When forwarding a message inline, Thunderbird strips inline-images

RESOLVED FIXED in Thunderbird2.0

Status

--
major
RESOLVED FIXED
13 years ago
9 years ago

People

(Reporter: youngabe, Assigned: mscott)

Tracking

(5 keywords)

Thunderbird2.0
x86
Windows XP
privacy, regression, verified1.7.13, verified1.8.0.2, verified1.8.1.3
Bug Flags:
blocking-aviary1.0.8 +
blocking1.8.0.1 -
blocking1.8.0.2 +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:privacy])

Attachments

(2 attachments)

(Reporter)

Description

13 years ago
User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1; .NET CLR 1.1.4322)
Build Identifier: Thunderbird 1.5 R.C. 1

When forwarding a message inline, Thunderbird strips the message of any images

Reproducible: Always

Steps to Reproduce:
Receive a message with images, forward inline.
Actual Results:  
Receive a message with images, forward inline.

Expected Results:  
It does not include the images in the message

Forwarded the message including the images.

Comment 1

13 years ago
*** Bug 315626 has been marked as a duplicate of this bug. ***

Comment 2

13 years ago
Related to/duplicate of bug 307023?

Comment 3

13 years ago
I am seeing this bug as well, and I would go so far as to suggest that this may have some element of a security issue about it that needs to be looked at, or at least commented on.

In my observed and reproduceable case the flow of emails goes like this:

1. Mail composed by a first person in HTML, has an image inserted part way through the mail.  Not ATTACHED to the end, but inline.
2. Mail is sent to a second user who uses Thunderbird, the image inline is displayed correctly and formatted as it should be.  The image is ripped out by TB, and replaced by a URL of sorts, such as this one:

mailbox:///C%7C/Documents%20and%20Settings/Owen/Application%20Data/Thunderbird/Profiles/0je2yffp.default/Mail/Local%20Folders/%7ExxxxX.sbd/000000%20NxH%20ExG?number=29380&part=1.2&filename=image001.jpg

or:

imap://reuben@tornado.reub.net:143/fetch%3EUID%3E.INBOX%3E7130?part=1.2&filename=DSCN0720.JPG

3. The second user using TB then attempts to forward or reply to the email to a third person by clicking on the forward or reply buttons only. The URLs above are forwarded WITHOUT MODIFICATION to the third person when the mail is sent.

There are a couple of problems with this.

Firstly, the mail is sent, but breaks on the receivers Thunderbird.  It is pretty visibly obvious and explained by just right clicking on the image and copying it's location, which is noted to refer to some path on the second persons system that doesn't exist on the third persons system.

Secondly, the URL that is replaced in on the forwarders system, reveals far more information about the person who forwarded the mail on, than really should.  I can tell the users windows login name, where their system profile is stored, their thunderbird profile name, and some mailbox names as well, depending on where the email was forwarded from.

As a remote user that information should _not_ be leaked out to me.  I could potentially use information like that to trick the user (remember I do know who they are and what IP address they are on, and if I know them a little I could probably socially engineer an attack) into executing something nasty, or write a trojan which could destroy personal data, given I know the right paths to it all.  While in itself I don't think it's a big deal, the information could be used for more malicious purposes.


I think this bug is rightly marked as a fairly high priority, it breaks basic functionality and there appears to be no workaround for it.

In my instance at least this is not a dupe of 307023 because I'm not seeing characters truncated.

This bug exists in both TB-1.5-RC/branch as well as the trunk as of today.
Kind of the opposite of bug 263345 (including *remote* images when we didn't want to).
Summary: When forwarding a message inline, Thunderbird strips the message of any images → When forwarding a message inline, Thunderbird strips inline-images

Comment 5

13 years ago
I can confirm that this bug still exists in the 1.5rc's for MacOS and in the current trunk builds. To further stress the importance of correcting this issue, I have discovered that some email clients that receive emails from Thunderbird, where the image has been stripped out, crash whenever trying to open the email. Microsoft Entourage is one of those.

This does seem to be a very critical bug, that needs immediate attention.I wonder why the bug is still unconfirmed after a month.

Comment 6

13 years ago
Here's what I found: this bug is due to the html attribute <img> moz-do-not-send which is set to true by default when forwarding an e-mail with inline graphic file. 

When forwarding a html message with inline image, it is possible (double-click on the image) to change Image Properties. If you change in Advance Edit the attribute "moz-do-not-send" to "false" or you remove this attribute - a message is properly forwarded with the image inside (results are immediately visible in the Sent box).

Since there's no problems when replying to the same e-mail (the attribute is not on the list), I hope that somone can prepare a patch before 1.5RC3...
(Reporter)

Comment 7

13 years ago
Yes, please provide some sort of option in the next releases of Thunderbird.

Comment 8

13 years ago
Please also vote for this bug so that it changes status to be CONFIRMED - and the more votes it gets the more likely something will be done about it :)
(Reporter)

Comment 9

13 years ago
Yes we need to confirm this bug,\.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: blocking1.8.0.1?
Keywords: privacy

Comment 10

13 years ago
Changing moz-do-not-send to false is fine if you are forwarding an email with one image. However, this can be a real time consuming effort if you are forwarding an email with multiple images, as each image would have to be dealt with separately. Either this needs to be a global option that can be set to false in about:config, or there needs to be some other way to apply this option to all images in a given email with one step.
Without a tested trunk fix this isn't blocking 1.8.0.1
Flags: blocking1.8.0.1? → blocking1.8.0.1-
Whiteboard: [sg:privacy]

Comment 12

13 years ago
Hm.  Bug 305557 was supposed to have fixed the issue of -moz-do-not-send 
being applied to attached images.  Adding the moz-do-not-send attribute was 
due to a potential security hole, but that hole does not apply to images or other data that was already attached to a message, so this is a problem.

Also see bug 224733 -- the actual image URL sent is not only privacy-invading, it's broken.
Keywords: regression
Version: unspecified → 1.5

Comment 13

13 years ago
*** Bug 324267 has been marked as a duplicate of this bug. ***
(Assignee)

Comment 14

13 years ago
that sucks that this regressed.
Status: NEW → ASSIGNED
Depends on: 305557
Target Milestone: --- → Thunderbird2.0
(Assignee)

Comment 15

13 years ago
Created attachment 209390 [details] [diff] [review]
the fix

In our TagEmbeddedObjects method, mQuoteURI had no value in the case of a forwarded attachment. As a result, our uri comparison routine always failed, causing all the embedded parts to get tagged as do not send.

I remove mQuoteURI altogether and just used mOriginalMsgURI which has the same value that we were assigning mQuoteURI with for the cases when it did have a value (i.e. replies).

I'm still at a loss to explain why this broke though, I don't see any code changes that messed around with mQuoteURI over the regression window. And that worries me.
Attachment #209390 - Flags: superreview?(bienvenu)

Comment 16

13 years ago
Comment on attachment 209390 [details] [diff] [review]
the fix

not sure what changed, but I probably changed some stuff for doing reply to .eml files, and I think other folks have made changes as well.
Attachment #209390 - Flags: superreview?(bienvenu) → superreview+
(Assignee)

Comment 17

13 years ago
fixed on 1.8 and the trunk.

I'll approve for 1.5.0.x when that branch opens for changes.
Status: ASSIGNED → RESOLVED
Last Resolved: 13 years ago
Keywords: fixed1.8.1
Resolution: --- → FIXED
(Assignee)

Updated

13 years ago
Attachment #209390 - Flags: approval1.8.0.2?

Comment 18

13 years ago
Sure is. Thanks Scott.
Tod
(Assignee)

Comment 19

13 years ago
Please help test in tomorrow's trunk or 1.8 based builds Tod. Thanks. 

Comment 20

13 years ago
Not fixed on my 'puter. I don't know how to access the truncked or 1.8 versions. I was wrong yesterday. I tested an attachment in error.
Tod 

Comment 21

13 years ago
V with TB 1.5-0126 (tinderbox build).  Thanks, Scott!
Status: RESOLVED → VERIFIED

Comment 22

13 years ago
I have found that this bug can be worked around by selecting Cntrl+E to edit as a new message before sending. I consider this a major bug, but I don't see any updates for ver 1.5 and refuse to try beta software. When will an official release be made to address this issue ? Also, reading below, I see a brief statement about  an URL: there will not be an URL to the images if the images were pasted into the email from an image editing program via the clipboard. ALSO, it is my observation that while the email IS sent, the images ARE not sent contrary to the comments below. When the images are sent, the status dialog gives a status of the send command ( 25%, 50% etc during the upload of the email to the SMTP server) however when the forward send command is hit, you can clearly see that it just states that the message was sent, no uploading of images ever takes place to the SMTP server. 
(Assignee)

Comment 23

13 years ago
Comment on attachment 209390 [details] [diff] [review]
the fix

now that seamonkey is done with the branch we can take mailnews changes for thunderbird 1.8.0.2.
Attachment #209390 - Flags: approval1.8.0.2? → approval1.8.0.2+
(Assignee)

Updated

13 years ago
Keywords: fixed1.8.0.2
*** Bug 326800 has been marked as a duplicate of this bug. ***
This is a regression from 305557; since that landed on the aviary branch do we need this fix there as well?
Flags: blocking-aviary1.0.8?
(Assignee)

Comment 26

13 years ago
This regression has now mad its way into 1.0.8. I've just confirmed that. 

We'll need this patch in 1.7.13 and 1.0.8.
(Assignee)

Updated

13 years ago
Attachment #209390 - Flags: approval-aviary1.0.8?
(Assignee)

Comment 27

13 years ago
Created attachment 213068 [details] [diff] [review]
patch for the 1.0.8 branch

I had to tweak somethings to make this patch apply on the 1.0.8 branch. Encapsulating those changes here.
Attachment #213068 - Flags: superreview?(bienvenu)
Attachment #213068 - Flags: approval-aviary1.0.8?
(Assignee)

Updated

13 years ago
Attachment #209390 - Flags: approval-aviary1.0.8?

Updated

13 years ago
Attachment #213068 - Flags: superreview?(bienvenu) → superreview+
Comment on attachment 213068 [details] [diff] [review]
patch for the 1.0.8 branch

approved for aviary101/moz17 branches, a=dveditz for drivers
Attachment #213068 - Flags: approval-aviary1.0.8? → approval-aviary1.0.8+
Flags: blocking1.8.0.2+
Flags: blocking-aviary1.0.8?
Flags: blocking-aviary1.0.8+
(Assignee)

Comment 29

13 years ago
fixed for aviary 1.0.8 and 1.7.13
Keywords: fixed-aviary1.0.8, fixed1.7.13
looks good using Mozilla 1.7.13 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060302. When I follow the STR, I do see the images when I forward the message inline. Adding keyword.
Keywords: fixed1.7.13 → verified1.7.13
(Assignee)

Comment 31

13 years ago
Marcia, just to be sure that this is working, in addition to seeing the images in the msg, do a view source and examine the message source to make sure you see the image binaries included in source and not an imap url that refers to the image on a server.

Comment 32

13 years ago
*** Bug 329551 has been marked as a duplicate of this bug. ***

Comment 33

13 years ago
*** Bug 330110 has been marked as a duplicate of this bug. ***
(Reporter)

Comment 34

13 years ago
I STILL SAY THIS IS NOT COMPLETELY FIXED! Let me give an example. Let's say someone sends me an E-mail with an image…keep in mind I am the first and only recipient of this message. I forward the message inline to a friend...it works just FINE. Next example...let's say a message is forwarded to me however numerous other recipients have had this message and their E-Mail client forwards messages as attachments. When I receive this message, I open the message down to the actual text/image(s) eliminating all of the nonsense attachments. I want to then forward the message on from THAT PARTICULAR POINT. I do not want to forward the message with all of the nonsense attachments, I just want to forward right from the actual text/image(s) of the message, Thunderbird strips the images if they're are any. Thunderbird only strips images if you are forwarding INLINE from a particular point in a message. If I were to send the above message example as an ATTACHMENT, the image(s) and text would be included just fine. The INLINE feature still does not work properly in my book!
Status: VERIFIED → REOPENED
Resolution: FIXED → ---

Comment 35

13 years ago
(In reply to comment #34)
> I STILL SAY THIS IS NOT COMPLETELY FIXED!

You are wrong.  Do not reopen this bug.


> Let me give an example. [...] let's say a message is forwarded to me however
> numerous other recipients have had this message and their E-Mail client
> forwards messages as attachments. When I receive this message, I open the
> message down to the actual text/image(s) eliminating all of the nonsense
> attachments. I want to then forward the message on from THAT PARTICULAR POINT.
> I do not want to forward the message with all of the nonsense attachments, I
> just want to forward right from the actual text/image(s) of the message,
> Thunderbird strips the images if they're are any. Thunderbird only strips
> images if you are forwarding INLINE from a particular point in a message. If I
> were to send the above message example as an ATTACHMENT, the image(s) and text
> would be included just fine. The INLINE feature still does not work properly
> in my book!

This may be the issue seen at bug 301347.
Status: REOPENED → RESOLVED
Last Resolved: 13 years ago13 years ago
Resolution: --- → FIXED

Comment 36

13 years ago
I am a novice. When I click on 'the fix' link, I don't understand anything that is written on the next page. Is there anyone that can help me with this or do I need to wait until the next TB version comes out...whenever that will be?
(Reporter)

Comment 37

13 years ago
Well, if I am wrong, please provide evidence to prove me wrong.  The example I have provided does NOT work correctly.  This is preventing me from permanently switching to Thunderbird as my E-Mail client.  

Comment 38

13 years ago
(In reply to comment #36)

howdy bonniejean,

you will hafta wait for the release. the "fix" is program code and not run-able unless you compile it into tbird. if are VERY brave & want to test it, then use one of the pre-release testing builds from here ...
- Thunderbird Builds
http://forums.mozillazine.org/viewforum.php?f=29

the newest "daily build" thread will have link to the "newest daily build". [*grin*] 

please remember that the builds - both branch and trunk are PRE-RELEASE and therefor not for real life use by normal folks.

take care,
lee

Comment 39

13 years ago
(In reply to comment #37)
> Well, if I am wrong, please provide evidence to prove me wrong.  The example I
> have provided does NOT work correctly.

The evidence that you are wrong is: builds with the fix do not exhibit the detailed symptoms described in comment 3.  

Now, it is possible that the symptom you're incoherently complaining about in comment 34 is the same issue that you meant to report when you opened this bug; nobody could tell, because comment 0 contains insufficient information.  But someone else noticed a new bug that occurred with 1.5 that matched up with your original report and, in comment 3, provided detailed information; that became what this bug is about.


> This is preventing me from permanently
> switching to Thunderbird as my E-Mail client.  

I see that you posted a comment in bug 301347 in which you seem to agree that the problem described there is the problem you're talking about now.  If you read that bug, you'll see that the issue is *not* that you can't send the 
nested attachments, but only that those attachments aren't displayed within the compose window.  Personally, I don't understand why such an issue would be an impediment to using the program.

Comment 40

13 years ago
(In reply to comment #36)
> do I need to wait until the next TB version comes out

1.5.0.2 will have this fix and a few others, but none of the new features in development on the branches.  The latest pre-release for this version is at:

http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-aviary1.0.1/

Comment 41

13 years ago
(In reply to comment #39)
> I see that you posted a comment in bug 301347 in which you seem to agree that
> the problem described there is the problem you're talking about now.  

Hm.  On closer inspection, your comment there seems to be complaining about *this* bug's actual symptom.
(Assignee)

Comment 42

13 years ago
(In reply to comment #40)
> (In reply to comment #36)
> > do I need to wait until the next TB version comes out
> 
> 1.5.0.2 will have this fix and a few others, but none of the new features in
> development on the branches.  The latest pre-release for this version is at:
> 
> http://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-aviary1.0.1/
> 

Actually 1.5.0.2 is located at:

ftp://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-mozilla1.8.0

:)
(Reporter)

Comment 43

13 years ago
Okay let's clean this up a bit...it seems to be getting to the point that no one has any idea who said what.

My comment was as follows...
"I STILL SAY THIS IS NOT COMPLETELY FIXED! Let me give an example. Let's say
someone sends me an E-mail with an image…keep in mind I am the first and only
recipient of this message. I forward the message inline to a friend...it works
just FINE. Next example...let's say a message is forwarded to me however
numerous other recipients have had this message and their E-Mail client
forwards messages as attachments. When I receive this message, I open the
message down to the actual text/image(s) eliminating all of the nonsense
attachments. I want to then forward the message on from THAT PARTICULAR POINT.
I do not want to forward the message with all of the nonsense attachments, I
just want to forward right from the actual text/image(s) of the message,
Thunderbird strips the images if they're are any. Thunderbird only strips
images if you are forwarding INLINE from a particular point in a message. If I
were to send the above message example as an ATTACHMENT, the image(s) and text
would be included just fine. The INLINE feature still does not work properly in
my book!"

Do people understand EXACTLY the point I was making above?  I just downloaded "version 1.5.0.2 (20060313)" and what I am talking about still does not work.  If a person receives an E-Mail with a message attachment, open the attachment and then click "Message", "Forward As", and then "Inline" any images in the message are not included.  If a person receives a message with NO attachments and just images embedded into the message, forwarding inline works correctly.  Can everyone see the difference in the two examples I provided?

Also, the reason this prevents me from switching to Thunderbird permanently is because many people out there still use Outlook Express.  Any time I receive an E-Mail with useless attachments, I like to clean the message up before I forward it.  If images are included, this is not possible.

Comment 44

13 years ago
"S", I think perhaps the problem you're talking about now is bug 320571; there is a partial fix for it in the 2.0alpha branch, but it won't be part of 1.5.0.x.

 ftp://ftp.mozilla.org/pub/mozilla.org/thunderbird/nightly/latest-mozilla1.8.1
Verified fixed on the 1.8.0 branch using version 1.5.0.2 (20060308). Image binaries are included in source. I tested using the steps in Comment 3 and did not see any issues when forwarding inline. Adding term to SW.
Reminder to Marcia - go back and verify this on 1.7.13. 


Whiteboard: [sg:privacy] → [sg:privacy][qa:verified-tb-1802]

Comment 46

13 years ago
*** Bug 332062 has been marked as a duplicate of this bug. ***
verified with Windows Thunderbird - version 1.0.8 (20060317)
Keywords: fixed-aviary1.0.8 → verified-aviary1.0.8

Comment 48

13 years ago
*** Bug 333685 has been marked as a duplicate of this bug. ***

Comment 49

12 years ago
verified fixed thunderbird 2.0.0.0 rc2 winxp.
Keywords: fixed1.8.0.2, fixed1.8.1 → verified1.8.0.2, verified1.8.1
Whiteboard: [sg:privacy][qa:verified-tb-1802] → [sg:privacy]

Updated

12 years ago
Keywords: verified1.8.1 → verified1.8.1.3

Comment 50

9 years ago
This is not fixed.

Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.7) Gecko/20100111 Lightning/1.0b2pre Thunderbird/3.0.1

Also still present in 2.0.0.23 (and previous versions).

When an e-mail is received with an inline attachment to where the image is displayed within the e-mail, hitting REPLY will cause the reply message to not display the image and give the error...

"Sending of message failed.  There was an error attaching .[sic]  Please check if you have access to the file."

Using FORWARD instead of REPLY displays the inline image properly and allows the e-mail to be sent.

This need to be fixed both in 2.0 and 3.0.

Also there is a grammar error in the error message quoted above.  There is an extra space before the period of the second sentence.
You need to log in before you can comment on or make changes to this bug.