When using something like the oEmbed module, you can have say a video file in {file_managed}, and the oEmbed response can return the URL to a thumbnail image that isn't in {file_managed}. And it would be nice to be able to generate derivatives of this thumbnail (e.g., a square crop for use in Media module's Preview view mode).

This patch enables that, while still preventing open access to arbitrary URLs.

CommentFileSizeAuthor
#5 allow_image_derivatives-1299438-5.patch6.31 KBneetu morwani
#2 remote_stream_wrapper-image-derivatives.patch6.54 KBeffulgentsia
#1 remote_stream_wrapper-image-derivatives.patch6.1 KBeffulgentsia
remote_stream_wrapper-image-derivatives.patch5.16 KBeffulgentsia

Comments

effulgentsia’s picture

effulgentsia commented
StatusFileSize
new remote_stream_wrapper-image-derivatives.patch6.1 KB

Oops. Forgot the .install file. Here's a patch with that included.

effulgentsia’s picture

effulgentsia commented
StatusFileSize
new remote_stream_wrapper-image-derivatives.patch6.54 KB

#1 adds a hook_schema() implementation, but no update function for existing users of this module. This patch fixes that.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

Seems to me this would open up sites to allowing image styles of any possible remote file out there to be generated, which could be considered a major security risk?

effulgentsia’s picture

effulgentsia commented 
+++ b/remote_stream_wrapper.image.inc
@@ -2,21 +2,25 @@
+  // Only process remote URLs for which remote_stream_wrapper_image_style_path()
+  // (e.g., via theme('image_style')) has been invoked. Otherwise, the website
+  // is open to any user processing any remote URL.
+  $image_uri = db_select('remote_stream_wrapper_url', 'rswu')->fields('rswu', array('url'))->condition('id', $hash)->execute()->fetchField();
+  if (!isset($image_uri)) {
+    return MENU_NOT_FOUND;
+  }

Does this not cover for that?

neetu morwani’s picture

neetu morwani commented
Version: 7.x-1.x-dev » 7.x-1.0-rc1
Issue summary: View changes
StatusFileSize
new allow_image_derivatives-1299438-5.patch6.31 KB

Here is the reroll patch for the rc1 candidate of the module.

Status: Needs review » Needs work

The last submitted patch, 5: allow_image_derivatives-1299438-5.patch, failed testing.

Dave Reid credited Upchuk.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented