--- a/sat/plugins/plugin_sec_aesgcm.py	Wed Mar 18 19:56:05 2020 +0100
+++ b/sat/plugins/plugin_sec_aesgcm.py	Wed Mar 18 20:25:02 2020 +0100
@@ -42,7 +42,7 @@
     C.PI_IMPORT_NAME: "AES-GCM",
     C.PI_TYPE: "SEC",
     C.PI_PROTOCOLS: ["OMEMO Media sharing"],
-    C.PI_DEPENDENCIES: ["XEP-0363", "XEP-0384", "DOWNLOAD"],
+    C.PI_DEPENDENCIES: ["XEP-0363", "XEP-0384", "DOWNLOAD", "ATTACH"],
     C.PI_MAIN: "AESGCM",
     C.PI_HANDLER: "no",
     C.PI_DESCRIPTION: dedent(_("""\
@@ -61,9 +61,13 @@
     def __init__(self, host):
         self.host = host
         log.info(_("AESGCM plugin initialization"))
+        self._http_upload = host.plugins['XEP-0363']
+        self._attach = host.plugins["ATTACH"]
         host.plugins["DOWNLOAD"].registerScheme(
             "aesgcm", self.download
         )
+        self._attach.register(
+            self.canHandleAttachment, self.attach, encrypted=True)
         host.trigger.add("XEP-0363_upload_size", self._uploadSizeTrigger)
         host.trigger.add("XEP-0363_upload", self._uploadTrigger)
         host.trigger.add("messageReceived", self._messageReceivedTrigger)
@@ -128,6 +132,62 @@
             self.host.plugins["DOWNLOAD"].errbackDownload(file_obj, d, resp)
         return progress_id, d
 
+    async def canHandleAttachment(self, client, data):
+        try:
+            await self._http_upload.getHTTPUploadEntity(client)
+        except exceptions.NotFound:
+            return False
+        else:
+            return True
+
+    async def _uploadCb(self, client, filepath, filename, options):
+        options['encryption'] = C.ENC_AES_GCM
+        return await self._http_upload.fileHTTPUpload(
+            client=client,
+            filepath=filepath,
+            filename=filename,
+            options=options
+        )
+
+    async def attach(self, client, data):
+        # XXX: the attachment removal/resend code below is due to the one file per
+        #   message limitation of OMEMO media sharing unofficial XEP. We have to remove
+        #   attachments from original message, and send them one by one.
+        # TODO: this is to be removed when a better mechanism is available with OMEMO (now
+        #   possible with the 0.4 version of OMEMO, it's possible to encrypt other stanza
+        #   elements than body).
+        attachments = data["extra"][C.MESS_KEY_ATTACHMENTS]
+        if not data['message'] or data['message'] == {'': ''}:
+            extra_attachments = attachments[1:]
+            del attachments[1:]
+            await self._attach.uploadFiles(client, data, upload_cb=self._uploadCb)
+        else:
+            # we have a message, we must send first attachment separately
+            extra_attachments = attachments[:]
+            attachments.clear()
+            del data["extra"][C.MESS_KEY_ATTACHMENTS]
+
+        body_elt = next(data["xml"].elements((C.NS_CLIENT, "body")))
+
+        for attachment in attachments:
+            body_elt.addContent(attachment["url"])
+
+        for attachment in extra_attachments:
+            # we send all remaining attachment in a separate message
+            client.sendMessage(
+                to_jid=data['to'],
+                message={'': ''},
+                subject=data['subject'],
+                mess_type=data['type'],
+                extra={C.MESS_KEY_ATTACHMENTS: [attachment]},
+            )
+
+        if ((not data['extra']
+             and (not data['message'] or data['message'] == {'': ''})
+             and not data['subject'])):
+            # nothing left to send, we can cancel the message
+            raise exceptions.CancelError("Cancelled by AESGCM attachment handling")
+
     def onDataDownload(self, data, client, file_obj, decryptor):
         if file_obj.tell() + len(data) > file_obj.size:
             # we're reaching end of file with this bunch of data