Hi!

When I was looking at the attachments source code I have seen code like this:

with file:

file.write(another_file.read())

This is dangerous because you read another_file into memory completely and this can lead to MemoryErrors. There is a function shutil.copyfileobj that already does what we need: reading chunk for chunk into memory and writing it to another file object.

I enabled the Mozilla Persona plugin while my browser was logged in with a previously created basic_auth user, restarted MG and reloaded the page. Now I can't log out; the logout button changed its link to "javascript:;" and has no effect.

(Clearing cookies logged me out though.)