6

I would like to display pictures which are defined as custom "File" fields within an event. I currently to this by generating URLs having the following format:

MY_URL?q=civicrm/file&reset=1&id=FILE_ID&eid=EVENT_ID

There's another question that has been answered and can be seen here.

Using this worked, until CiviCRM recently introduced a security patch (i'm on version 5.10.3). Now, the picture urls have some sort of hash attached to them (the url contains fcs=...). Since that update, I can't display the pictures anymore.

Is there a standard, API way of getting images defined in custom fields? I know there's an Attachment API, but when I try to retrieve my file I get the following error:

{

"error_code": 0,
"entity": "Attachment",
"action": "get",
"is_error": 1,
"error_message": "Failed to run permission check: Unrecognized target entity table (civicrm_event)"
}
2

Check how this bug was fixed elsewhere https://github.com/veda-consulting/uk.co.vedaconsulting.pcpteams/pull/216

  • Sorry, but I don't get it. Could you please explain how to get a file path including the new mandatory hash via the API? Just posting a link is not Stack Overflow best practice :-/ – Philipp Michael Jul 18 at 10:46
0

The file hash is mandatory because of CIVI-SA-2019-01. Now you have to use the attachments url, which is available via the API. To bypass the permission check, you have to add the parameter check_permissions with value 0 (available since 5.12).

Keep in mind, that you should only use this parameter on trusted API calls!

 $result = civicrm_api3('Attachment', 'getvalue', [
  'return' => "url",
  'id' => 42, // attachment/file id
  'check_permissions' => 0
]);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.