This plugin has a contact author first policy but I am going to break that policy because...

• The plugin has a major security problem. If you use it now - uninstall it now and wait for my update.
• The plugin has a very likely race condition problem
• The plugin leaves a mess in its work area.

I am addressing all 3 in an update of the plugin. Still fighting with some other details which may be an error in core. The problem I fight is that attachments saved by the plugin using the official API cannot later have their comment attribute altered.

KJL

Turned out the plugin was also running when you run upload so when you changed the attribute, the plugin reset them back.

When you save the topic the attributes are still overwritten. That is how the API works.

At least the plugin works much safer and better now.

KJL