Answers.Body: <p>Check how this bug was fixed elsewhere <a href="https://github.com/veda-consulting/uk.co.vedaconsulting.pcpteams/pull/216" rel="nofollow noreferrer">https://github.com/veda-consulting/uk.co.vedaconsulting.pcpteams/pull/216</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-07-18T10:46:37.923Z
Answers.Text: Sorry, but I don't get it. Could you please explain how to get a file path including the new mandatory hash via the API? Just posting a link is not Stack Overflow best practice :-/
Answers.UserDisplayName: Philipp Michael
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-03-05T12:58:24.270Z
Answers.LastActivityDate: 2019-03-05T12:58:24.270Z
Answers.UserDisplayName: user4278
Answers.Body: <p>The file hash is mandatory because of <a href="https://civicrm.org/advisory/civi-sa-2019-01-weak-access-control-for-file-attachments" rel="nofollow noreferrer">CIVI-SA-2019-01</a>. Now you have to use the attachments url, which is available via the API. To bypass the permission check, you have to add the parameter <code>check_permissions</code> with value <code>0</code> (available since <a href="https://lab.civicrm.org/dev/core/issues/690" rel="nofollow noreferrer">5.12</a>). </p>
  
  <p>Keep in mind, that you should only use this parameter on trusted API calls!</p>
  
  <pre><code> $result = civicrm_api3('Attachment', 'getvalue', [
    'return' =&gt; "url",
    'id' =&gt; 42, // attachment/file id
    'check_permissions' =&gt; 0
  ]);
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-07-18T12:46:51.393Z
Answers.LastActivityDate: 2019-07-18T12:46:51.393Z
Answers.UserDisplayName: Philipp Michael
Body: <p>I would like to display pictures which are defined as custom "File" fields within an event. I currently to this by generating URLs having the following format:</p>
  
  <pre><code>MY_URL?q=civicrm/file&amp;reset=1&amp;id=FILE_ID&amp;eid=EVENT_ID
  </code></pre>
  
  <p>There's another question that has been answered and can be seen <a href="https://civicrm.stackexchange.com/questions/11966/how-to-get-url-for-custom-image-field">here</a>.</p>
  
  <p>Using this worked, until CiviCRM recently introduced a security patch (i'm on version 5.10.3). Now, the picture urls have some sort of hash attached to them (the url contains <code>fcs=...</code>). Since that update, I can't display the pictures anymore.</p>
  
  <p>Is there a standard, API way of getting images defined in custom fields? I know there's an Attachment API, but when I try to retrieve my file I get the following error:</p>
  
  <pre><code>{
  
  "error_code": 0,
  "entity": "Attachment",
  "action": "get",
  "is_error": 1,
  "error_message": "Failed to run permission check: Unrecognized target entity table (civicrm_event)"
  }
  </code></pre>
  
Tags: <civievent><api><php><urls>
Title: Get URL of custom image field
ThreadText: # Get URL of custom image field
  
  (Asked by: username_0 on 2019-03-04)
  
  I would like to display pictures which are defined as custom "File" fields within an event. I currently to this by generating URLs having the following format:
  
  ```
  MY_URL?q=civicrm/file&reset=1&id=FILE_ID&eid=EVENT_ID
  
  ```
  
  There's another question that has been answered and can be seen [here](https://civicrm.stackexchange.com/questions/11966/how-to-get-url-for-custom-image-field).
  
  Using this worked, until CiviCRM recently introduced a security patch (i'm on version 5.10.3). Now, the picture urls have some sort of hash attached to them (the url contains `fcs=...`). Since that update, I can't display the pictures anymore.
  
  Is there a standard, API way of getting images defined in custom fields? I know there's an Attachment API, but when I try to retrieve my file I get the following error:
  
  ```
  {
  
  "error_code": 0,
  "entity": "Attachment",
  "action": "get",
  "is_error": 1,
  "error_message": "Failed to run permission check: Unrecognized target entity table (civicrm_event)"
  }
  
  ```
  
  **Tags:** civievent, api, php, urls
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2019-03-05. Score: 2 | Accepted answer
  
  Check how this bug was fixed elsewhere <https://github.com/veda-consulting/uk.co.vedaconsulting.pcpteams/pull/216>
  
  > **Comments:**
  > **username_2**: Sorry, but I don't get it. Could you please explain how to get a file path including the new mandatory hash via the API? Just posting a link is not Stack Overflow best practice :-/  
  
  ---
  
  ### Answer by username_2 on 2019-07-18. Score: 1
  
  The file hash is mandatory because of [CIVI-SA-2019-01](https://civicrm.org/advisory/civi-sa-2019-01-weak-access-control-for-file-attachments). Now you have to use the attachments url, which is available via the API. To bypass the permission check, you have to add the parameter `check_permissions` with value `0` (available since [5.12](https://lab.civicrm.org/dev/core/issues/690)).
  
  Keep in mind, that you should only use this parameter on trusted API calls!
  
  ```
   $result = civicrm_api3('Attachment', 'getvalue', [
    'return' => "url",
    'id' => 42, // attachment/file id
    'check_permissions' => 0
  ]);
  
  ```
  
  
  ---
  
  