Item4827: Using the viewfile script for an attachment when logged out does not work

When logged in, this produces an attachment as expected.
http://server/bin/viewfile/Main/TestTopic?filename=test.txt

Although, when logged out, it produces login screen:
http://server/bin/login/Main/TestTopic?filename=test.txt;origurl=%2Fbin%2Fviewfile%2FMain%TestTopic%3Ffilename%3Dtest.txt

After logging in, another request is made to viewfile, but this fails with a redirect to an "Attachment '?' does not exist" page.
http://server/bin/oops/Main/TestTopic?template=oopsattention;def=no_such_attachment;param1=viewfile;param2=%3f

Note the values for param1 and param2 are incorrect.

They should look like this, for a request for a non-existent attachment:
http://server/bin/viewfile/Main/TestTopic?filename=doesntexist.txt
http://server/bin/oops/Main/TestTopic?template=oopsattention;def=no_such_attachment;param1=viewfile;param2=doesntexist.txt

The data passed in from 'origurl' seems to have been parsed such that the filename is the question mark character, rather than 'test.txt' as it should have been.
I have spent a bit of time searching for where this may occur with not much luck. It seems odd that the problem lies with NatSkin, rather than TWiki.

-- TWiki:Main/ChrisLJones - 15 Oct 2007