Latest version of PHPMailer no longer attaches files to emails

[threeatetwo]

I've been trying to track down why my s3 bucket files are no longer being attached to automated emails being sent out by WordPress (using the Gravity Forms Entry Automation plugin).

I've been able to identify the latest version of PHPMailer being the reason why the attachments no longer get added. From the author:

---

This is due to a bug fix that also closed a major security hole. PHPMailer deliberately avoids being a client for HTTP or other protocols for file attachments because it is far too risky. The solution is to take on responsibility for fetching remote files yourself. Instead of :

$mail->addAttachment('s3://file.txt', 'file.txt');

Do this:

$mail->addStringAttachment(file_get_contents('s3://file.txt'), 'file.txt');

​https://github.com/PHPMailer/PHPMailer/issues/2355#issuecomment-858373284

---

I reached out to the Gravity Forms authors as well as the Entry Automation authors and they both have said their plugins just generate raw notification objects and then use wp_mail() to pass the generated mail object off to the rest of my server to actually handle the sending.

Is there a way to get this working again without having to roll my WP version back? Or do y'all know how others are handling this issue?

[threeatetwo]

Would it be possible in wp_mail to add a filter to handle attachment URLs and fetch the contents? My temporary fix right now is I copied the wp_mail function into a plugin and modified it like so:

    if ( ! empty( $attachments ) ) {
      foreach ( $attachments as $attachment ) {
        try {
          if ( substr($attachment, 0, 20 ) === "s3://mybucketnamehere" ) {
            $strArray = explode('/',$attachment);
            $filename = end($strArray);
            $phpmailer->addStringAttachment( file_get_contents($attachment ), $filename);
          } else {
            $phpmailer->addAttachment( $attachment );
          }
        } catch ( PHPMailer\PHPMailer\Exception $e ) {
          continue;
        }
      }
    }

[desrosj]

Sorry that someone was not able to investigate this one before the deadline to include in 5.8. I'm moving this to 5.8.1 to get it some attention.

[peterwilsoncc]

Introduced in [50799] and [50800] for #53114. If I recall correctly, some of these changes were ported in to earlier versions of WP too.

Given the relative popularity of using streams in WP (s3 and other storage bucket plugins are quite popular), I'd like to support streams for attaching files to email.

I'm hesitant about something as simple as:

<?php
if ( is_wp_stream( /* file */ ) ) {
  $phpmailer->addStringAttachment( file_get_contents( /* file */ ) );
}

Such code include HTTP, FTP and several similar protocols by default. Essentially reintroducing to WP the problem the PHPMailer library was trying to avoid.

It's WP's prerogative to loosen the restrictions on streams to account for acceptable and safe use within the user base, care will need to be taken not to loosen the restrictions too far.

[Boniu91]

Hello @threeatetwo

Thank you for reporting this issue. Could you provide us with the exact instructions on how to reproduce the problem?

1. Used plugins?
2. How they're set up?
3. What are the exact steps to reproduce the problem

With the above data, it'll be much easier for us to see the problem on our own and later confirm that the fix is correct and doesn't introduce any regressions.

Thank you!

[desrosj]

This still needs a working patch and more discussion/testing. Because 5.8.1 RC is due out in less than 24 hours, I'm going to punt this to 5.8.2.

[desrosj]

This one still needs a patch and proper review. With 5.8.2 RC due out tomorrow, I'm going to punt this to Future Release.