fix: reject dangling file attachment links

server/db/mysql/adapter.go

@@ -5135,16 +5135,27 @@ func (a *adapter) FileLinkAttachments(topic string, userId, msgId t.Uid, fids []
 		}
 		dids = append(dids, store.DecodeUid(id))
 	}
+	var existing int
+	query, queryArgs, err := sqlx.In("SELECT COUNT(*) FROM im_fileuploads WHERE id IN (?) AND status=?", dids, t.UploadCompleted)
+	if err != nil {
+		return err
+	}
+	ctx, cancel := a.getContextForTx()
+	if cancel != nil {
+		defer cancel()
+	}
+	if err = a.db.GetContext(ctx, &existing, a.db.Rebind(query), queryArgs...); err != nil {
+		return err
+	}
+	if existing != len(dids) {
+		return t.ErrNotFound
+	}
 
 	for _, id := range dids {
 		// createdat,fileid,[msgid|topic|userid]
 		args = append(args, now, id, linkId)
 	}
 
-	ctx, cancel := a.getContextForTx()
-	if cancel != nil {
-		defer cancel()
-	}
 	tx, err := a.db.BeginTxx(ctx, nil)
 	if err != nil {
 		return err