Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-41675

Wiki markup embedded images are not shown in email notifications

    • 4.03
    • 94
    • Severity 3 - Minor
    • 7
    • Hide
      Atlassian Update – 8 April 2019

      Hi everyone,

      Thank you for sharing your use cases with us for both Jira and Jira Service Desk. After investigating the problem, we have found that Jira properly links to images in email messages.

      The three main causes for the images not rendering properly are all related to the fact that in order to view attachments in Jira, the user has to be authorized:

      • the user viewing the email message is not logged in, as described in the knowledge base article: Images not showing in Jira email notifications 
      • the user's email client doesn't allow to set up a session in Jira for authentication purposes
      • the configured outgoing mail server caches images, but is unable to authorize in Jira, and caches the 403 responses (e.g. when Gmail with the default settings is used as the outgoing mail server)

      To allow displaying image attachments without the need to authorize, we initially created a feature suggestion JRASERVER-69065 to embed images directly in the emails. But,  because the current issue has history, votes and watchers, we will track work here and close the suggestion as duplicate. Please note that the solution creates a potential security vulnerability, e.g. if an attacker starts attaching multiple big files to comments.

      The issue is now transitioned to 'Long Term Backlog' status. The status means that the issue will not be fixed within the next 6 months. At the same time, it is still being monitored by Atlassian for any updates and considered a potential target within the next 6-9 months. Please do not consider this a deadline to fix the bug, but rather as an estimated timeline.

      To learn more about our recent investments in Jira Server and Data Center, please check our two new dashboards containing Recently resolved issues and Current work and future plans.

      Kind regards,
      Katarzyna Derenda
      Product manager, Jira Server

      Show
      Atlassian Update – 8 April 2019 Hi everyone, Thank you for sharing your use cases with us for both Jira and Jira Service Desk. After investigating the problem, we have found that Jira properly links to images in email messages. The three main causes for the images not rendering properly are all related to the fact that in order to view attachments in Jira, the user has to be authorized: the user viewing the email message is not logged in, as described in the knowledge base article:  Images not showing in Jira email notifications   the user's email client doesn't allow to set up a session in Jira for authentication purposes the configured outgoing mail server caches images, but is unable to authorize in Jira, and caches the 403 responses (e.g. when Gmail with the default settings is used as the outgoing mail server) To allow displaying image attachments without the need to authorize, we initially created a feature suggestion JRASERVER-69065 to embed images directly in the emails. But,  because the current issue has history, votes and watchers, we will track work here and close the suggestion as duplicate. Please note that the solution creates a potential security vulnerability, e.g. if an attacker starts attaching multiple big files to comments. The issue is now transitioned to 'Long Term Backlog' status. The status means that the issue will not be fixed within the next 6 months. At the same time, it is still being monitored by Atlassian for any updates and considered a potential target within the next 6-9 months. Please do not consider this a deadline to fix the bug, but rather as an estimated timeline. To learn more about our recent investments in Jira Server and Data Center, please check our two new dashboards containing Recently resolved issues and Current work and future plans . Kind regards, Katarzyna Derenda Product manager, Jira Server

      NOTE: This bug report is for Jira Server. Using Jira Cloud? This has been resolved in Jira Cloud: See the corresponding bug report.

      Summary

      Wiki markup embedded images are not shown in email notifications

      Steps to Reproduce (tested with a local JIRA 6.3.13):

      1. Add a google mail as the outgoing mail server;
      2. Create a project and an issue;
      3. Attach an image to the issue;
      4. Add a comment to the issue:
        !my-attachment.png!
        

      Expected Behavior

      The email notification would show the attached image.

      Actual Results

      The notification does not display the image attached.

      Notes

      The problem with Avatars not being shown in the email notifications is now being tracked here:

      • JRA-45967 Default Avatar is not displayed on Email Notifications

      Workaround

      There is currently no workaround for this issue.

        1. avatar_error.PNG
          21 kB
        2. screenshot-1.png
          39 kB
        3. screenshot-2.png
          4 kB
        4. Screen Shot 2015-01-16 at 7.43.36 PM.png
          27 kB

            [JRASERVER-41675] Wiki markup embedded images are not shown in email notifications

            Brian Peters added a comment - - edited

            I had images working (following a pattern found in the email templates I downloaded: templates\email\html\includes\header.vm

            <img id="img1" src="$attachmentsManager.getImageUrl("/images/logoHeader.png")" alt="Logo" title="Logo" class="image_fix" height="45" width="673" border="0" style="height:45px; margin-left: 10px;" />

            But, once we upgraded to Jira 9.12.0, it stopped working.  

            I then did it similar to how Avatars image are displayed in the default templates (they still work):

            <img id="img1" src="$textutils.htmlEncode($attachmentsManager.getExternalImageUrl("images/logoHeader.png"))" alt="Logo" title="Logo" class="image_fix" height="45" width="673" border="0" style="height:45px; margin-left: 10px;" />

            ... but it still didn't work.

            Note: I also tried it with single inner quotes around the image path for both methods, still not working:

            src="$attachmentsManager.getImageUrl('/images/logoHeader.png')"

            Double Note: I am logged into Jira when trying to view these images in Outlook.  

             

             

             

            Brian Peters added a comment - - edited I had images working (following a pattern found in the email templates I downloaded: templates\email\html\includes\header.vm <img id="img1" src="$attachmentsManager.getImageUrl("/images/logoHeader.png")" alt="Logo" title="Logo" class="image_fix" height="45" width="673" border="0" style="height:45px; margin-left: 10px;" /> But, once we upgraded to Jira 9.12.0, it stopped working.   I then did it similar to how Avatars image are displayed in the default templates (they still work): <img id="img1" src="$textutils.htmlEncode($attachmentsManager.getExternalImageUrl("images/logoHeader.png"))" alt="Logo" title="Logo" class="image_fix" height="45" width="673" border="0" style="height:45px; margin-left: 10px;" /> ... but it still didn't work. Note: I also tried it with single inner quotes around the image path for both methods, still not working: src="$attachmentsManager.getImageUrl( ' /images/logoHeader.png ' )" Double Note: I am logged into Jira when trying to view these images in Outlook.        

            Hi rsi8

            For displaying images in notification emails security tokens were implemented, images are not embedded directly in the emails.

            You can see more details about troubleshooting here: https://confluence.atlassian.com/jirakb/image-attachments-are-not-displayed-in-emails-1021245523.html

             

             

            Mikolaj Grzaslewicz added a comment - Hi rsi8 For displaying images in notification emails security tokens were implemented, images are not embedded directly in the emails. You can see more details about troubleshooting here: https://confluence.atlassian.com/jirakb/image-attachments-are-not-displayed-in-emails-1021245523.html    

            Roland Siegel added a comment - - edited

            wait...

            Atlassian says: 

            "To allow displaying image attachments without the need to authorize, we initially created a feature suggestion JRASERVER-69065 to embed images directly in the emails. But,  because the current issue has history, votes and watchers, we will track work here and close the suggestion as duplicate. Please note that the solution creates a potential security vulnerability, e.g. if an attacker starts attaching multiple big files to comments."

            Status "closed", solution "fixed"

            Lookin in my mails:

            Did I miss sth?

             

            Roland Siegel added a comment - - edited wait... Atlassian says:  "To allow displaying image attachments without the need to authorize, we initially created a feature suggestion  JRASERVER-69065  to embed images directly in the emails. But,  because the current issue has history, votes and watchers, we will track work here and close the suggestion as duplicate. Please note that the solution creates a potential security vulnerability, e.g. if an attacker starts attaching multiple big files to comments." Status "closed", solution "fixed" Lookin in my mails: Did I miss sth?  

            T.S. added a comment -

            Great... found this via google, images not showing, sheers atlassian!

            T.S. added a comment - Great... found this via google, images not showing, sheers atlassian!

            Dale Tan added a comment -

            NOTE: This bug report is for Jira Server. Using Jira Cloud? This has been resolved in Jira CloudSee the corresponding bug report.
            IMHO issue is neither fixed properly in Jira Cloud.

             

            lol...definitely not fixed on Jira cloud. I'm still getting broken images in emails when they are in the comments.

            Dale Tan added a comment - >  NOTE:  This bug report is for  Jira Server . Using  Jira Cloud ? This has been resolved in  Jira Cloud :  See the corresponding bug report . IMHO issue is neither fixed properly in Jira Cloud.   lol...definitely not fixed on Jira cloud. I'm still getting broken images in emails when they are in the comments.

            Joris Vleminckx added a comment - - edited

            I fully agree with you, @Jeffrey....

            For those people arriving at this ticket through google, just be aware of what it says at the top of the ticket: 

            NOTE: This bug report is for Jira Server. Using Jira Cloud? This has been resolved in Jira CloudSee the corresponding bug report.
            IMHO issue is neither fixed properly in Jira Cloud.

            Joris Vleminckx added a comment - - edited I fully agree with you, @Jeffrey.... For those people arriving at this ticket through google, just be aware of what it says at the top of the ticket:  NOTE:  This bug report is for  Jira Server . Using  Jira Cloud ? This has been resolved in  Jira Cloud :  See the corresponding bug report . IMHO issue is neither fixed properly in Jira Cloud.

            Any update on this? As others mentioned we are now 5 years in on this bug and the last update from Atlassian was over a year ago with a estimated 6-9 months. I get that this is estimated but we didn't even get an update within that time frame to say this was delayed due to other bugs, etc.

            Can we get some kind of update so we know this is still on the radar?

            I understand this is not 100% on Atlassian/Jira since the Outlook desktop client is to blame for issues displaying images from authenticated URLs but other applications/platforms have managed to work around this. I also get that there is security/privacy considerations but there are still options here such as...

            1. Embedding the image in the email so it can be referenced locally instead of via external authenticated URL
              1. This is how the rest of the images (project logos, user photos, etc.) are displayed today. Why not the others? At least give the option.. it can be defaulted to 'off'.
              2. To address concerns of large embedded images, you could provide a configurable embedded size limit and replace with a link/message like #3 below if it exceeds it. Additionally there could be throttling logic to prevent or slow repeated attempts by a user so as not to overload the platform.
            2. Generate long random ID URLs to the images and allow access to them without authentication.
              1. This can be an issue but for some Orgs they would be ok with it. Especially if you are hosting your own server which is not accessible to the internet.
            3. Replace the image with a message and link such as: 'Due to security we cannot display the image in this email. Please click here to view it in Jira."
              1. While not providing the image itself it at least provides a better user experience and lets the recipient know there is additional information to view.
            4. And as a last resort or short term workaround you could even just remove all non-public inline images as was suggested above as well.
              1. Even nothing is a better experience then errors in the email which reflect poorly to the customer/users and waste the time of Jira admins who have to repeatedly address it as a 'known issue'

            Any/All of these, and more I am probably not thinking of, are valid options and could be provided via flags to enable/disable. In addition whitelisting could be an additional component to all of these so you can restrict these options only to specific email domains.

             

            Jeffrey Irwin added a comment - Any update on this? As others mentioned we are now 5 years in on this bug and the last update from Atlassian was over a year ago with a estimated 6-9 months. I get that this is estimated but we didn't even get an update within that time frame to say this was delayed due to other bugs, etc. Can we get some kind of update so we know this is still on the radar? I understand this is not 100% on Atlassian/Jira since the Outlook desktop client is to blame for issues displaying images from authenticated URLs but other applications/platforms have managed to work around this. I also get that there is security/privacy considerations but there are still options here such as... Embedding the image in the email so it can be referenced locally instead of via external authenticated URL This is how the rest of the images (project logos, user photos, etc.) are displayed today. Why not the others? At least give the option.. it can be defaulted to 'off'. To address concerns of large embedded images, you could provide a configurable embedded size limit and replace with a link/message like #3 below if it exceeds it. Additionally there could be throttling logic to prevent or slow repeated attempts by a user so as not to overload the platform. Generate long random ID URLs to the images and allow access to them without authentication. This can be an issue but for some Orgs they would be ok with it. Especially if you are hosting your own server which is not accessible to the internet. Replace the image with a message and link such as: 'Due to security we cannot display the image in this email. Please click here to view it in Jira." While not providing the image itself it at least provides a better user experience and lets the recipient know there is additional information to view. And as a last resort or short term workaround you could even just remove all non-public inline images as was suggested above as well. Even nothing is a better experience then errors in the email which reflect poorly to the customer/users and waste the time of Jira admins who have to repeatedly address it as a 'known issue' Any/All of these, and more I am probably not thinking of, are valid options and could be provided via flags to enable/disable. In addition whitelisting could be an additional component to all of these so you can restrict these options only to specific email domains.  

            affinityid added a comment -

            And the SAGA continues!!! can you please fix this already. Its been 5 years with many requests. We pay a lot for maintenance, for no maintenance on a highly requested bug fix.
            We have been patient but this bug impacts the way we work. Our workaround is not ideal and we have lost a function that saved us time. we have started to look at the Salesforce solution now. 

            affinityid added a comment - And the SAGA continues!!! can you please fix this already. Its been 5 years with many requests. We pay a lot for maintenance, for no maintenance on a highly requested bug fix. We have been patient but this bug impacts the way we work. Our workaround is not ideal and we have lost a function that saved us time. we have started to look at the Salesforce solution now. 

            I can't believe we need to wait more than 5 years for this bugfix.

            Charlie Misonne added a comment - I can't believe we need to wait more than 5 years for this bugfix.

            tamarayee added a comment -

            My team uses the JEditor app in Jira Software 8.8.1 when we want more advanced HTML formatting. It has the option to revert to the native Jira rich text editor using wiki markup. FYI, this email issue only happens when using the native rich text editor. When we embed images in JEditor, they're displayed in emails fine.

            I would like to get my team to use the native editor more now, but the emails aren't very meaningful as we heavily use embedded screenshots to report bugs, write requirements and add testing notes.

            tamarayee added a comment - My team uses the JEditor app in Jira Software 8.8.1 when we want more advanced HTML formatting. It has the option to revert to the native Jira rich text editor using wiki markup. FYI, this email issue only happens when using the native rich text editor. When we embed images in JEditor, they're displayed in emails fine. I would like to get my team to use the native editor more now, but the emails aren't very meaningful as we heavily use embedded screenshots to report bugs, write requirements and add testing notes.

              17c7584fdc03 Shushan Ulubabyan
              mfernandes@atlassian.com Matheus Fernandes
              Affected customers:
              264 This affects my team
              Watchers:
              205 Start watching this issue

                Created:
                Updated:
                Resolved: