PR: 2054.

I'm OK with the proposed change.

It would be interesting to have some context about the actual usage you're planning for this, can you link your plugin's code ?

I was working on updating the same MantisLdapAvatar plugin and found that the plugin saves files to its ‘files’ directory (actually it could be any directory) to be uploaded to the browser, and generates the URL of such upload using core.... passing inside it only the filename without the path!

But how core understands where to find the file?!

It turns out that core itself combines the path to the file as the plugin name and the string ‘/files/’. I.e. everything worked only due to a lucky chance that in plugin path to files was literally inside ‘files’...

So I decided to do the opposite - ask core to tell me where the plugin's ‘files’ are, and remove the path selection option in the plugin itself as unsupported.

the plugin saves files to its ‘files’ directory

It does not sound like a good idea to store files in the plugin's or MantisBT's code structure - that's a recipe for disaster if you ask me. I would recommend to use another directory outside of the MantisBT root.

that's a recipe for disaster

Can you tell me more about it, please? Many dynamic content systems create caches within their main directory accessible by direct URL, e.g. file wikis, forums, ad-systems, etc.

I also saw a recommendation in the MantisBT checks section that the MantisBT root directory should not be inside the web server directory, which is also a rather obscure recommendation. Especially given the very flexible configuration options for virtual servers, aliases and file system symbolic links.

Just security best practice. Allowing uncontrolled 3rd party files in your web root may allow attackers to inject files that may later be executed on your server.

Normally write access to files is denied to the entire web server. In our case the administrator will have to manually allow writing to the ‘files’ directory, a corresponding check is added and will be performed when installing the plugin.

Many thanks @raspopov for your contribution !