mirror of
https://github.com/bulwarkmail/webmail.git
synced 2026-10-31 00:12:39 +00:00
Roman Varlakov
94c7a454cc
upfiles.get is a read, but sat behind the email:blob-write permission and the privileged tier, which requires crypto:full plus a signed managed bundle. That put a simple attachment-offload plugin in the same trust bucket as crypto plugins that read stored message bytes. The method only returns a file the user just attached in this session, looked up by the unguessable UUID the composer itself passes to the onBeforeBlobUpload hook. It cannot reach server-side message blobs; those stay behind jmap.fetchBlob on the privileged tier. So gate it behind email:blob-read (consent copy already covers attachment bytes) and drop the tier requirement. Note: the privileged set also lists 'upfiles.set', but the dispatched method is named 'upfiles.save', so that entry never matched; left as-is here, flagged in the PR.