In the latest code release, it decides if the file is in part of the site using the following code
mimemail.inc:180

    $public_path = file_directory_path();
    $no_access = !user_access('send arbitrary files - Warning: has security implications!');
    $not_in_public_path = strpos(realpath($file), $public_path) === FALSE;
    if (@is_file($file) && $not_in_public_path && $no_access) {
      return $url;
    }

If you have separated the Drupal files directory into another part of the file system and use a symbolic link then there is a chance above fails even although Drupal has created and written the file. The work around is to set the permission 'send arbitary files - Warning: has security implications!'.

Why have a separated files directory? To keep uploaded files in a well known place, so if the files in the modules and themes change, it is possible, using symbolic links, to version control their releases. The same goes for the settings.php file.

Comments

somersoft’s picture

somersoft commented
Title: Deciding if file in » Deciding if file in public path or not.
luti’s picture

luti commented

It seems not to work as expacted with mail sent from simplenews...

I've created a newsletter as site admin, and send a test message within simplenews. Site admin has explicitely checked option to send arbitrary files (altough user with uid = 1 should have this permission by default already, as the user_access() function works). Images contained in public path are not included in the message though.

Probably user_access() should be called with $user (author of the newsletter message) provided or something like that (when $no_access is calculated)?

I've commented out a line "return $url;" until this is resolved (and, images are back to the message...).

sgabe’s picture

sgabe commented

@LUTi: I remember that Simplenews switches users for sending.

luti’s picture

luti commented

OK, but how? Does it switch to the author or does it have any own idedntity (and, what would it be in this case)?

I've created a node (newsletter / message) as user UID = 1 (site admin). This user should have access to everything by default already. Furthermore, I've explicitely enabled it in permissions. So, why are files (images which should be included) not accepted (to be added to the message), but refused?

sgabe’s picture

sgabe commented

@LUTi: It switches to anonymous user.

luti’s picture

luti commented

sgabe, thank you for the feedback.

So, we have a problem with this new feature of mimemail now... Should this be reported as a feature request to simplenews (to provide a user - an author of the newsletter / node instead of switching to an anonymous)?

As I really don't see a benefit to have this new feature in mimemail, but have to enable anonymous user to make simplenews work...

nextpic’s picture

nextpic commented

Hello everyone,
after updating the module "mime mail" from version 6.x-1.0 to 6.x-1.1, when sending the newsletter with the module "simplenews", the links in the body of e-mail are created without the domain. For example, if the first were http://www.mysite.com/page/text now is http://page/text.
how can I fix it?

sgabe’s picture

sgabe commented

This is not a new feature but a security bug fix see SA-CONTRIB-2012-124.

luti’s picture

luti commented

I understand it is a security fix... ;-)

But if we have to enable "send arbitrary files" for an Anonymous user to make simplenews work, we haven't do much, or? As we don't enable it for just the user who should be able to do it (an author of a certain newsletter), but for any anonymous user...

So, it should be a feature request for simplenews (and not for mimemail), or?

sgabe’s picture

sgabe commented

Images contained in public path are not included in the message though.

If the files are in the public directory then in should work as expected. Just to be clear, do you use symlinks? Or the culprit is something else?

luti’s picture

luti commented

Yes, I have images in some other directory, as they are common for multiple websites.

Just to be clear, I don't blame mimemail for anything (I understand this was needed is for security reasons). I just don't want to theck the option "send arbitrary files" for Anonymous user, as I believe simplenews should somehow provide the actual user for a newsletter (an author of the content / node).