315625 - When forwarding a message inline, Thunderbird strips inline-images

Status: RESOLVED FIXED

(Thunderbird :: General, defect)

Description

[S]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1; .NET CLR 1.1.4322)
Build Identifier: Thunderbird 1.5 R.C. 1

When forwarding a message inline, Thunderbird strips the message of any images

Reproducible: Always

Steps to Reproduce:
Receive a message with images, forward inline.
Actual Results:  
Receive a message with images, forward inline.

Expected Results:  
It does not include the images in the message

Forwarded the message including the images.

Comment 1

[Adam Becevello]

*** Bug 315626 has been marked as a duplicate of this bug. ***

Comment 2

[zug_treno]

Related to/duplicate of bug 307023?

Comment 3

[Reuben Farrelly]

I am seeing this bug as well, and I would go so far as to suggest that this may have some element of a security issue about it that needs to be looked at, or at least commented on.

In my observed and reproduceable case the flow of emails goes like this:

1. Mail composed by a first person in HTML, has an image inserted part way through the mail.  Not ATTACHED to the end, but inline.
2. Mail is sent to a second user who uses Thunderbird, the image inline is displayed correctly and formatted as it should be.  The image is ripped out by TB, and replaced by a URL of sorts, such as this one:

mailbox:///C%7C/Documents%20and%20Settings/Owen/Application%20Data/Thunderbird/Profiles/0je2yffp.default/Mail/Local%20Folders/%7ExxxxX.sbd/000000%20NxH%20ExG?number=29380&part=1.2&filename=image001.jpg

or:

imap://[e-mail]:143/fetch%3EUID%3E.INBOX%3E7130?part=1.2&filename=DSCN0720.JPG

3. The second user using TB then attempts to forward or reply to the email to a third person by clicking on the forward or reply buttons only. The URLs above are forwarded WITHOUT MODIFICATION to the third person when the mail is sent.

There are a couple of problems with this.

Firstly, the mail is sent, but breaks on the receivers Thunderbird.  It is pretty visibly obvious and explained by just right clicking on the image and copying it's location, which is noted to refer to some path on the second persons system that doesn't exist on the third persons system.

Secondly, the URL that is replaced in on the forwarders system, reveals far more information about the person who forwarded the mail on, than really should.  I can tell the users windows login name, where their system profile is stored, their thunderbird profile name, and some mailbox names as well, depending on where the email was forwarded from.

As a remote user that information should _not_ be leaked out to me.  I could potentially use information like that to trick the user (remember I do know who they are and what IP address they are on, and if I know them a little I could probably socially engineer an attack) into executing something nasty, or write a trojan which could destroy personal data, given I know the right paths to it all.  While in itself I don't think it's a big deal, the information could be used for more malicious purposes.


I think this bug is rightly marked as a fairly high priority, it breaks basic functionality and there appears to be no workaround for it.

In my instance at least this is not a dupe of 307023 because I'm not seeing characters truncated.

This bug exists in both TB-1.5-RC/branch as well as the trunk as of today.

Comment 4

[Daniel Veditz [:dveditz]]

Kind of the opposite of bug 263345 (including *remote* images when we didn't want to).

Comment 5

[Jim Strickland]

I can confirm that this bug still exists in the 1.5rc's for MacOS and in the current trunk builds. To further stress the importance of correcting this issue, I have discovered that some email clients that receive emails from Thunderbird, where the image has been stripped out, crash whenever trying to open the email. Microsoft Entourage is one of those.

This does seem to be a very critical bug, that needs immediate attention.I wonder why the bug is still unconfirmed after a month.

Comment 6

[Wojtek Kazimierczak]

Here's what I found: this bug is due to the html attribute <img> moz-do-not-send which is set to true by default when forwarding an e-mail with inline graphic file. 

When forwarding a html message with inline image, it is possible (double-click on the image) to change Image Properties. If you change in Advance Edit the attribute "moz-do-not-send" to "false" or you remove this attribute - a message is properly forwarded with the image inside (results are immediately visible in the Sent box).

Since there's no problems when replying to the same e-mail (the attribute is not on the list), I hope that somone can prepare a patch before 1.5RC3...

Comment 7

[S]

Yes, please provide some sort of option in the next releases of Thunderbird.

Comment 8

[Reuben Farrelly]

Please also vote for this bug so that it changes status to be CONFIRMED - and the more votes it gets the more likely something will be done about it :)

Comment 9

[S]

Yes we need to confirm this bug,\.

Comment 10

[Jim Strickland]

Changing moz-do-not-send to false is fine if you are forwarding an email with one image. However, this can be a real time consuming effort if you are forwarding an email with multiple images, as each image would have to be dealt with separately. Either this needs to be a global option that can be set to false in about:config, or there needs to be some other way to apply this option to all images in a given email with one step.

Comment 11

[Daniel Veditz [:dveditz]]

Without a tested trunk fix this isn't blocking 1.8.0.1

Comment 12

[Mike Cowperthwaite]

Hm.  Bug 305557 was supposed to have fixed the issue of -moz-do-not-send 
being applied to attached images.  Adding the moz-do-not-send attribute was 
due to a potential security hole, but that hole does not apply to images or other data that was already attached to a message, so this is a problem.

Also see bug 224733 -- the actual image URL sent is not only privacy-invading, it's broken.

Comment 13

[Mike Cowperthwaite]

*** Bug 324267 has been marked as a duplicate of this bug. ***

Comment 14

[Scott MacGregor]

that sucks that this regressed.

Comment 15

[Scott MacGregor]

Attachment: the fix

In our TagEmbeddedObjects method, mQuoteURI had no value in the case of a forwarded attachment. As a result, our uri comparison routine always failed, causing all the embedded parts to get tagged as do not send.

I remove mQuoteURI altogether and just used mOriginalMsgURI which has the same value that we were assigning mQuoteURI with for the cases when it did have a value (i.e. replies).

I'm still at a loss to explain why this broke though, I don't see any code changes that messed around with mQuoteURI over the regression window. And that worries me.

Comment 16

[David :Bienvenu]

Comment on attachment 209390 [details] [diff] [review]
the fix

not sure what changed, but I probably changed some stuff for doing reply to .eml files, and I think other folks have made changes as well.

Comment 17

[Scott MacGregor]

fixed on 1.8 and the trunk.

I'll approve for 1.5.0.x when that branch opens for changes.

Comment 18

[Tod]

Sure is. Thanks Scott.
Tod

Comment 19

[Scott MacGregor]

Please help test in tomorrow's trunk or 1.8 based builds Tod. Thanks. 

Comment 20

[Tod]

Not fixed on my 'puter. I don't know how to access the truncked or 1.8 versions. I was wrong yesterday. I tested an attachment in error.
Tod 

Comment 21

[Mike Cowperthwaite]

V with TB 1.5-0126 (tinderbox build).  Thanks, Scott!

Comment 22

[Gene Caldwell]

I have found that this bug can be worked around by selecting Cntrl+E to edit as a new message before sending. I consider this a major bug, but I don't see any updates for ver 1.5 and refuse to try beta software. When will an official release be made to address this issue ? Also, reading below, I see a brief statement about  an URL: there will not be an URL to the images if the images were pasted into the email from an image editing program via the clipboard. ALSO, it is my observation that while the email IS sent, the images ARE not sent contrary to the comments below. When the images are sent, the status dialog gives a status of the send command ( 25%, 50% etc during the upload of the email to the SMTP server) however when the forward send command is hit, you can clearly see that it just states that the message was sent, no uploading of images ever takes place to the SMTP server. 

Comment 23

[Scott MacGregor]

Comment on attachment 209390 [details] [diff] [review]
the fix

now that seamonkey is done with the branch we can take mailnews changes for thunderbird 1.8.0.2.

Comment 24

[Bill Gianopoulos [:WG9s]]

*** Bug 326800 has been marked as a duplicate of this bug. ***

Comment 25

[Daniel Veditz [:dveditz]]

This is a regression from 305557; since that landed on the aviary branch do we need this fix there as well?

Comment 26

[Scott MacGregor]

This regression has now mad its way into 1.0.8. I've just confirmed that. 

We'll need this patch in 1.7.13 and 1.0.8.

Comment 27

[Scott MacGregor]

Attachment: patch for the 1.0.8 branch

I had to tweak somethings to make this patch apply on the 1.0.8 branch. Encapsulating those changes here.

Comment 28

[Daniel Veditz [:dveditz]]

Comment on attachment 213068 [details] [diff] [review]
patch for the 1.0.8 branch

approved for aviary101/moz17 branches, a=dveditz for drivers

Comment 29

[Scott MacGregor]

fixed for aviary 1.0.8 and 1.7.13

Comment 30

[Marcia Knous [:marcia]]

looks good using Mozilla 1.7.13 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060302. When I follow the STR, I do see the images when I forward the message inline. Adding keyword.

Comment 31

[Scott MacGregor]

Marcia, just to be sure that this is working, in addition to seeing the images in the msg, do a view source and examine the message source to make sure you see the image binaries included in source and not an imap url that refers to the image on a server.

Comment 32

[Mike Cowperthwaite]

*** Bug 329551 has been marked as a duplicate of this bug. ***

Comment 33

[zug_treno]

*** Bug 330110 has been marked as a duplicate of this bug. ***

Comment 34

[S]

I STILL SAY THIS IS NOT COMPLETELY FIXED! Let me give an example. Let's say someone sends me an E-mail with an image…keep in mind I am the first and only recipient of this message. I forward the message inline to a friend...it works just FINE. Next example...let's say a message is forwarded to me however numerous other recipients have had this message and their E-Mail client forwards messages as attachments. When I receive this message, I open the message down to the actual text/image(s) eliminating all of the nonsense attachments. I want to then forward the message on from THAT PARTICULAR POINT. I do not want to forward the message with all of the nonsense attachments, I just want to forward right from the actual text/image(s) of the message, Thunderbird strips the images if they're are any. Thunderbird only strips images if you are forwarding INLINE from a particular point in a message. If I were to send the above message example as an ATTACHMENT, the image(s) and text would be included just fine. The INLINE feature still does not work properly in my book!

Comment 35

[Mike Cowperthwaite]

(In reply to comment #34)
> I STILL SAY THIS IS NOT COMPLETELY FIXED!

You are wrong.  Do not reopen this bug.


> Let me give an example. [...] let's say a message is forwarded to me however
> numerous other recipients have had this message and their E-Mail client
> forwards messages as attachments. When I receive this message, I open the
> message down to the actual text/image(s) eliminating all of the nonsense
> attachments. I want to then forward the message on from THAT PARTICULAR POINT.
> I do not want to forward the message with all of the nonsense attachments, I
> just want to forward right from the actual text/image(s) of the message,
> Thunderbird strips the images if they're are any. Thunderbird only strips
> images if you are forwarding INLINE from a particular point in a message. If I
> were to send the above message example as an ATTACHMENT, the image(s) and text
> would be included just fine. The INLINE feature still does not work properly
> in my book!

This may be the issue seen at bug 301347.

Comment 36

[bonniejean]

I am a novice. When I click on 'the fix' link, I don't understand anything that is written on the next page. Is there anyone that can help me with this or do I need to wait until the next TB version comes out...whenever that will be?

Comment 37

[S]

Well, if I am wrong, please provide evidence to prove me wrong.  The example I have provided does NOT work correctly.  This is preventing me from permanently switching to Thunderbird as my E-Mail client.  

Comment 38

[Lee_Dailey]

(In reply to comment #36)

howdy bonniejean,

you will hafta wait for the release. the "fix" is program code and not run-able unless you compile it into tbird. if are VERY brave & want to test it, then use one of the pre-release testing builds from here ...
- Thunderbird Builds
http://forums.mozillazine.org/viewforum.php?f=29

the newest "daily build" thread will have link to the "newest daily build". [*grin*] 

please remember that the builds - both branch and trunk are PRE-RELEASE and therefor not for real life use by normal folks.

take care,
lee

Comment 39

[Mike Cowperthwaite]

(In reply to comment #37)
> Well, if I am wrong, please provide evidence to prove me wrong.  The example I
> have provided does NOT work correctly.

The evidence that you are wrong is: builds with the fix do not exhibit the detailed symptoms described in comment 3.  

Now, it is possible that the symptom you're incoherently complaining about in comment 34 is the same issue that you meant to report when you opened this bug; nobody could tell, because comment 0 contains insufficient information.  But someone else noticed a new bug that occurred with 1.5 that matched up with your original report and, in comment 3, provided detailed information; that became what this bug is about.


> This is preventing me from permanently
> switching to Thunderbird as my E-Mail client.  

I see that you posted a comment in bug 301347 in which you seem to agree that the problem described there is the problem you're talking about now.  If you read that bug, you'll see that the issue is *not* that you can't send the 
nested attachments, but only that those attachments aren't displayed within the compose window.  Personally, I don't understand why such an issue would be an impediment to using the program.

Comment 40

[Mike Cowperthwaite]

(In reply to comment #36)
> do I need to wait until the next TB version comes out

1.5.0.2 will have this fix and a few others, but none of the new features in development on the branches.  The latest pre-release for this version is at:

http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-aviary1.0.1/

Comment 41

[Mike Cowperthwaite]

(In reply to comment #39)
> I see that you posted a comment in bug 301347 in which you seem to agree that
> the problem described there is the problem you're talking about now.  

Hm.  On closer inspection, your comment there seems to be complaining about *this* bug's actual symptom.

Comment 42

[Scott MacGregor]

(In reply to comment #40)
> (In reply to comment #36)
> > do I need to wait until the next TB version comes out
> 
> 1.5.0.2 will have this fix and a few others, but none of the new features in
> development on the branches.  The latest pre-release for this version is at:
> 
> http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-aviary1.0.1/
> 

Actually 1.5.0.2 is located at:

ftp://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-mozilla1.8.0

:)

Comment 43

[S]

Okay let's clean this up a bit...it seems to be getting to the point that no one has any idea who said what.

My comment was as follows...
"I STILL SAY THIS IS NOT COMPLETELY FIXED! Let me give an example. Let's say
someone sends me an E-mail with an image…keep in mind I am the first and only
recipient of this message. I forward the message inline to a friend...it works
just FINE. Next example...let's say a message is forwarded to me however
numerous other recipients have had this message and their E-Mail client
forwards messages as attachments. When I receive this message, I open the
message down to the actual text/image(s) eliminating all of the nonsense
attachments. I want to then forward the message on from THAT PARTICULAR POINT.
I do not want to forward the message with all of the nonsense attachments, I
just want to forward right from the actual text/image(s) of the message,
Thunderbird strips the images if they're are any. Thunderbird only strips
images if you are forwarding INLINE from a particular point in a message. If I
were to send the above message example as an ATTACHMENT, the image(s) and text
would be included just fine. The INLINE feature still does not work properly in
my book!"

Do people understand EXACTLY the point I was making above?  I just downloaded "version 1.5.0.2 (20060313)" and what I am talking about still does not work.  If a person receives an E-Mail with a message attachment, open the attachment and then click "Message", "Forward As", and then "Inline" any images in the message are not included.  If a person receives a message with NO attachments and just images embedded into the message, forwarding inline works correctly.  Can everyone see the difference in the two examples I provided?

Also, the reason this prevents me from switching to Thunderbird permanently is because many people out there still use Outlook Express.  Any time I receive an E-Mail with useless attachments, I like to clean the message up before I forward it.  If images are included, this is not possible.

Comment 44

[Mike Cowperthwaite]

"S", I think perhaps the problem you're talking about now is bug 320571; there is a partial fix for it in the 2.0alpha branch, but it won't be part of 1.5.0.x.

 ftp://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-mozilla1.8.1

Comment 45

[Marcia Knous [:marcia]]

Verified fixed on the 1.8.0 branch using version 1.5.0.2 (20060308). Image binaries are included in source. I tested using the steps in Comment 3 and did not see any issues when forwarding inline. Adding term to SW.
Reminder to Marcia - go back and verify this on 1.7.13. 

Comment 46

[zug_treno]

*** Bug 332062 has been marked as a duplicate of this bug. ***

Comment 47

[Tracy Walker [:tracy]]

verified with Windows Thunderbird - version 1.0.8 (20060317)

Comment 48

[Ray Booysen]

*** Bug 333685 has been marked as a duplicate of this bug. ***

Comment 49

[Bob Clary [:bc] (inactive)]

verified fixed thunderbird 2.0.0.0 rc2 winxp.

Comment 50

[Buford T. Justice]

This is not fixed.

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.7) Gecko/20100111 Lightning/1.0b2pre Thunderbird/3.0.1

Also still present in 2.0.0.23 (and previous versions).

When an e-mail is received with an inline attachment to where the image is displayed within the e-mail, hitting REPLY will cause the reply message to not display the image and give the error...

"Sending of message failed.  There was an error attaching .[sic]  Please check if you have access to the file."

Using FORWARD instead of REPLY displays the inline image properly and allows the e-mail to be sent.

This need to be fixed both in 2.0 and 3.0.

Also there is a grammar error in the error message quoted above.  There is an extra space before the period of the second sentence.