# Attachments

On request Mail Log keeps the attachments of sent mails, so that you can later trace exactly what was sent. The settings for this are in the *options* in the tab *attachments*.

## How attachments are captured

If *capture attachments* is active, Mail Log copies every attachment into a protected directory while sending and records it in the log entry. In the detail view the attachments appear in the tab *attachments* with name, type and size and can be downloaded individually (the permission *download attachments and .eml* being required).

## Where attachments live — outside the web root

<div class="callout success" id="bkmrk-out-of-the-box%2C-atta">Out of the box, attachments are stored **outside the publicly reachable area** (in the Joomla log directory under `com_maillog/attachments`). They are therefore not retrievable directly through a URL, but only through the component with a permission check.

</div>With *storage path* you can set a location of your own. If the field stays empty, the safe default path applies. For additional protection Mail Log places lock files (`.htaccess`, `web.config`) in the attachment directory.

<div class="callout info" id="bkmrk-coming-from-a-very-e">**Coming from a very early version?** Earlier builds stored attachments inside the web root. After the update Mail Log still points at the old location so that nothing is lost. The maintenance task *move attachment files* moves the files to the safe default location once and clears the old reference afterwards.

</div>## Limits and storage budget

<table class="table" id="bkmrk-optiondefaultmeaning"> <thead> <tr><th scope="col">Option</th><th scope="col">Default</th><th scope="col">Meaning</th></tr> </thead> <tbody> <tr><td>Capture attachments</td><td>Yes</td><td>Copy attachments to disk while sending.</td></tr> <tr><td>Storage path</td><td>empty (= safe default)</td><td>Where the attachments are kept.</td></tr> <tr><td>Max. per file (MB)</td><td>10</td><td>Larger attachments are skipped; their metadata (name, type, size) still stays in the log.</td></tr> <tr><td>Total storage budget (MB)</td><td>500</td><td>Once the budget is used up, new attachments are no longer copied until the next cleanup.</td></tr> </tbody></table>

## Cleaning up

How long attachment files are kept is controlled by *attachment retention (days)* in the tab *retention* (default 30 days). The maintenance task *clean up attachment files*removes older files and those whose log entry has already been deleted. How to set up this task is described in the chapter [Maintenance: scheduled tasks](https://docs.graup-it.de/books/mail-log-en/page/maintenance-scheduled-tasks).

## Safety of file names

Mail Log sanitises every attachment file name before storing it and defuses potentially executable extensions (`.php`, for instance) by appending `.bin`. Together with the storage location outside the web root, this rules out an attachment being executed on the server.

<small>Applies to version 1.0.5.</small>

[Deutsche Fassung](https://docs.graup-it.de/link/84)