[balsa] Do not attach files in response to a click

[Peter Bloomfield <peterb src gnome org>]

commit 2c6f21fa31223452d99ac54e5da1d12ccf08faa3
Author: Peter Bloomfield <PeterBloomfield bellsouth net>
Date:   Sun Mar 3 11:54:02 2019 -0500

    Do not attach files in response to a click
    
    Do not attach files in response to clicking a "mailto:"; URL, only if
    the URL is passed to Balsa on the command line by "-m" or "--compose".
    
    Also, accept either "attach=" or "attachment=" in a "mailto:"; URL.
    
    * src/sendmsg-window.c (sendmsg_window_process_url),
    (sw_attach_file), (sendmsg_window_set_field),
    (set_list_post_rfc2369): attach a file only if the request comes
    from the command line;
    * src/balsa-mime-widget-text.c (url_send_cb), (handle_url): this
    request is not from the command line;
    * src/main.c (balsa_check_open_compose_window): this request is
    from the command line;
    * src/sendmsg-window.h: new argument "gboolean
    from_command_line" for sendmsg_window_process_url() and
    sendmsg_window_set_field().

 ChangeLog                    | 22 ++++++++++++++++++++++
 src/balsa-mime-widget-text.c |  4 ++--
 src/main.c                   |  4 ++--
 src/sendmsg-window.c         | 25 +++++++++++--------------
 src/sendmsg-window.h         |  6 ++++--
 5 files changed, 41 insertions(+), 20 deletions(-)
---
diff --git a/ChangeLog b/ChangeLog
index aca14c2dc..b507be9cc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,25 @@
+2019-03-03  Peter Bloomfield  <pbloomfield bellsouth net>
+
+       Do not attach files in response to clicking a "mailto:"; URL
+
+       Only if the URL is passed to Balsa on the command line by "-m"
+       or "--compose".
+
+       Also, accept either "attach=" or "attachment=" in a "mailto:";
+       URL.
+
+       * src/sendmsg-window.c (sendmsg_window_process_url),
+       (sw_attach_file), (sendmsg_window_set_field),
+       (set_list_post_rfc2369): attach a file only if the request comes
+       from the command line;
+       * src/balsa-mime-widget-text.c (url_send_cb), (handle_url): this
+       request is not from the command line;
+       * src/main.c (balsa_check_open_compose_window): this request is
+       from the command line;
+       * src/sendmsg-window.h: new argument "gboolean
+       from_command_line" for sendmsg_window_process_url() and
+       sendmsg_window_set_field().
+
 2019-02-28  Peter Bloomfield  <pbloomfield bellsouth net>
 
        Simplify handling "mailto:"; URLs
diff --git a/src/balsa-mime-widget-text.c b/src/balsa-mime-widget-text.c
index 0159796c2..deba4763a 100644
--- a/src/balsa-mime-widget-text.c
+++ b/src/balsa-mime-widget-text.c
@@ -468,7 +468,7 @@ url_send_cb(GtkWidget * menu_item, message_url_t * uri)
     BalsaSendmsg * newmsg;
 
     newmsg = sendmsg_window_compose();
-    sendmsg_window_set_field(newmsg, "body", uri->url);
+    sendmsg_window_set_field(newmsg, "body", uri->url, FALSE);
 }
 
 static gboolean
@@ -786,7 +786,7 @@ handle_url(const gchar * url)
 {
     if (!g_ascii_strncasecmp(url, "mailto:";, 7)) {
         BalsaSendmsg *snd = sendmsg_window_compose();
-        sendmsg_window_process_url(url + 7, snd);
+        sendmsg_window_process_url(snd, url + 7, FALSE);
     } else {
         GtkStatusbar *statusbar;
         guint context_id;
diff --git a/src/main.c b/src/main.c
index aed859345..03374bad0 100644
--- a/src/main.c
+++ b/src/main.c
@@ -444,9 +444,9 @@ balsa_check_open_compose_window(void)
 
         if (opt_compose_email) {
             if (g_ascii_strncasecmp(opt_compose_email, "mailto:";, 7) == 0)
-                sendmsg_window_process_url(opt_compose_email + 7, snd);
+                sendmsg_window_process_url(snd, opt_compose_email + 7, TRUE);
             else
-                sendmsg_window_set_field(snd, "to", opt_compose_email);
+                sendmsg_window_set_field(snd, "to", opt_compose_email, TRUE);
             g_free(opt_compose_email);
             opt_compose_email = NULL;
         }
diff --git a/src/sendmsg-window.c b/src/sendmsg-window.c
index 936360d69..9b293557a 100644
--- a/src/sendmsg-window.c
+++ b/src/sendmsg-window.c
@@ -4415,19 +4415,21 @@ decode_and_strdup(const gchar * str, int delim, const gchar ** newstr)
    of format 'key'='value' with ampersands as separators.
 */
 void
-sendmsg_window_process_url(const char *url, void *data)
+sendmsg_window_process_url(BalsaSendmsg *bsmsg,
+                           const char   *url,
+                           gboolean      from_command_line)
 {
     const gchar *ptr;
     gchar *to, *key, *val;
 
     to = decode_and_strdup(url,'?', &ptr);
-    sendmsg_window_set_field(data, "to", to);
+    sendmsg_window_set_field(bsmsg, "to", to, from_command_line);
     g_free(to);
     while(ptr) {
        key = decode_and_strdup(ptr,'=', &ptr);
        if(ptr) {
            val = decode_and_strdup(ptr,'&', &ptr);
-           sendmsg_window_set_field(data, key, val);
+           sendmsg_window_set_field(bsmsg, key, val, from_command_line);
            g_free(val);
        }
        g_free(key);
@@ -4452,14 +4454,7 @@ sw_attach_file(BalsaSendmsg * bsmsg, const gchar * val)
                                    _("not an absolute path"));
         return;
     }
-    if (!(g_str_has_prefix(val, g_get_home_dir())
-          || g_str_has_prefix(val, g_get_tmp_dir()))) {
-        balsa_information_parented(GTK_WINDOW(bsmsg->window),
-                                   LIBBALSA_INFORMATION_WARNING,
-                                   _("Could not attach the file %s: %s."), val,
-                                   _("not in your directory"));
-        return;
-    }
+
     if (!g_file_test(val, G_FILE_TEST_EXISTS)) {
         balsa_information_parented(GTK_WINDOW(bsmsg->window),
                                    LIBBALSA_INFORMATION_WARNING,
@@ -4505,7 +4500,7 @@ sw_attach_file(BalsaSendmsg * bsmsg, const gchar * val)
 
 void
 sendmsg_window_set_field(BalsaSendmsg * bsmsg, const gchar * key,
-                         const gchar * val)
+                         const gchar * val, gboolean from_command_line)
 {
     const gchar *type;
     g_return_if_fail(bsmsg);
@@ -4519,7 +4514,9 @@ sendmsg_window_set_field(BalsaSendmsg * bsmsg, const gchar * key,
         return;
     }
 #if defined(NO_SECURITY_ISSUES_WITH_ATTACHMENTS)
-    if (g_ascii_strcasecmp(key, "attach") == 0) {
+    if (from_command_line &&
+        (g_ascii_strcasecmp(key, "attach") == 0 ||
+         g_ascii_strcasecmp(key, "attachment") == 0)) {
         sw_attach_file(bsmsg, val);
         return;
     }
@@ -6469,7 +6466,7 @@ set_list_post_rfc2369(BalsaSendmsg * bsmsg, const gchar * url)
 
             url += 7;
             field = g_strndup(url, close - url);
-            sendmsg_window_process_url(field, bsmsg);
+            sendmsg_window_process_url(bsmsg, field, FALSE);
             g_free(field);
 
            return TRUE;
diff --git a/src/sendmsg-window.h b/src/sendmsg-window.h
index 1780751eb..fca1bbbe5 100644
--- a/src/sendmsg-window.h
+++ b/src/sendmsg-window.h
@@ -123,14 +123,16 @@ G_BEGIN_DECLS
                                           guint msgno);
 
     void sendmsg_window_set_field(BalsaSendmsg *bsmsg, const gchar* key,
-                                  const gchar* val);
+                                  const gchar* val, gboolean from_command_line);
 
     gboolean add_attachment(BalsaSendmsg * bsmsg,
                             const gchar *filename, 
                             gboolean is_a_tmp_file, 
                             const gchar *forced_mime_type);
 
-    void sendmsg_window_process_url(const char *url, void *data);
+    void sendmsg_window_process_url(BalsaSendmsg *bsmsg,
+                                    const char *url,
+                                    gboolean from_command_line);
     BalsaSendmsg *sendmsg_window_new_from_list(LibBalsaMailbox * mailbox,
                                                GArray * selected,
                                                SendType type);