attachments visible to all - security issue

hinkelmann.holger

I am a bit shocked, that a mail attachment of a newsletter can be opened by all who have the internet adress. We have an intern newsletter with infos not meant to be spread to the public. The attachment should be attached to the email-newsletter. It should be visible in the archive to the chosen logged in usergroup. But it should not be visible to public. Have I overseen a setting? If not could you improve security?

mihha

Did you try to create a newsletter archive menu item with access to only that specific user group which should have access to the attachments?

To be honest, I don't know how we could check if user is allowed to see something or not. AcyMailing newsletter lists are not connected to the Joomla user groups and ACL

hinkelmann.holger

Thank you for the explanation. What about giving an option in the configuration that attachments are put in an access restricted folder of Joomla, so that they are accessable for registered useres only?
AcyMailing itself has than access, sending the attachments, but outsiders could not open the attachments without being registered.

Remi_Acyba

Hi,

This is not a security on our end, if you want to grant access to document on your website you can do it via another extension, Docman for example.
We are integrated with it, so you can include documents in your newsletter, here is our documentation:
https://docs.acymailing.com/addons/joomla-add-ons/docman