1309217 - Support &attach= in mailto URLs specified with -compose command line switch for compatibility with LibreOffice

Status: RESOLVED WONTFIX

(Thunderbird :: Message Compose Window, enhancement)

Description

[joerg.steffens]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Build ID: 2016092200

Steps to reproduce:

I tried to generate a email with attachment by LibreOffice (4.3.7.2) resp. AdobeReader (9.4.2).

Tests on Linux (openSUSE and Ubuntu 16.04)


Actual results:

The Thunderbird compose window opens, but the attachment has not been added.


Expected results:

The Thunderbird compose window should open and have the attachment included.

Comment 1

[joerg.steffens]

What happens:

LibreOffice executes following command:
/usr/lib64/thunderbird/thunderbird-bin --compose "mailto:?subject=document&attach=file:///tmp/lu5ggnu2.tmp/lu5ggnug.tmp/document.odt"

AcrobatReader:
/usr/lib64/thunderbird/thunderbird-bin --compose "mailto:?attach=/home/user/.adobe/Acrobat/9.0/Temp/SendMail/tmparOd7h0O/document.pdf&cc=&bcc=&subject=&body="

The documents exists and the user has access to them.

How to reproduce:
# create test attachment:
echo "ATTACHMENT" > /tmp/test.txt

# open thunderbird in compose windows:
thunderbird --compose "mailto:?attach=file:///tmp/test.txt&cc=[e-mail]&bcc=&subject=My%20attachment%20test&body=This%20email%20should%20contain%20a%20attachement."

This opens up a Thunderbird compose windows, with CC, subject and body filled. However, the attachment is not added.

Comment 2

[Jorg K (CEST = GMT+2)]

That syntax isn't right, read here:
http://kb.mozillazine.org/Command_line_arguments_%28Thunderbird%29

Comment 3

[joerg.steffens]

Well, it is true, that these programs do not use the documented syntax. However, I'm wondering, that two well known programs uses this syntax independently from each other.

Also, this mailto syntax mostly works. The only thing missing is the attachment.

The user you reported this to me also claimed, that this did work in the past. A quick check with different version of Thunderbird did not succeed for me.

Surely, the proper solution would be if Acrobat Reader and LibreOffice adapt the call to the documented syntax. However, I'm afraid that this will not happen, at least not of Acrobat Reader.

So is there an option that Thunderbird add support for this (again?)?

If not, please set this ticket to invalid once more.

Comment 4

[Jorg K (CEST = GMT+2)]

Ich verstehe nur 'Bahnhof' hier :-(

The documented syntax is:

thunderbird -compose "to='[e-mail],[e-mail]',cc='[e-mail]',subject='dinner',body='How about dinner tonight?',attachment=C:\temp\info.doc"

So if you use "attachment=" it works, I tested it.

What are you saying about LibreOffice and Acrobat Reader? They execute some sort of command to compose an e-mail?? How?

Comment 5

[joerg.steffens]

How:
LibreOffice (as well as Acrobat Reader) have the option to generate email to sent the current document as attachment.

In LibreOffice you have to select:
File -> Send -> E-mail Document

If you do so (and Thunderbird is your primary email program) LibreOffice executes:

/usr/lib64/thunderbird/thunderbird-bin --compose "mailto:?subject=document&attach=file:///tmp/lu5ggnu2.tmp/lu5ggnug.tmp/document.odt"

/usr/lib64/thunderbird/thunderbird-bin is platform specific. It works the same if you just execute "thunderbird" here.

And this does not produce the expected result, as Thunderbird opens a compose windows, sets the correct subject, but have no file attached.

The syntax you describe (and is documented by Mozilla) does work.
(As a side note: works mostly:
On Linux you have to prepend "file://" before the file name (attachment=file:///tmp/test.txt). Full Unix paths without "file://" are not accepted, however full Windows are accepted, e.g. C:\temp\info.doc which of course does not make sense on Linux.)

I hope this clarifies this issue a bit. Thanks for taking the time to discuss this.

Comment 6

[Jorg K (CEST = GMT+2)]

OK, it would be a change of a few lines to support attach= together with the already existing attachment=.

Manuel, would you be interested to prepare a patch for this?

Comment 7

[Manuel Grießmayr]

Are you sure you want a patch?
We don't support attachments in mailto-URLs:
https://dxr.mozilla.org/comm-central/source/mailnews/compose/src/nsSmtpUrl.cpp#100
Try
> thunderbird -compose mailto:?attachment=test.txt
It doesn't work.

Comment 8

[Jorg K (CEST = GMT+2)]

Frankly I'm still confused by this bug.

Surely we have the command line syntax that accepts attachment= and there is no harm done also supporting attach=.

That said, that's not what the bug is about since comment #1 and comment #5 show mailto: URLs:
"mailto:?subject=document&attach=file:///tmp/lu5ggnu2.tmp/lu5ggnug.tmp/document.odt"
And according to your research, ?attachment= is explicitly disabled.

So how are
"mailto:?subject=document&attach=file:///tmp/lu5ggnu2.tmp/lu5ggnug.tmp/document.odt"
and
"subject=document,attachment=file:///tmp/lu5ggnu2.tmp/lu5ggnug.tmp/document.odt
related?

They are two different things? The mailto URL is parsed in nsMailtoUrl::ParseMailtoUrl() and the other command line options are parsed elsewhere?

Comment 9

[Manuel Grießmayr]

(In reply to Jorg K (GMT+2) from comment #8)
> They are two different things? The mailto URL is parsed in
> nsMailtoUrl::ParseMailtoUrl() and the other command line options are parsed
> elsewhere?
Yes correct, different syntax, different parsing. The comma separated values are parsed here:
https://dxr.mozilla.org/comm-central/source/mail/components/compose/content/MsgComposeCommands.js#1827

Comment 10

[Manuel Grießmayr]

@Jörg: Can you explain what the security fire hole is?

Comment 11

[Jorg K (CEST = GMT+2)]

Thanks for the investigation in comment #9.

As for your question: Phishing attack. An attacker gets you to click onto such a link and he can extract any file from your system he can guess beforehand. That would only work in socially engineered attacks where the attacker already has information about the victim's system ... and of course the victim must click "Send" without checking the attachments of the message.

It's sad that useful functions can also be abused.

As for the bug: I'll close it as WONTFIX since we won't implement ?attach= in mailto URLs. Implementing attach= in the -compose command line switch seems unnecessary since there is already attachment= and adding attach= won't address the compatibility problem with LibreOffice.

Comment 12

[joerg.steffens]

Just for completeness:

LibreOffice behaves correctly when setting
LibreOffice: Tools -> Options -> Internet -> E-mail -> E-mail program = thunderbird

(on Linux it uses https://cgit.freedesktop.org/libreoffice/core/tree/shell/source/unix/misc/senddoc.sh to sent emails)

However, if you leave this settings to the empty default or set it to xdg-open or xdg-email (the default  desktop integration utilities from freedesktop.org), it calls them using a mailto parameter. In the result, attachments do not work with thunderbird.

So at least there is a work around for LibreOffice.

Comment 13

[Jorg K (CEST = GMT+2)]

(In reply to joerg.steffens from comment #12)
> LibreOffice behaves correctly when setting
> LibreOffice: Tools -> Options -> Internet -> E-mail -> E-mail program
Thanks for the feedback. Sadly no such option in LO 5.2.2.2 on Windows.