Index: openacs-4/packages/file-storage/www/download-zip.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/file-storage/www/download-zip.tcl,v
diff -u -N -r1.6 -r1.6.6.1
--- openacs-4/packages/file-storage/www/download-zip.tcl	2 Feb 2008 12:17:27 -0000	1.6
+++ openacs-4/packages/file-storage/www/download-zip.tcl	9 Oct 2013 06:36:14 -0000	1.6.6.1
@@ -7,13 +7,14 @@
 } -errors {object_id:,notnull,integer,multiple {Please select at least one item to download.}
 }
 
+auth::require_login 
 set user_id [ad_conn user_id]
 
 # publish the object to the file system
 set in_path [ns_tmpnam]
 file mkdir $in_path
 
-if {[llength $object_id] eq 1} {
+if {[llength $object_id] == 1} {
     set download_name [fs::get_file_system_safe_object_name -object_id $object_id]
 } else {
     set download_name [fs::get_file_system_safe_object_name -object_id [fs::get_parent -item_id [lindex $object_id 0]]]
@@ -22,14 +23,22 @@
 append download_name ".zip"
 
 foreach fs_object_id $object_id {
+    # The minimal requirment is that the object exists. Don't throw
+    # hard errors on following outdated links. We could test for
+    # supported object_types.
+    if {![acs_object::object_p -id $fs_object_id]} {
+	ns_returnnotfound
+	file delete -force $in_path
+	ad_script_abort 
+    }
     set file [fs::publish_object_to_file_system -object_id $fs_object_id -path $in_path -user_id $user_id]
 }
 
 # create a temp dir to put the archive in
 set out_path [ns_tmpnam]
 file mkdir $out_path
 
-set out_file [file join "${out_path}" "${download_name}"]
+set out_file [file join ${out_path} ${download_name}]
 
 # get the archive command
 set cmd "zip -r \"$out_file\" ."
@@ -39,6 +48,8 @@
     exec bash -c "cd $in_path; $cmd; cd -"
 } {
     # some day we'll do something useful here
+    file delete -force $in_path
+    file delete -force $out_path
     error $errmsg
 }