Enh 0003662: Provide more config vars to control viewing/downloading/deleting bug attachments.

M core/bug_api.php

• (bug_is_readonly): Added

M config_defaults_inc.php

• Group together all configs relating to bug attachments.
• Added $g_view_attachments_threshold (default VIEWER). Access level needed to view bugs attachments. View means to see the file names sizes, and timestamps of the attachments.
• Added $g_download_attachments_threshold (default VIEWER). Access level needed to download bug attachments.
• Added $g_delete_attachments_threshold (default VIEWER). Access level needed to delete bug attachments.
• Added $g_allow_view_own_attachments (default ON). Allow users to view attachments uploaded by themselves even if their access level is below view_attachments_threshold.
• Added $g_allow_download_own_attachments (default ON). Allow users to download attachments uploaded by themselves even if their access level is below download_attachments_threshold.
• Added $g_allow_delete_own_attachments (default OFF). Allow users to delete attachments uploaded by themselves even if their access level is below delete_attachments_threshold.

M core/file_api.php

• (file_can_view_bug_attachments): Added
• (file_can_download_bug_attachments): Added
• (file_can_delete_bug_attachments): Added
• (file_list_attachments): Modified to use the above three functions.

M file_download.php

• Use file_can_download_bug_attachments() from file_api.php

M view_all_inc.php

• Replaced use of UPDATER with the use of config variable update_bug_threshold.
• Use file_can_view_bug_attachments()

M admin/check.php

• Added checks to make sure that the settings for the new config vars make sense. For example, it shouldn't be possible to allow a user to delete an attachment without being able to download it or view its details.

git-svn-id: http://mantisbt.svn.sourceforge.net/svnroot/mantisbt/trunk@2448 <a class="text" href="/?p=mantisbt.git;a=object;h=f5dc347c">f5dc347c</a>-c33d-0410-90a0-b07cc1902cb9