-
-
Notifications
You must be signed in to change notification settings - Fork 10
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support for encrypted file attachments to outgoing email messages #4
Comments
PHPMailer should be sufficient for this or the core functions of WordPress. But for mail attachments PHPMailer is strongly recommended. Also see http:https://stackoverflow.com/questions/12301358/send-attachments-with-php-mail Implementing this with I have an example code (which uses php-gpg but will possibly migrate it to openpgp-php in the future) there: https://github.com/DanielRuf/honeypot-scripts/blob/7a8b0daf5d57f27ab9ab164e6672af490d07b472/upload_mail.php#L30-L41 Theoretically just one line to add a file attachment to a mail. Generally this works with both libraries, the old one and the new one, you just have to encrypt the file as string and use the appropriate PHPMailer function. |
WordPress uses PHPMailer under the hood since version 2.2, so perhaps there is already an API available for this. If so, and if it is indeed a simple matter of attaching an encrypted string to an outgoing email, this should not be too hard. The harder part would be figuring out how to provide a consistent public UX for end users and developers to make use of the encryption feature, but that is a problem I actually know enough to solve. I will have a closer look this weekend at your example code, PHPMailer, and how WordPress uses it to see if integration is feasible. Thank you for the suggestions! |
UX is definitely a challenge which should be solved. When the UX is good, more people will use it. Fid not take a look at the exact API methods of WordPress for sending mails with attachments but theoretically this should be very simple. I will take a look at these specific API methods later. |
Oops, did not mean to close this from the commit. My bad. |
Sorry, forgot that. Seems to be quite easy. You just have to filter it and process the 5th parameter ((array)attachments) with the encryption function.
https://developer.wordpress.org/reference/functions/wp_mail/ So you just have to iterate over the
The attachments argument contains the path to the file, so you can read the file to a string, encrypt it and use this with http:https://wp-a2z.com/oik_api/phpmaileraddstringattachment/
https://core.trac.wordpress.org/browser/tags/4.4.2/src/wp-includes/pluggable.php#L235
|
If I understand the WordPress support forum post you linked to correctly, it suggests modifying WordPress core functions? This is not acceptable for a plugin to do. Also, the Unfortunately, a filter hook isn't enough here if we need to call There is also a WordPress Core issue citing this precise scenario as a limitation, see ticket:29513 on the WP core Trac:
So it looks like this will be easy once WordPress core is updated to allow |
Sorry, forget the link, I pasted the wrong link here. You should use the filter_hook, but I am not sure how to replace this. Seems you would have to copy This would be the manual way (recreate the functionality using a PHPMailer instance with the same arguments) but possibly not directly possible and the right way. The WordPress API should be preferred.
Right, I agree. This seems to be a bit more tricky. This https://core.trac.wordpress.org/ticket/29513 would probably ease this. Here is an example without modifying core files: Did not try this but looks more promising but like already mentioned is more like a hack than a real solution as it does not use the WordPress API directly and uses the PHPMailer class directly. Anyhow, I thought these may be useful maybe but I would also vote for the trac ticket as this is definitely useful. |
That example is clever, I will try playing with that some to see if it works well for me. Good find, and again, thank you. |
Hm, what if we create a temporary file with the encrypted attachment using file_get_contents and the openpgp-php functions, using this instead of the original one and unlinking this temporary file afterwards? Would be one possible and working workaround. |
For example tmpfile(), php:https://memory and php:https://temp |
@DanielRuf I don't think we'll need to use temporary files because when
So that means we can handle the To send PGP-encrypted messages with attachments, my understanding is that we have to use PGP/MIME, defined in RFC 3156, but PHPMailer does not support this. There is a subclass in @ravisorg's PHPMailer fork here that does (seem to) implement PGP/MIME but it uses the PHP GnuPG extension instead of @singpolyma's OpenPGP-PHP for its PGP functionality. This means we'll need to either further subclass @ravisorg's implementation or contribute a patch upstream to make it optionally use OpenPGP-PHP in addition to the In the mean time, I will ask @stefannagy back on the WordPress forums to help test the So that's where we are with this for now. Thanks again for finding that neat WordPress trick. |
This will require implementing RFC 3156.
See also singpolyma/openpgp-php#21.
/via https://wordpress.org/support/topic/encrypt-e-mail-attachments?replies=1
The text was updated successfully, but these errors were encountered: