Request: Adding attachment feature to PM's

[NiteCloak]

I would like the ability to be able to private message (pm) my members and attach a file to the pm.

I have not found this available as a mod or script edit anywhere although I admit that I am not 100% sure what search criteria to search under. I scoured the SMF forums and the mod downloads for about an hour and could not find anything on this subject.

Can anyone offer any input on this?  I cannot speak for others but this would be a huge benefit to myself and my members as quite often I need to forward small, private files to specific members that I don't wish to attach to an open forum post that others can see.

[KGIII]

The earliest request for this that I have found goes back to 2003. It still hasn't been done for a variety of reasons involving complexity, management, security, and legal liability.

[NiteCloak]

Goodness.  Can you elaborate?  Particulary on the complexity and legal liability issues.

It would seem that it can definitely be done.  After some Google searches I found the following code at this site: www.sitepoint.com:

Koodi [Valitse] Laajenna


<?php
// Read POST request params into global vars
$to      = $_POST['to'];
$from    = $_POST['from'];
$subject = $_POST['subject'];
$message = $_POST['message'];


// Obtain file upload vars
$fileatt      = $_FILES['fileatt']['tmp_name'];
$fileatt_type = $_FILES['fileatt']['type'];
$fileatt_name = $_FILES['fileatt']['name'];


$headers = "From: $from";


if (is_uploaded_file($fileatt)) {
 // Read the file to be attached ('rb' = read binary)
 $file = fopen($fileatt,'rb');
 $data = fread($file,filesize($fileatt));
 fclose($file);

 // Generate a boundary string
 $semi_rand = md5(time());
 $mime_boundary = "==Multipart_Boundary_x{$semi_rand}x";
 
 // Add the headers for a file attachment
 $headers .= "\nMIME-Version: 1.0\n" .
             "Content-Type: multipart/mixed;\n" .
             " boundary=\"{$mime_boundary}\"";


 // Add a multipart boundary above the plain message
 $message = "This is a multi-part message in MIME format.\n\n" .
            "--{$mime_boundary}\n" .
            "Content-Type: text/plain; charset=\"iso-8859-1\"\n" .
            "Content-Transfer-Encoding: 7bit\n\n" .
            $message . "\n\n";


 // Base64 encode the file data
 $data = chunk_split(base64_encode($data));


 // Add file attachment to the message
 $message .= "--{$mime_boundary}\n" .
             "Content-Type: {$fileatt_type};\n" .
             " name=\"{$fileatt_name}\"\n" .
             "Content-Disposition: attachment;\n" .
             " filename=\"{$fileatt_name}\"\n" .
             "Content-Transfer-Encoding: base64\n\n" .
             $data . "\n\n" .
             "--{$mime_boundary}--\n";
}


// Send the message
$ok = @mail($to, $subject, $message, $headers);
if ($ok) {
 echo "<p>Mail sent! Yay PHP!</p>";
} else {
 echo "<p>Mail could not be sent. Sorry!</p>";
}
?>



Could this not be integrated in to SMF's pm mail system some how?

[Alan S]

Well the complexity would be designing it to the pm system so the attachments are stored in a different database table ( So you dont confuse them with post attachments ) Then theres also making it obey the size limit etc......... , It's basicaly redesigning the current post attachment system.

As for legal liability , Forum admins cannot view Pm's unless they know where to look in the database , So if forum admins cant other peoples pm's , How can they manage the attachments being sent via pm's and ensure they are not illegal , distasteful or ones that might offend others?

[NiteCloak]

Well the complexity issue sounds to me that its more a case of someone not actually sitting down and trying to do the programming and integration possibly because of the second issue?

As to the liability...  I'm sorry if I sound stupid here, but what is the difference between owning a domain with email capabilities that can be granted to your users, versus having the pm feature within your forums provide the same service?   You're right, you can't personally audit a user's private message attachment and nor should you, only perhaps by type, such as .exe or .com etc.

I do not see why this cannot be implemented.  It sounds more like that those that might know how to do it, won't attempt it because they cannot have full admin control over it. 

It would be just another 'service' tool that can be offered to your users.  Provided your users are appraised of the limitations and or liabilities prior to using the service you are providing, I fail to see what the problem is.

[Rudolf]

Well, complexity-wise it's all pretty easy. You just use the attachment system. I see no problem why it wouldn't be ok to mix the messages and posts. You just have to do some extra things to differentiate the two.
I did it, and it's pretty straightforward, even if there's a bit of coding to do.

I think the whole issue around the liability is because of the wording is used for the PM's. I don't call it Private Messages, I call them Personal Messages. It's different. You can send a message to another user that's personal for you and him/her, but it is not private. There's no privacy issue.

[Rudolf]

As for legal liability , Forum admins cannot view Pm's unless they know where to look in the database , So if forum admins cant other peoples pm's , How can they manage the attachments being sent via pm's and ensure they are not illegal , distasteful or ones that might offend others?

How can forum admins ensure that the message don't contain hateful, racist or offensive text? They can't. So your point is moot here.
Anyways, users can use the report PM feature, so if they receive a PM with "ugly" attachments in them, they can simply report it to the admins. What's the issue, again?

[NiteCloak]

Thx Rudolf.  Well I am no programmer so I guess I'll just have to sit tight until some brave soul launches an installable package I can use. 

[metallica48423]

though i do not speak in any official capacity, i think the issue is more on the lines of people being able to share illegal files WITHOUT a site owner's knowledge.

If you think not knowing of something saves you from prosecution under the law, and i mean this respectfully, but, well, you're wrong.  You can thank those who designed the copyright laws for that.

And, of course, The SMF team, from a moral standpoint, cannot and will not assist a member in being able to view others Personal Messages, the one caveat to that which would allow the admin to track this.

[Rudolf]

I quote the answer of one of the developers of SMF as a response to a user complaining about what he can do or can't do.

Just to be clear:  This is our server.  We can and will tell you how you may or may not use our facilities.  That is the right of every forum operator.

So, how is this conduct in line with the SMF Team's moral standpoint of not giving the possibility to other people to do the same with their own server. Morally, it is the right of every forum operator to know how the users use their services.

[NiteCloak]

Metallica, not that I disagree with your statement, but it is a sad state of affairs when our endeavors to better an already fine product for the benefit of everyone, is curtailed by legal eggshell-stepping based on the 'possible' actions of an unknown minority.  Wouldn't you agree?

[metallica48423]

These are my own personal opinions, not necessarily that of the staff.  Please realize this when reading this.

We are not in any way saying that you can't do it.  In fact, i'd encourage it to use it as a learning experience.  But the SMF team from a moral standpoint, on the terms of not making PM's readable by admins due to privacy concerns, stands to protect user's privacy.  We will not stop anyone from doing what they wish, but we will not help them do it if it stands to violate a person's privacy. 

I agree with the whole deal on a personal level.  I am simply stating what has been said and decided before me or my time as a team member, please understand that before assuming anything .  I have two voices, in some ways.  My own voice, and as a team member, willingly or not, i also speak for the team.  I speak now using my own voice.

I am simply stating what has been decided prior.

Rudolf, that really is a different context from this issue.  That issue dealt with the moderation of a member.  Its not that we will not allow it.  We do not want to be held liable for it.  We aim to put out an excellent product and that could be halted should any litigation be brought forward.

The bigger SMF gets, the more it has to watch itself lest someone decide we infringed on our rights.  People these days are very sue-happy.  I personally don't see it happening but, it is still a liability.  You must remember how different laws are over there versus over here and how sue-happy people are over here.

[Tristan Perry]

Firstly, sorry about the abruptness of this reply, I'm in a rush and would just like a few answers when possible

With regards to the personal message argument... why the "Report to Admin" link, then? It's either not ethical to be able to view any part of PMs, hence this feature should be scrapped, or there's no argument to not add attachments to a PM (considering that they can be moderated if need be).

Also, whilst I can understand this from a legal standpoint, posting illegal images via normal posts would still be illegal, no? And wouldn't PMing members links to illegal content also be illegal? I cannot see that adding attachments to PMs would be any different from a legal stand-point, considering SMF software can already be used (both publicly and via PM) to promote illegal activity?

[nitins60]

It's so stupid @discussing regarding Legal and Illegal Files!! Why admin panel s there? If admin has suspects, he can disable attachments in PMs. After all, it depends on Admin Control!!!

Regarding 3rd post, why it's complex n code! Use same attachment code of posts n pm! After all you have to create one more table for pm attachments!!

[metallica48423]

its not adding the functionality that is the exact issue.  I agree that it should be possible.

The problem with the PM's is that it cannot be moderated UNLESS someone reports it   It is ultimately up to the admin if they choose to take a direction.  We cannot and will not stop them.  But for many of us, its not morally right for us to help accomplish something that can be abused.  I encourage the addition of the functionality if it is necessary, by all means.  I can see it being a mod, but i can't see it being in default.  That is not my call, however.

As for 'the minority'... we do actually get a few concerns from time to time asking whether their PM's can be read by others.  So that tells us that there are groups on both sides of 'admins seeing pm's type things.

I lack the technical knowledge to accomplish it, but i encourage that if it is necessary, it be done. 

Rudolf, you have said that you have done this, have anything that you can share?  Thanks.

[Tristan Perry]

The problem with the PM's is that it cannot be moderated UNLESS someone reports it   It is ultimately up to the admin if they choose to take a direction.

But the PM system can still be used to discuss (and give links to) illegal content without admins knowing - hence technically it's the PM system that should be scrapped due to potential abuse?

[nitins60]

The problem with the PM's is that it cannot be moderated UNLESS someone reports it   It is ultimately up to the admin if they choose to take a direction.

But the PM system can still be used to discuss (and give links to) illegal content without admins knowing - hence technically it's the PM system that should be scrapped due to potential abuse?

+1

[NiteCloak]

I don't wish to offend anyone but all I have heard so far is semantics.  Lets develop the functionality, whether its available as part of the standard distribution or as a mod, and let the users decide.  SMF cannot be held liable for a "maybe".   

There is no illegality that I know of in providing what is essentially a full-function, site specific, messaging/email service.   SMF, like every other forum board developer, has already made the decision to provide the pm service.  Now that it already exists, adding functionality to it is neither here nor there.  Anything can be abused but if we live our lives worrying what someone "might" do with something we'll never get anything achieved. 

I could lend my truck to a neighbor for an afternoon who claims he wants to use it for moving some lumber.  He then uses it to ram an ATM and rob a bank.  How was I to know?  Should the automotive manufacturers stop making trucks because this possibility may occur?

[Rudolf]

Rudolf, you have said that you have done this, have anything that you can share?  Thanks.

I'll make it as a mod, then we will see where to go from there. It'll be a couple of weeks, so you still have time to discuss semantics.

[metallica48423]

All i was looking for is understanding of our point as a whole.   Nitins60 has a very excellent point.

There is a slight difference there too though.  Distribution vs. not.

With such a system, itd be possible to directly distribute the file, which could make that user, but most likely the site or the admin, liable for its content.  Whereas with a posted link they would go after the distributor site if anything got out about it.  Again, theres the 'personal' part of it.  It works both sides of the street, it keeps the admins out, but it also keeps the feds out .

Theres no point in arguing semantics though.  I haven't much more to say than giving a general warning about the misuse.  You all seem to understand the risks well enough, so I can say that i support your endeavors to gain this functionality.  Its not our job to play dad, but i thought it would be only right to notify you of that possibility. 

That possibility is why this is likely not and may not be in the core.  For that, i'd have to ask a developer, as it is their playing field there

Rudolf:  Thanks   Much obliged.