Accessing image attachments outside of CRM directly

[shalmaxb]

emillod , good morning. The extension works excellent. I will see, how to secure the app from unauthorized access.

[emillod]

shalmaxb please be aware that this extension will give access to ALL files in formats which are mentioned here to users which are NOT logged in. So i recommend to NOT use this extension on production instance, without any additional safety mechanisms.

[shalmaxb]

I saw the list of implementations you`ve already made. Pricing? I don`t know either. I think customers are ready to pay, what it is worth regarding, what they will do with it. The app I am developing is directed to artists, who never have enough money an so I won`t be able to get much money either. I will offer my app for free, only the service will be paid.

[emillod]

shalmaxb we have examples on our website, but we're not sure for how much we should sell our extensions

[shalmaxb]

emillod , that is very generous from you. I will test it and give my feedback. Would be nice, if you put your paid extensions on your website. It happens, that I prefer sometimes to buy a ready solution than to sit here weeks and weeks and not succeeding, because I lack of the knowledge to do so. I get around espoCRM quite fine so far, but far away from being a developer. So this forum and especially your help is really appreciated.
How people here in this forum treat each other is one great plus for espoCRM.

[emillod]

shalmaxb
I've created simple extension which will create an entryPoint and let you share files with your clients without login.

https://github.com/dubas-pro/ext-public-attachment

We have more advanced extension which GUI, additional module which let user only get access to specific files for specific amount of time and with additional strings for safety reasons, but it's not available for free.

[emillod]

You should create an EntryPoint in /custom/Espo/Custom/EntryPoints/ directory, which you should create, because EntryPoint is not created by default.
Look at entrypoints in applications directory.

Yuri meant to use authRequired with false. Here you have code from my Espo.
https://dubas.pro/c/?59cd8a7c0ae07d5...9KKG9Ja6mz1DSD

[shalmaxb]

Ok, thank you, but I did not succeed. I am not a developer and when it comes to modify things that way in espoCRM, there is a lot of trial and error from my side. Mereley, because, there are so many variable configurations, that I really get lost.

I created a folder Entry Point in custom/Espo/Custom
I copied the file Image.php, and here I already had the first doubts. Is that the right one ore should I take the Attachment.php? Ok, I choose Image.php
In Image.php I changed the namespace to custom/Espo/Custom/EntryPoints -> I don`t know, if this is completely correct??
Beneath the namespace, there are lots of paths, directing to the app folder -> should I leave these paths?
I do not see any reference to indicate auth not required (as yurikuzn wrote in his post)
I do not see any reference to the upload folder and where to put the folder, that I would like to have for my images
I see references to $disableAccessCheck = false, what I guess is the auth, but setting this to true did not have any effect.
I though found in the file Espo/Core/EntryPointsManager this variable, that I could change to "true", what caused, that the access to the entry point did not need authentication anymore. But this is in a not upgrade safe place.

Well, in the end I saved this file with another name in the newly created folder EntryPoints, but it did not have any effect.

It is quite difficult to handle all the possibilities, how soemthing might work, is it important to use small letters or capitals (sometimes I don`t know), when do you have to use ' ', and so on.

It would be nice to have a thorough tutorial, how to get this working. It would be even nicer, if we had the possibilty to choose the upload folder path from Admin interface, including the possibility to make this folder accessible without authentication.

[emillod]

You should create new folder in Custom folder, called EntryPoint? You should check how espo devs created that in applications folder.
It can be done in one file of EntryPoint.

[shalmaxb]

Hi, could anybody explain, where I will have to put a new entry point and which files I would have to create and put where.

[StG]

Thank you all, that is exactly what I needed. I copied the Image entrypoint to a new custom entrypoint called Wsimage in the custom namespace, adjusted the extension reference and changed authentication to false. After rebuilding the backend through Administration everything worked exactly as I had hoped.

[emillod]

Yes, that's correct. We've created our own entryPoint to share invoices from our EspoCRM in PDF. You don't have to worry, you can add some kind of unique strings, for example UUID to protect your files.

[telecastg]

At the risk of sounding too obvious, make sure that you define the new entry point in the Custom namespace to keep it "upgrade safe" and that you use a unique name for the custom entry point because duplicate entry point names even in different namespaces are not allowed.

[yuri]

It's not supported. You can create a new entry point extended from the image entry point and indicate as not requiring auth.

[StG]

Example scenario: EspoCRM is installed at crm.mydomain.com, and the main website is located at www.mydomain.com.

In EspoCRM, I've attached an image to an Opportunity. On the main website, I can access the EspoCRM database to find the image ID. Is there a way I can directly access the image publicly? I know that crm.mydomain.com?entryPoint=image&id=12345689 works if I am logged into the EspoCRM. If not, I am directed to the login screen. I've found that I can use the API, but I'm hoping to find a direct access route.