By adamps on
Change record status:
Published (View all published change records)
Project:
Introduced in branch:
1.x
Introduced in version:
1.6.0
Issue links:
Description:
Adds support for embedding and enhances security with access control for attachments.
- New class
Attachmentbased on SymfonyDataPart. - New function
$email->attach(Attachment)which automatically 'embeds' the attachment when needed. - New functions
email->getAttachments()andemail->removeAttachment()to find and alter existing attachments. - Access control for attachments controlled by
Attachment::setAccess(). - Default access set by
AttachmentAccessEmailAdjuster. Allows public files, temporary content (viaAttachment::fromData()) and anything that the webserver allows access to using http/https. - Custom code is needed to attach any other content. Obviously this creates extra work but it avoids the attackers emailing themselves private files such as settings.php or webserver log/config.
Changes to existing code
Before
$email->attachFromPath($path);
$email->attachNoPath($body, $name);
After
$email->attachFromPath($path); // unchanged
$email->attach(Attachment::fromData($body, $name));
// For files in protected locations:
Attachment::setAccess();
$email->attachFromPath($path);
$email->attachNoPath($body, $name);
$email->attachFromPath($path); // unchanged
$email->attach(Attachment::fromData($body, $name));
// For files in protected locations:
Attachment::setAccess();
Impacts:
Site builders, administrators, editors
Module developers