I expect this is fallout from the blocking of original images (http://drupal.org/node/165186):
if an original is the same as a preview image, only those who have permission to see original images can see the preview/original image.

(It's not a browser bug - I can reproduce it in both firefox and konqueror).

CommentFileSizeAuthor
#9 image_170659_0.patch1.55 KBdrewish
#6 image_170659.patch3.08 KBdrewish

Comments

Hetta’s picture

Hetta commented

This is a two-pronged problem:

1) people get "access denied" on previews on normal image node pages - if the defined preview size is larger than the original image (that is, preview = original).
Commenting out part of the "deny originals" patch, in image.module (latest dev) will fix things:
line 361 // if ($file->filename != IMAGE_ORIGINAL || user_access('view original images')) {
line 369 // }
line 370 // return -1;

2) however, now people can also see originals which they shouldn't be able to access. For instance, original-size photos. Moving (or copying) the original files to a different set of image subdirectories, and updating the files table accordingly, will fix that. (for instance, leave previews + thumbnails in /files/images/photos/, and put originals into /originals/photos/ - or whatever).

Because people will right-click to "view image", will see that there's a .thumbnail. (or .preview.) between the name and the .jpg, and they will try to remove that particular bit, to see what that'll net them.
Moving the originals + updating the files table will net them a "page not found".

Code logic, hmmm, if original is smaller than defined preview size, allow, else, deny. Coding that, umm.

drewish’s picture

drewish commented

i'll take a look at this this afternoon.

drewish’s picture

drewish commented

this isn't going to be easy to fix... i can see why no-one had bothered to implement this.

drewish’s picture

drewish commented

marked http://drupal.org/node/175973 as a duplicate

drewish’s picture

drewish commented

this should be easier to fix after some of the recent changes to -dev.

drewish’s picture

drewish commented
Status: Active » Needs review
StatusFileSize
new image_170659.patch3.08 KB

okay here's a patch for HEAD. it shouldn't take too much tweaking to backport to DRUPAL-5.

Hetta’s picture

Hetta commented
Version: 5.x-1.x-dev » 6.x-1.x-dev

Now things work like they should:
If an anonymous user tries to view a larger-than-preview original, he gets "denied".
If he tries to view a preview=original, he gets the image.

Lovely, thanks!

(The patch failed on x-dev, so I tested it on the latest HEAD only.)

drewish’s picture

drewish commented
Version: 6.x-1.x-dev » 5.x-1.x-dev
Status: Needs review » Patch (to be ported)

cool, committed to head i'll work on a backport.

drewish’s picture

drewish commented
Status: Patch (to be ported) » Needs review
StatusFileSize
new image_170659_0.patch1.55 KB

here's a re-roll for -dev. i didnt' have a chance to test it yet.

Hetta’s picture

Hetta commented

Lovely, that patch works, too.
Thanks!

drewish’s picture

drewish commented
Status: Needs review » Fixed

thanks, committed to DRUPAL-5

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)