Coming from: #2816303: File upload destination should be private files by default if available

If private files is used (and should be) on a webform, the only way to actually attach a file to the message is to go into the user permissions and enable "Send arbitrary files" for Mime Mail. The feature request is a 2 option part, with the second option being the better route IMO.

1) If attach file is enabled on the webform, webform should automatically check for and set the "Send arbitrary Files". The million dollar question is: "For which role". It is assumed anonymous and authenticated. The inherent problem is that this potentially could open up other security issues since this is a site wide global permission.

2) Webform will set the "Send arbitrary files" flag for anonymous and authenticated, ONLY for webform. Maybe this means a new permission needs to be added for webform to be able to control this, however "if" a user is enabling the option to send attachments, it is probably not too much to expect they are OK with enabling this for all roles, specifically for webform. It makes me uneasy to have that permission set to anonymous for the entire site, however I'd be fine if it was only webform.

The other thing to think about if this is not directly addressed, is to simply add a description to the "Attach file to message", pointing people to set that permission manually and warn of the implications of setting it globally. Maybe even link to permissions to make it easier to find. As one of the folks in the linked issue mentioned, they spent countless days trying to figure out how to attach a file to an email after converting to private files. I was fortunate enough to figure it out within a few hours.

Comments

philsward created an issue. See original summary.

philsward’s picture

Issue summary: View changes
Liam Morland’s picture

robertragas’s picture

+1

Not sure what the best way to go is, but now it feels like if there would be a leak, that everyone potentially has the option to send themselves every private file there is.

israel dahan’s picture

subscribe