Hey Yellow Swordfish et. all,
Thank you for staying on top of this issue – I’d like to turn the attention back to the original post topic.
Our initial investigation led us to believe there was an issue with the image file size and the interval; however, this is not the case.
This is going to be a lengthy reply and will address a lot of our concerns. I appreciate you taking the time to support this plugin. I hope we can get it straightened out once and for all. 🙂
This is from one of our developers that has been spending a lot of time looking into why this is occurring.
Line ~724 on sp-plupload-components.php was using the function move_uploaded_file() (http://php.net/manual/en/function.move-uploaded-file.php) to try and move the email attachments from the /tmp/ directory to the forum users upload directory in sp-resources.
The problem with that move_uploaded_file() is that it will run a check to make sure the file it’s trying to move is a legitamately uploaded file, which means the file exists in the $_FILES array of the current page laod and was uploaded via POST method. The post by email plugin doesn’t do that. It uses fwrite() to take the image from the email, and write it to the /tmp/ directory… and then tries to move it with move_uploaded_file()… but that function basically responds with false, or “Nope, nope moving that file because it wasn’t uploaded the way I need it to be uploaded)”.
The solution was to use rename() instead of move_uploaded_file()… which is actually used somewhere else in the same file. Using rename(), or copy()… or aynthing that doesn’t use security checks isn’t incredibly secure. But, you guys have plenty of checks in place to make sure only users with valid emails can post… so you’re fine. There’s also MIME check’s as well to make sure only valid files can be uploaded. Lots of other checks, too.
Here is the MAIN concern and why WE believe the emails aren’t being deleted from the inbox.
As shown in this screenshot (
https://i.imgur.com/wS3eYBV.png) .. the pluploader addon is deliberately designed to DIE anytime it runs across a situation where that attachment isn’t good. All of those die’s in that screenshot (and many more) sit between the forum thread creation and the imap delete function. So, you’re still vulnerable to something happening to an attachment, the script dying, not deleting the email on hover, then the plugin will poll again later (whatever you have the cron set to) and try to repost that email again. There’s WAY too much going on for us to just remove or replace those die’s and be fully confident that it doesn’t produce any other symptoms. Also notice the line after the dies aren’t being run because the die is stopping the script.
Perhaps try catch would be more effective? We believe the script is dying before it’s able to delete the email from the inbox.
There is also another moving piece amidst the emails not being deleted that we discovered.
The core problem was that the mailbox was being opened in POP3 mode and not IMAP, despite the configuration being set to IMAP. This was why the Unseen and Recent header fields were never correct and so attempts to ignore messages that have already been read weren’t working.
We have made modifications to the plugin, but would like some insight from your team before moving forwards. Please look over this information and let us know what you think.
Here is a full diff of our current version against latest.
https://github.com/irkanu/chriscrabtree-pnp/commit/56b49796bce2201232120eb34b9650cc4c8ec526