When a user tries to view an image style derivative, image_file_download() determines access based on that users permission to view the original image:
// Check the permissions of the original to grant access to this image.
$headers = module_invoke_all('file_download', $original_uri);
if (!in_array(-1, $headers)) {
[...grant access...]
}
However, there are some use cases where it is necessary to allow access to image style derivatives, while denying access to the original image (see below for an example).
As this functionality is hard-coded into Drupal (it can't be overridden even by implementing your own hook_file_download()), I therefore propose making it optional whether image style derivative access is based on the original image or not. This could be done simply by checking against a variable that defaults to TRUE.
Example use case:
A photographer sells digital copies of his photos online.
Full-size, original images are uploaded, then image styles are automatically created that scale down and watermark the images for previewing.
All users should be able to view the scaled, watermarked image style derivatives; but the full-size, un-watermarked original images should only be accessible to paying members.
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | optional_image_style_derivative_access-1890084-1.patch | 917 bytes | Anonymous (not verified) |
Comments
Comment #1
Anonymous (not verified) commentedBTW: this whole issue only applies when using the private file system.
Here's a patch that does what I suggested above.
Comment #2
zhangtaihao commentedUnfortunately, the difficulty with this approach is that the option is way too global. Fields provide an opportunity to secure private uploads by bundle-field combination, but the global derivative access is simply untenable with the granularity afforded by the field-specific file system setting.
Having said that, if a mechanism can be set up to contextually set
image_derivative_access_based_on_originalin a relatively intelligent way, it would solve the granularity problem. However, that approach is frankly not going to be committed to core.Comment #3
zhangtaihao commentedMeanwhile, I have developed Image Style Access and released it.