I would like to display pictures which are defined as custom "File" fields within an event. I currently to this by generating URLs having the following format:


There's another question that has been answered and can be seen here.

Using this worked, until CiviCRM recently introduced a security patch (i'm on version 5.10.3). Now, the picture urls have some sort of hash attached to them (the url contains fcs=...). Since that update, I can't display the pictures anymore.

Is there a standard, API way of getting images defined in custom fields? I know there's an Attachment API, but when I try to retrieve my file I get the following error:


"error_code": 0,
"entity": "Attachment",
"action": "get",
"is_error": 1,
"error_message": "Failed to run permission check: Unrecognized target entity table (civicrm_event)"

2 Answers 2


Check how this bug was fixed elsewhere https://github.com/veda-consulting/uk.co.vedaconsulting.pcpteams/pull/216

  • Sorry, but I don't get it. Could you please explain how to get a file path including the new mandatory hash via the API? Just posting a link is not Stack Overflow best practice :-/ Commented Jul 18, 2019 at 10:46

The file hash is mandatory because of CIVI-SA-2019-01. Now you have to use the attachments url, which is available via the API. To bypass the permission check, you have to add the parameter check_permissions with value 0 (available since 5.12).

Keep in mind, that you should only use this parameter on trusted API calls!

 $result = civicrm_api3('Attachment', 'getvalue', [
  'return' => "url",
  'id' => 42, // attachment/file id
  'check_permissions' => 0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.