When I upload an image using imagefield and then have another user upload a different file with the same file name imagefield just writes over the previous image. This presents a problem, users could easily sabotage images in another person's post by uploading something of the same filename. Even if they were not being malicious this could easily happen by mistake.

I am trying to patch the module myself to maybe hash the filename with a timestamp, but I am not familiar with the structure of writing modules. Hopefully someone maintaining this module can make this seemingly simple fix for me :)

Comments

budda’s picture

Can we not use the same code as Drupal Core does for the user account photos. if file exists, add a numbver to the end +1 ?

bojanz’s picture

StatusFileSize
new1.58 KB

I am guessing this is the same problem that I've had.
The problem is that imagefield checks if the filename exists only when saving the node, so if you upload (via ajax for example) two files of the same name, preview will show the first image for both fields, because the preview address is the same, so Drupal gets confused.

My first try was to add code to _imagefield_widget_prepare_form_values that would check if the filename exists in the filesystem, and session for all fields, and if the filename exists, add +1 to the filename. Repeat until we have a unique filename. So, if we start uploading Playground.jpg to two fields, we would get incrementing filenames, like Playground_1.jpg, Playground_2.jpg etc.

However, my client pointed out that that could get very bad for performance on a big site, users usually don't rename files, so imagine two thousand images called Image.jpg.. That would make the checking code quite slow, since it would execute file_exists two thousand times.
The solution was to add the unix timestamp to the filename. After that, still do the mentioned check and increment the filename if a file with that name exists, just in case two people posted in the same second.

I am attaching the patch for you to consider.

bojanz’s picture

Status: Active » Needs review

Changing thread status.

dopry’s picture

Status: Needs review » Needs work

Bojanz, can you drop the time thing? And is there a particular reason you're working with filename and not filepath?

bojanz’s picture

StatusFileSize
new1.59 KB

Here's a new patch, removed the time thing, and rerolled against latest HEAD.
I manipulated filename because it seemed more logical, we make the unique filename, and pass it on to filepath...
Hope it's good.

bojanz’s picture

By the way, please note the performance concerns:
Users usually don't rename files, so imagine two thousand images called Image.jpg.. That would make the checking code quite slow, since it would execute file_exists two thousand times.

But that's the way Drupal itself does it, so that's it.. Maybe we could provide adding the timestamp as an option?

Robardi56’s picture

Hi Dopry,
of course you'll decide which patch to apply (the one with the timestamp, and the one without), but I suggest you reconsider the arguments listed by Bojan just above ( http://drupal.org/node/143686#comment-254800 ) on why the timestamp solves many duplicate names and performance problems we encountered while testing the module, and thus is a valuable feature.

Cordially,
Brakkar

sean2000’s picture

My imagefield version is 5.x-1.x-dev (Last updated: June 19, 2007 - 00:15).

I am getting errors when I try to apply the patch unique_filenames.patch.

File to patch: imagefield.module
patching file imagefield.module
Hunk #1 FAILED at 390.
Hunk #2 succeeded at 399 with fuzz 1 (offset -58 lines).
1 out of 2 hunks FAILED -- saving rejects to file imagefield.module.rej
-bash-3.00$ cat imagefield.module.rej
***************
*** 390,395 ****

      if ($valid_image) {
        $file = _imagefield_scale_image($file, $field['widget']['max_resolution']);

        // Create the filepath for the image preview
        if (function_exists('token_replace')) {
--- 390,407 ----

      if ($valid_image) {
        $file = _imagefield_scale_image($file, $field['widget']['max_resolution']);
+
+       // The images in session need to have unique filenames, in order not to mix up the thumbs
+       $cnt = time();
+       $filename_parts = explode('.', $file['filename']);
+
+       $filename = ucfirst(strtolower($filename_parts[0])) . '_' . $cnt . '.' . strtolower($filename_parts[1]);
+       while(file_exists($path . '/' . $filename) || _imagefield_in_session($filename)) {
+         $cnt++;
+         $filename = ucfirst(strtolower($filename_parts[0])) . '_' . $cnt . '.' . strtolower($filename_parts[1]);
+       }
+
+       $file['filename'] = $filename;

        // Create the filepath for the image preview
        if (function_exists('token_replace')) {
-bash-3.00$

I am guessing this might be because imagefield.module has changed since. Any help would be greatly appreciated.

bojanz’s picture

Yes, this patch will have to be rerolled against latest HEAD... However, I'm traveling to Spain in a while, so I won't have time till I return (July 15th)..

sean2000’s picture

Thanks for your prompt response. If anyone else can help me with this earlier than that, that'd be ace. I'll try figuring it out myself if I can. If not, I'll wait till bojanz is free. Thanks.

bojanz’s picture

Just came back from holiday, reread this thread, and realised that sean2000 is trying to apply the wrong patch, I already posted a patch against the latest HEAD: http://drupal.org/node/143686#comment-260479
So, Sean, please apply unique_filenames_0.patch

Bojan

bojanz’s picture

Status: Needs work » Needs review
StatusFileSize
new1.86 KB

Uploading new patch to fix bug mentioned at http://drupal.org/node/144475

dopry’s picture

Status: Needs review » Postponed (maintainer needs more info)

I can't reproduce this bug... And it does use the same code as core to create unique filenames. Can anyone confirm this is an issue?

ericpugh’s picture

Checking out the patch. This has been a problem on a site of mine, but with special circumstances. Basically, I have imagefield with imagecache, and if a user uploads a bitmap image it is not processed by imagecache (a seperate problem) however, the image is also not renamed, and has caused all kinds of strange behavior. Images with the same name replacing each other, etc.

Point is... I think that unique filenames would be a good idea, just because of these kinds of "special circumstances." Thanks all.

ximo’s picture

We're having the same problem as #14. We allow our users to upload photos of themselves for their profiles, and with nearly 4000 users, it's unfortunate that some users get another user's photo on their profile.. If anybody have a solution for this, please let me know.

reed.richards’s picture

Priority: Normal » Critical

Changing this to critical.

reed.richards’s picture

I've tried this in version 5.x-2.1 and it doesn't seem to be a problem. If someone could confirm that this has been fixed for the 5.x-2.1 version, then maybe we finally could close this issue?

quicksketch’s picture

Status: Postponed (maintainer needs more info) » Closed (fixed)

The 1.x version is no longer supported and this has been fixed in 2.x. Let's close this out.

goodghost’s picture

thanx for patch, works for me :)