Index: openacs-4/packages/file-storage/www/download-zip.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/file-storage/www/download-zip.tcl,v
diff -u -r1.6 -r1.7
--- openacs-4/packages/file-storage/www/download-zip.tcl	2 Feb 2008 12:17:27 -0000	1.6
+++ openacs-4/packages/file-storage/www/download-zip.tcl	27 Oct 2014 16:41:32 -0000	1.7
@@ -1,19 +1,20 @@
 ad_page_contract {
     delete items
 } {
-    object_id:notnull,multiple
+    object_id:naturalnum,notnull,multiple
     {confirm_p:optional,boolean 0}
     {return_url ""}
 } -errors {object_id:,notnull,integer,multiple {Please select at least one item to download.}
 }
 
+auth::require_login 
 set user_id [ad_conn user_id]
 
 # publish the object to the file system
-set in_path [ns_tmpnam]
+set in_path [ad_tmpnam]
 file mkdir $in_path
 
-if {[llength $object_id] eq 1} {
+if {[llength $object_id] == 1} {
     set download_name [fs::get_file_system_safe_object_name -object_id $object_id]
 } else {
     set download_name [fs::get_file_system_safe_object_name -object_id [fs::get_parent -item_id [lindex $object_id 0]]]
@@ -22,23 +23,30 @@
 append download_name ".zip"
 
 foreach fs_object_id $object_id {
+    # The minimal requirment is that the object exists. Don't throw
+    # hard errors on following outdated links. We could test for
+    # supported object_types.
+    if {![acs_object::object_p -id $fs_object_id]} {
+	ns_returnnotfound
+	file delete -force $in_path
+	ad_script_abort 
+    }
     set file [fs::publish_object_to_file_system -object_id $fs_object_id -path $in_path -user_id $user_id]
 }
 
 # create a temp dir to put the archive in
-set out_path [ns_tmpnam]
+set out_path [ad_tmpnam]
 file mkdir $out_path
 
-set out_file [file join "${out_path}" "${download_name}"]
+set out_file [file join ${out_path} ${download_name}]
 
-# get the archive command
-set cmd "zip -r \"$out_file\" ."
-
 # create the archive
 with_catch errmsg {
-    exec bash -c "cd $in_path; $cmd; cd -"
+    util::zip -source $in_path -destination $out_file
 } {
     # some day we'll do something useful here
+    file delete -force $in_path
+    file delete -force $out_path
     error $errmsg
 }