API File has Versioned extension

API Improved support for versioned DataObject
API GridField extensions for versioned dataobjects
API De-couple File and ErrorPage
API File::handle_shortcode now respects canView()
API AssetControlExtension is now able to delete, publish, or protect files
API Upload now protects new assets by default

_config/versioning.yml

@@ -0,0 +1,6 @@
+---
+Name: versioning
+---
+GridFieldDetailForm:
+  extensions:
+    - VersionedGridFieldDetailForm

control/RequestHandler.php

@@ -460,6 +460,7 @@ public function checkAccessAction($action) {
 	 * @param int $errorCode
 	 * @param string $errorMessage Plaintext error message
 	 * @uses SS_HTTPResponse_Exception
+	 * @throws SS_HTTPResponse_Exception
 	 */
 	public function httpError($errorCode, $errorMessage = null) {
 

dev/SapphireTest.php

@@ -169,12 +169,21 @@ public static function get_fixture_file() {
 
 	protected $model;
 
+	/**
+	 * State of Versioned before this test is run
+	 *
+	 * @var string
+	 */
+	protected $originalReadingMode = null;
+
 	public function setUp() {
 
 		//nest config and injector for each test so they are effectively sandboxed per test
 		Config::nest();
 		Injector::nest();
 
+		$this->originalReadingMode = \Versioned::get_reading_mode();
+
 		// We cannot run the tests on this abstract class.
 		if(get_class($this) == "SapphireTest") $this->skipTest = true;
 
@@ -525,6 +534,9 @@ public function tearDown() {
 			$controller->response->setStatusCode(200);
 			$controller->response->removeHeader('Location');
 		}
+
+		\Versioned::set_reading_mode($this->originalReadingMode);
+
 		//unnest injector / config now that tests are over
 		Injector::unnest();
 		Config::unnest();

docs/en/02_Developer_Guides/14_Files/03_File_Security.md

@@ -278,23 +278,27 @@ You can customise this with the below config:
 ### Configuring: Archive behaviour
 
 By default, the default extension `AssetControlExtension` will control the disposal of assets
-attached to objects when those objects are deleted. For example, unpublished versioned objects
-will automatically have their attached assets moved to the protected store. The deletion of 
-draft or unversioned objects will have those assets permanantly deleted (along with all variants).
+attached to objects when those objects are archived. For example, unpublished versioned objects
+will automatically have their attached assets moved to the protected store. The archive of 
+draft or (or deletion of unversioned objects) will have those assets permanantly deleted
+(along with all variants).
 
-In some cases, it may be preferable to have any deleted assets archived for versioned dataobjects,
-rather than deleted. This uses more disk storage, but will allow the full recovery of archived
+Note that regardless of this setting, the database record will still be archived in the
+version history for all Versioned DataObjects.
+
+In some cases, it may be preferable to have any assets retained for archived versioned dataobjects,
+instead of deleting them. This uses more disk storage, but will allow the full recovery of archived
 records and files.
 
-This can be applied to DataObjects on a case by case basis by setting the `archive_assets`
+This can be applied to DataObjects on a case by case basis by setting the `keep_archived_assets`
 config to true on that class. Note that this feature only works with dataobjects with
 the `Versioned` extension.
 
 
     :::php
     class MyVersiondObject extends DataObject {
-        /** Enable archiving */
-        private static $archive_assets = true;
+        /** Ensure assets are archived along with the DataObject */
+        private static $keep_archived_assets = true;
         /** Versioned */
         private static $extensions = array('Versioned');
     }

docs/en/04_Changelogs/4.0.0.md

@@ -25,6 +25,9 @@
    more information.
  * `Object::useCustomClass` has been removed. You should use the config API with Injector instead.
  * Upgrade of TinyMCE to version 4.
+ * `File` is now versioned, and should be published before they can be used on the frontend.
+   See section on [Migrating File DataObject from 3.x to 4.0](#migrating-file-dataobject-from-3x-to-40)
+   below for upgrade notes.
 
 ## New API
 
@@ -48,6 +51,12 @@
    TinyMCE editor.
  * `HtmlEditorField::setEditorConfig` may now take an instance of a `HtmlEditorConfig` class, as well as a
    standard config identifier name.
+ * A lot of standard versioned API has been refactored from `SiteTree` into `Versioned` extension. Now
+   all versioned DataObjects have canPublish(), canArchive(), canUnpublish(), doPublish(), doArchive()
+   doUnpublish(), isPublished() and isonDraft() out of the box. However, do*() methods will no longer
+   automatically check can*() permissions, and must be done by usercode before invocation.
+ * GridField edit form now has improved support for versioned DataObjects, with basic publishing
+   actions available when editing records.
 
 ### Front-end build tooling for CMS interface
 
@@ -243,6 +252,13 @@ large amounts of memory and run for an extended time.
 	  migrate_legacy_file: true
 
 
+This task will also support migration of existing File DataObjects to file versioning. Any
+pre-existing File DataObjects will be automatically published to the live stage, to ensure
+that previously visible assets remain visible to the public site.
+
+If additional security or visibility rules should be applied to File dataobjects, then
+make sure to correctly extend `canView` via extensions.
+
 ### Upgrade code which acts on `Image`
 
 As all image-specific manipulations has been refactored from `Image` into an `ImageManipulations` trait, which 
@@ -321,9 +337,11 @@ After:
 
 	:::php
 	function importTempFile($tmp) {
+	    Versioned::reading_stage('Stage');
 		$file = new File();
 		$file->setFromLocalFile($tmp, 'imported/'.basename($tmp));
 		$file->write();
+		$file->doPublish();
 	}
 
 
@@ -333,13 +351,19 @@ stored in the assets folder.
 
 There are other important considerations in working with File dataobjects which differ from legacy:
 
-* Deleting File dataobjects no longer removes the physical file directly. This is because any file could be referenced
-  from DBFile fields, and deleting these could be a potentially unsafe operation.
 * File synchronisation is no longer automatic. This is due to the fact that there is no longer a 1-to-1 relationship
   between physical files and File dataobjects.
-* Moving files now performs a file copy rather than moving the underlying file, although only a single DataObject
-  will exist, and will reference the destination path.
 * Folder dataobjects are now purely logical dataobjects, and perform no actual filesystem folder creation on write.
+* All Files are versioned, which means that by default, new File records will not be visibile
+  to the public site. You will need to make sure to invoke ->doPublish() on any File dataobject
+  you wish visitors to be able to see.
+
+You can disable File versioning by adding the following to your _config.php
+
+
+    :::php
+    File::remove_extension('Versioned');
+
 
 ### Upgrading code performs custom image manipulations