Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.
Sign up to join this community
For my webforms, I want to receive attachments, when I receive an email. I had issues receiving them until I set the permissions for Anonymous User to allow them to use "Send arbitrary files".
Underneath, there's a warning:
Give to trusted roles only; this permission has security implications.
Does anyone know what are the security implications?
Thanks!
It means that MimeMail (because that's a MimeMail permission) would be able to attach a file that's it not in the public files directory, like private files, settings.php or any other file in your filesystem.
However, using this permission is mandatory to attach private files, for example, because they are outside the public files directory.
What are the security issues? Well, it depends on what you attach to your email and how. For example, if the path of the attached file depends on some user input, the user can potentially craft a special input that may lead to attaching certain files like the settings.php file or any private file (if the malicious user knows the file path, or can guess it). If your code doesn't allow this you are probably safe.
For example, you may have private files in your nodes and your code just emails the private file of a certain node given its nid, and you get the nid form a button in the full node view page. On this scenario, it seems a malicious user can't craft any submission that attaches an arbitrary file as a result.
In MimeMail words:
The 'send arbitrary files' permission allows you to attach or embed files located outside Drupal's public files directory. Note that this has security implications: arbitrary includes even your settings.php! Give to trusted roles only!
Also, check how MimeMail uses the 'send arbitrary files' permission
