Get URL of custom image field

Question

I would like to display pictures which are defined as custom "File" fields within an event. I currently to this by generating URLs having the following format:

MY_URL?q=civicrm/file&reset=1&id=FILE_ID&eid=EVENT_ID

There's another question that has been answered and can be seen here.

Using this worked, until CiviCRM recently introduced a security patch (i'm on version 5.10.3). Now, the picture urls have some sort of hash attached to them (the url contains fcs=...). Since that update, I can't display the pictures anymore.

Is there a standard, API way of getting images defined in custom fields? I know there's an Attachment API, but when I try to retrieve my file I get the following error:

{

"error_code": 0,
"entity": "Attachment",
"action": "get",
"is_error": 1,
"error_message": "Failed to run permission check: Unrecognized target entity table (civicrm_event)"
}

Answer 1

Check how this bug was fixed elsewhere https://github.com/veda-consulting/uk.co.vedaconsulting.pcpteams/pull/216

Answer 2

The file hash is mandatory because of CIVI-SA-2019-01. Now you have to use the attachments url, which is available via the API. To bypass the permission check, you have to add the parameter check_permissions with value 0 (available since 5.12).

Keep in mind, that you should only use this parameter on trusted API calls!

 $result = civicrm_api3('Attachment', 'getvalue', [
  'return' => "url",
  'id' => 42, // attachment/file id
  'check_permissions' => 0
]);