Changing target to 1.99 beta 3. (This doesn't mean it shouldn't be done a.s.a.p 
for GoMOOS - only that it isn't critical to the general Beta 2 release.)

Changing Version to 1.99 (2.0 not being worked on yet).

Taking this one since it's a P1.

Starting working on this.
I will propose my patch here before commiting anything since we are playing with
URL and so with security.

I noticed 2 problems while working on this. But I want to make sure with Paul
that they were not intentional before commiting anything. My change would be in
the core, so I want to make sure they are ok.

1- The fileSystemToURL() function did not check for the TmpImgPath directory.
2- There's no way of making a non-web-visible file web-visible.

To fix that I added in this function the functionality to copy files to the
TmpWebPath directory and to get file from the TmpIngPath.

Should I've done a new function for this purpose? Or is it ok to put them there?

Look:
function fileSystemToURL( $szFileSystemPath, $bMakeWebVisible=false )
{
    $szFileSystemPath = str_replace( '\\', '/', $szFileSystemPath );
    $szFileSystemPath = ereg_replace ("/+", "/", $szFileSystemPath);
    //echo "filesystem path: $szFileSystemPath<BR>";

    $szAppPath = str_replace( '\\', '/', realpath($_SESSION['gszAppPath']) );
    $szAppPath = ereg_replace ("/+", "/", $szAppPath);
    //echo "app path: $szAppPath<BR>";

    if (strncmp( $szFileSystemPath, $szAppPath, strlen($szAppPath) ) == 0)
        return $_SESSION['gszAppWebPath'].'/'.substr( $szFileSystemPath,
strlen($szAppPath));

    $szCorePath = str_replace( '\\', '/', realpath($_SESSION['gszCorePath']) );
    $szCorePath = ereg_replace ("/+", "/", $szCorePath);
    if (strncmp( $szFileSystemPath, $szCorePath, strlen($szCorePath) ) == 0)
    return
$_SESSION['gszCoreWebPath'].'/'.substr($szFileSystemPath,strlen($szCorePath));

    $szTmpImgPath = str_replace( '\\', '/', 
                                 realpath($_SESSION['gszTmpImgPath']) );
    $szTmpImgPath = ereg_replace ("/+", "/", $szTmpImgPath);
    if (strncmp( $szFileSystemPath, $szTmpImgPath, strlen($szTmpImgPath) ) == 0)
        return
$_SESSION['gszTmpWebPath'].'/'.substr($szFileSystemPath,strlen($szTmpImgPath));

    if($bMakeWebVisible == true && is_file($szFileSystemPath))
    {
        $szDestFileName = $szTmpImgPath.'/'.
            substr($szFileSystemPath, strrpos($szFileSystemPath, '/'));
        copy($szFileSystemPath, $szDestFileName);
        return
$_SESSION['gszTmpWebPath'].'/'.substr($szDestFileName,strlen($szTmpImgPath)+1);
    }

    return $szFileSystemPath;
}

do these changes fix the problem?  Can you describe the actual problem in more
detail and how this fixes it?  Other than that, if its fixed, I'm happy :)

This fix the problem by downloading the image and putting it in the session
folder (this was already done). What my changes do is to copy this image in the
gszTmpWebPath and return this path. So now the image is on the machine and
available from the web.

even though the keymap is working how can we verifiy that this was a successful
fix. :) Julie? Paul?

The original problem was that using a URL with the keymap widget did not work. 
I would suggest that you can verify by modifying a cwc2 template and changing
the keymap widget to use a remote image as its source and see if it works :)

Maybe I should read the bug. doh! I have been verify is getting to me. ;)

was able to get keymap in application using a URL:
 <cwc2 type="KeyMapDHTML"
image="http://nemesis/chameleon/samples/images/keymap.png" />

verified on windows beta3 20041022

set to verified.

Verified on Fedora Core 2 following comments #9 and #10.