Change record status: 
Introduced in branch: 
1.x
Introduced in version: 
1.6.0
Description: 

Adds support for embedding and enhances security with access control for attachments.

  1. New class Attachment based on Symfony DataPart.
  2. New function $email->attach(Attachment) which automatically 'embeds' the attachment when needed.
  3. New functions email->getAttachments() and email->removeAttachment() to find and alter existing attachments.
  4. Access control for attachments controlled by Attachment::setAccess().
  5. Default access set by AttachmentAccessEmailAdjuster. Allows public files, temporary content (via Attachment::fromData()) and anything that the webserver allows access to using http/https.
  6. Custom code is needed to attach any other content. Obviously this creates extra work but it avoids the attackers emailing themselves private files such as settings.php or webserver log/config.

Changes to existing code

Before

$email->attachFromPath($path);
$email->attachNoPath($body, $name);

After

$email->attachFromPath($path);  // unchanged
$email->attach(Attachment::fromData($body, $name));
// For files in protected locations:
Attachment::setAccess();
Impacts: 
Site builders, administrators, editors
Module developers