完善会话草稿恢复与附件保留，统一人工服务时区

tests/test_visitor.py

@@ -125,6 +125,17 @@ class VisitorTests(unittest.TestCase):
             self.assertIn('客户账号登录并关联',response.get_data(as_text=True))
             lookup.assert_not_called();model.assert_not_called()
 
+    def test_missing_attachments_show_a_readable_private_page_without_disclosing_ownership(self):
+        response=self.a.post('/api/upload',data={'file':(io.BytesIO(b'fixture'),'missing.txt')})
+        url=response.json['url']
+        (Path(self.app.config['UPLOAD_DIR'])/url.rsplit('/',1)[1]).unlink()
+        own=self.a.get(url);other=self.b.get(url)
+        self.assertEqual(own.status_code,404)
+        self.assertIn('附件暂时无法访问',own.get_data(as_text=True))
+        self.assertIn('no-store',own.headers['Cache-Control'])
+        self.assertEqual(own.data,other.data)
+        self.assertNotIn(url,own.get_data(as_text=True))
+
     def test_invalid_bootstrap_and_cross_site_requests_cannot_replace_the_guest(self):
         cid=self.conversation(self.a,'A_PRIVATE')
         for key in ('short','x'*64,'1'*65,[],{},123):