Security Error: Thunderbird not allowing opening a link in an email to open a local folder.
Security Error: Content at mailbox:///... may not load or link to file:///C:/temp.
I updated Mozilla Thunderbird from version 91.13.0 (32-bit) to version 102.2.1 (64-bit) and since, clicking on a link in an email to open a local folder does not work anymore. The OS is Windows 10 Pro.
For instance, in a simple email like the following (with a link to open the local folder C:\temp) whose body is:
<body>
<a href="file:C:\temp">C:\temp</a>
</body>
when I click on the link to open C:\temp in Explorer, nothing happens.
I receive no error message on the screen.
I just noticed in the Error Console (-->Tools --> Developer Tools --> Error Console) the following error message:
"Security Error: Content at mailbox:///J:/Data/Programs/Thunderbird/ThunderbirdPortable/Data/profile/Mail/Local%20Folders/Inbox?number=73 may not load or link to file:///C:/temp."
In Thunderbird 91.13.0, it was working: Windows Explorer was opening the folder C:/temp.
In Thunderbird 102.2.1, except this error message in the Error Console, nothing happens.
It looks like if Mozilla Thunderbird is not allowing me to open this link for security reasons. I suspect a security restriction from somewhere but I have no clue from where it could come. I looked in the Config Editor (-->Tools --> Settings -->General -->Config Editor...) but I did not see what could cause the problem and I am not even sure that this is the right place to fix this problem.
Anyone has any idea how to fix this problem?
Thank you for your help,
Modified by Albert
All Replies (13)
Why would you be wanting to open file links in the temp folder? I can not think of any reason to do that. Those sending mail will be not sharing a temp folder with you and downloads should not be going there for you to want to add them to an email as an attachment.
Hello Matt,
Thank you for your interest.
I chose the folder C:\temp to illustrate the problem with a directory familiar to many people.
Why do I want to do this? When I have a task to do, I send an email to myself describing this task and including a link to the folder containing the related documents. Later, when I review those emails, if I want to work on a task, I just have to click on this link to open the folder containing the related documents.
The question is not why I want to do it. The problem is that it was working before and it does not work anymore. I am trying to get it to work again.
Another way to look at this problem is the following: When you create/write an email, you can create such a link (to a local file for instance) using the following Thunderbird functionality: select some text in the body of the email and then -->Menu Bar -->Insert --->Link... [or Ctrl+K]. Make sure NOT to select the option 'Attach the source of this link to the message' when you create the link with the Thunderbird menu (-->Menu Bar -->Insert --->Link... [or Ctrl+K]): Link Properties
For instance, the HTML code created in the body of the email is:
<body>
<a moz-do-not-send="true" href="file:///C:/mytextfile.txt">myfile</a>
</body>
If you send this email to yourself, the link created by Thunderbird itself does not work when you click on it?!
The error generated in the Error Console (-->Menu Bar -->Tools --> Developer Tools --> Error Console) when you click on this link is : Security Error: Content at mailbox:///J:/Data/Programs/Thunderbird/ThunderbirdPortable/Data/profile/Mail/Local%20Folders/Inbox?number=15 may not load or link to file:///C:/mytextfile.txt.
For me, there is a concern if a functionality provided by Thunderbird does not work otherwise what is the point of such a feature?
Modified by Albert
Duplicate comment removed.
Modified by Albert
I tested this - Followed your instructions particulary this bit "Make sure NOT to select the option 'Attach the source of this link to the message' " and confirm the text link to file does not open and I get same error console message.
That's because the link said do not send is true - so you get the file name but nothing is hooked up to the link -
Source in email top one says do not send as true - this is the one that did not have the 'attach...' option selected and it fails to open. Same as you. It also produces the security error.
<a moz-do-not-send="true"
href="file:///C:/Users/Name/Documents/Family%20Tree.odt">insert no attach - not selected</a>
<a moz-do-not-send="false"
href="cid:[email protected]">insert with attach selected</a>
However, if I select option 'Attach the source of this link to the message', the the link works perfectly ok.
So I would advise that you select that 'attach.... ' option and you should have no problems because then it is not just a link showing where the file is located - the link is linked to the file.
But I see your point about having an option which would never function.
When you select option 'Attach the source of this link to the message',:
If you were to view the received email in 'View' > 'Message Body as' > 'plain text' mode, you would see the file as been attached and a paperclip is now shown in Thread Pane 'Attachments' column. This is not shown when using 'View' > 'Message Body as' > 'Original HTML' However try 'View' > 'Message Body as' > 'Simple HTML' and you will find only the one that had 'Attach the source of this link to the message' selected now shows as a link.
For more in depth information and explanation read info here: http://kb.mozillazine.org/Links_to_local_pages_don't_work
For me, there is a concern if a functionality provided by Thunderbird does not work otherwise what is the point of such a feature?
What if the link was to a destination which was public anyone could access like a webpage. Then you would not select 'Attach the source of this link to the message'. The link would open in browser.
Dear Sir,
Many thanks for your interest.
A few comments to try to progress and to keep focused on the problem:
> However, if I select option 'Attach the source of this link to the message', the link works perfectly ok. Indeed. But if you embed the file in the email, it is as sending an email with an attachment. The whole point here is to send only the link to a directory or to a file and not to attach the file to the email one way or another, without saying that this would not be possible to attach a directory as such to an email. In the case of a file, the idea is to open the source file directly from the email and NOT to work on a copy attached to the email.
> But I see your point about having an option which would never function. Let's keep in mind that it has been working until the previous version of Thunderbird. This behaviour changed without warning in the current release.
> For more in depth information and explanation read info here: > http://kb.mozillazine.org/Links_to_local_pages_don't_work During my search for a solution, I found this page and others. Unfortunately, the information is more that 15 years old. All the workarounds proposed (most of them for Firefox) that I tried are not working (anymore).
> What if the link was to a destination which was public anyone could access like a webpage. > Then you would not select 'Attach the source of this link to the message'. > The link would open in browser.' This is doing something different from what I want to do. The feature is (still) available in Thunderbird. I want to find a way of getting this feature to work again. I know I keep repeating the same thing but it was working until now. I am aware of alternatives like copying and pasting the link or sending a file in attachment but this is not what I want to do.
Concerning the security, it has never been a problem until now and I do not see how it could be a security issue. We have to keep in mind that Thunderbird is an email client and not a browser. If you open a directory from such a link in an email from Thunderbird, it is all happening locally. It does not talk or report information to any web server like a browser could do. I am not aware of any security report that would have triggered this restriction/change in Thunderbird. If this restriction was implemented for security reasons, I think however that the user should have the possibility to decide for himself if he wants to allow (or not) such links to work to open local directories or files. There are many specific reasons for willing to do this.
Modified by Albert
I do get your point. Use the workaround I mentioned to continue making it work for now.
I'll check out Bugzilla etc to see what is going on and look for reports.
Thank you for your efforts and for your support.
For now, I am indeed currently using the workaround - I have no other option. :-)
OK. I located a bug recently posted. I've added additional information to help developer. For your benefit this is the link. You can follow it and Vote for it - the Vote is located in the top section under 'Details', but you would need to create a login for Bugzilla. https://bugzilla.mozilla.org/show_bug.cgi?id=1789070
Thank you for the link to the Bug 1789070 on Bugzilla. I noticed that this bug was reported one day after I posted this problem on Mozilla Support. Registration for follow-up and vote done on Bugzilla.
Modified by Albert