The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.I expect this is fallout from the blocking of original images (http://drupal.org/node/165186):
if an original is the same as a preview image, only those who have permission to see original images can see the preview/original image.
(It's not a browser bug - I can reproduce it in both firefox and konqueror).
| Comment | File | Size | Author |
|---|---|---|---|
| #9 | image_170659_0.patch | 1.55 KB | drewish |
| #6 | image_170659.patch | 3.08 KB | drewish |
Comments
Comment #1
Hetta commentedThis is a two-pronged problem:
1) people get "access denied" on previews on normal image node pages - if the defined preview size is larger than the original image (that is, preview = original).
Commenting out part of the "deny originals" patch, in image.module (latest dev) will fix things:
line 361
// if ($file->filename != IMAGE_ORIGINAL || user_access('view original images')) {line 369
// }line 370
// return -1;2) however, now people can also see originals which they shouldn't be able to access. For instance, original-size photos. Moving (or copying) the original files to a different set of image subdirectories, and updating the files table accordingly, will fix that. (for instance, leave previews + thumbnails in /files/images/photos/, and put originals into /originals/photos/ - or whatever).
Because people will right-click to "view image", will see that there's a .thumbnail. (or .preview.) between the name and the .jpg, and they will try to remove that particular bit, to see what that'll net them.
Moving the originals + updating the files table will net them a "page not found".
Code logic, hmmm, if original is smaller than defined preview size, allow, else, deny. Coding that, umm.
Comment #2
drewish commentedi'll take a look at this this afternoon.
Comment #3
drewish commentedthis isn't going to be easy to fix... i can see why no-one had bothered to implement this.
Comment #4
drewish commentedmarked http://drupal.org/node/175973 as a duplicate
Comment #5
drewish commentedthis should be easier to fix after some of the recent changes to -dev.
Comment #6
drewish commentedokay here's a patch for HEAD. it shouldn't take too much tweaking to backport to DRUPAL-5.
Comment #7
Hetta commentedNow things work like they should:
If an anonymous user tries to view a larger-than-preview original, he gets "denied".
If he tries to view a preview=original, he gets the image.
Lovely, thanks!
(The patch failed on x-dev, so I tested it on the latest HEAD only.)
Comment #8
drewish commentedcool, committed to head i'll work on a backport.
Comment #9
drewish commentedhere's a re-roll for -dev. i didnt' have a chance to test it yet.
Comment #10
Hetta commentedLovely, that patch works, too.
Thanks!
Comment #11
drewish commentedthanks, committed to DRUPAL-5
Comment #12
(not verified) commented