Ah, didn't consider to look into privileges. This makes the feature much more powerful than I thought. I might thus not forbid it completely. Thank you!

Is there any way to disable the file upload? I only see the option to disable regular files upload. But I'd like to disable the file upload feature completely and not even allow images. Is there a way to do this?

This has now been implemented in 1.6.1.

Just as a note for people reading this thread and not wanting to read the issue

@PitaJ I probably won't bring the pull-request today as it is too late in my timezone already. But while looking at the code I found two strange things about the fallback transport:

• It seems it is only configured when NodeBB is startup? But when you change it in the e-mail settings nothing is mentioned that you need to restart the forum for the changed custom e-mail settings to take effect. Am I too tired and looking at this wrong? The fallbackTransport is only configured in Emailer.registerApp and that is only called on startup?
• Is there a spelling error on line 66 in emailer.js? serice instead of service? Thus the custom smtp never could actually take effect?

As far as I'm aware it breaks it. Because if you provide authentication options nodemailer will try to authenticate and if there is simply no available authentication the server will reject that and it will result in an error.

The plugin checks if username or password is empty. If either one is empty no authentication option is passed to the nodemailer and thus no authentication takes place.

Since I need this, I would be happy to provide a pull-request for this in the main code. I think what the plugin is doing could be very easily ported to the fallbackTransport in the core.

@PitaJ That is sadly not possible. The built-in SMTP emailer lacks several feature this plugin has. I need to send e-mails unencrypted without user authentication to another service running in the DMZ. This is not supported. Sendmail also is not an option thus I can't use services like ssmtp or msmtp.

With the changes I made to this plugin it not only works with the current NodeBB, but also provides unencrypted and unauthenticated e-mail transport. Quite important if you have a centralized service in your DMZ for relaying e-mails.

I fixed several problems with this plugin and made a pull request:
https://github.com/NodeBB/nodebb-plugin-emailer-local/pull/18

Until someone has time to merge this I published a fork of this plugin with those changes merged in:

Again, thank you for the prompt answer!

Thank you for the answer.

Regarding the second point: But thus the message would only be received by one user. So if there is only one administrator this wouldn't be a problem. But if there are multiple administrators?

To be honest I don't have a use case for this. Putting it in the uid_<uid_of_user> room would be enough for me. So the question is just out of curiousness.

So I'm currently trying to figure out the plugin development with NodeBB. I think I finally found out how the whole communication between a page in the ACP and the plugin works. But I'm now facing a security concern that I'm unclear how to solve.

Actually the problem is twofold:

1. If I expose functions in the plugin, what is the best way to make sure that only administrators can call them? Looking at other plugins like the Shoutbox plugin, they add their plugin functions to the admin object. Thus resulting in calls to admin.plugins.my-great-plugin.my-great-function. This way they use the before function in the admin object that makes sure that only an administrator can call the function. Is this the preferred way to do it? Or should I stay out of this namespace?
2. If I send events to the client, how can I make sure those are only received by an administrator? As far as I could tell everyone that is logged in can join the admin room. Thus if my plugin sends events to the admin room everyone can receive them. Just open your web console and type in app.enterRoom('admin') and you receive all those events. What can I do to prevent this?