darvanen → credited chx → .
Charlie ChX Negyesi → credited chx → .
quietone → credited chx → .
I complete agree and really, really like applying There Is No Kill Like Overkill to testing security related aspects of Drupal core.
Blast from the past #10824: node duplication →
Sure there are. It needs comments and tests too. Others can work on those...
during menu router (link) ?! Yes. Good idea. Let me feel the links rebuild ... striking at the evil core ... this day will last forever... (i should listen to less Judas Priest but something must keep me awake at this hour).
http://drupal.org/node/591682#comment-2425632 has a solution. ick but solution.
Benchmarks?
We agreed that the solution is that I am doccing right now that #type file can't be required.
(21:46:24) vertice: the problem is that during the upload process, the stuff gets removed OUT of the form system
(21:46:28) vertice: and gets stuffed in the session
(21:46:36) vertice: and every file api module does this on it's own
This is not the place neither the time to fix file API. Everybody on its own. I am outta here. If the change gets in, I will doc the change.