster_id,
 
 		'S_HAS_ATTACHMENTS'	=> (!empty($attachments[$row['post_id']])) ? true : false,
-		'S_MULTIPLE_ATTACH'	=> !empty($attachments[$row['post_id']]) && sizeof($attachments[$row['post_id']]) > 1,
+		'S_MULTIPLE_ATTACHMENTS'	=> !empty($attachments[$row['post_id']]) && sizeof($attachments[$row['post_id']]) > 1,
 		'S_POST_UNAPPROVED'	=> ($row['post_approved']) ? false : true,
 		'S_POST_REPORTED'	=> ($row['post_reported'] && $auth->acl_get('m_report', $forum_id)) ? true : false,
 		'S_DISPLAY_NOTICE'	=> $display_notice && $row['post_attachment'],