The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.World + dog can see original images, if they right-click on any image and remove the .preview or .thumbnail from the URL.
Oops. Workaround: run your site with low-quality "original" images.
That's with files set to private, after which the URL is example.com/system/files/images/whatever.
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | image-5.x.1.dev-165186_0.patch | 1.6 KB | drewish |
| #6 | image-5.x.1.dev-165186.patch | 1.6 KB | Hetta |
| #4 | image_165186.patch | 1.75 KB | drewish |
Comments
Comment #1
drewish commentedthat's by design. you need to use private file transfers. you can enable those from admin/settings/file-system but beware that it will increase the load on your server.
Comment #2
Hetta commentedAh, but my files are set to private, under admin/settings/file-system .
I'd love to move this to the relevant core component, but don't know which that would be.
Comment #3
drewish commentedmy bad. looking at image_file_download() we don't do enough permissions checking.
Comment #4
drewish commentedhere's the patch I committed to HEAD for this. it'll need some re-working for the 1.x-dev branch.
Comment #5
drewish commentedmarked http://drupal.org/node/140058 as a duplicate
Comment #6
Hetta commentedThe HEAD patch as reworked for 5.x-1.x-dev.
Comment #7
drewish commentedthanks! i swapped '_original' for IMAGE_ORIGINAL and committed it to DRUPAL-5.
Comment #8
(not verified) commented