With the security update 7.20 image src from insert module get placed with a query string.

old url: http://local/sites/default/files/styles/large/public/p1010055.jpg

new url: http://local/sites/default/files/styles/large/public/p1010055.jpg?itok=M...

with the query an image is not being generated.

Labeled it major because with an upgrade to 7.20 any new images inserted with the insert module (most tutorial present this method) will not be sized.

Comments

circuscowboy’s picture

Patch attached

quantos’s picture

can you elaborate please @circuscowboy. I just noticed these queries today too and as a non-techie, in the back-end sense, I'm not sure what this means. The majority of the sites we're building here are now all responsive and use the adaptive-image module which is where I'm seeing these strings.

Do we need to be concerned about anything? For example, images not being handled by the adaptive image module for their required size etc?

Any advise, much appreciated.

Q.

circuscowboy’s picture

I am not aware how the adaptive image module handles images. I do know that this module wasn't working right with the string attached. I would recommend creating an issue in the adaptive image module issue queue if things do not seem to be working. If it is just an observation of the query string - it is new and part of the 7.20 security update.

mibfire’s picture

http://drupal.org/node/1929740#comment-7122608

Circuscowboy do you have any idea for theme issue(linking images from theme dir)?

quicksketch’s picture

Title: Query string on src url breaks module » Query string on src url in Drupal 7.20 breaks module (cannot resize images that use styles)
Status: Active » Needs work

Updating title for clarity. @mibfir I closed your issue since it's reporting the same problem.

I think we need to preserve the file query string somehow in order to do our sub-request that generates an image if it's missing, since D7 won't generate the image if the token is missing. It may be easiest to remove the query string as this patch does currently, but add it back to the URL before we do the request to generate the image initially if it's an image style.

mrryanjohnston’s picture

I was also experiencing issues with this with the media module. The patch solves the problem I was having, but I'm not sure of the implications for it.

`Unable to generate the derived image located at public://styles/sidebar_thumb/public/test.png.`

Thanks, @circuscowboy!

dalin’s picture

Assigned: circuscowboy » Unassigned
Priority: Major » Critical
Status: Needs work » Reviewed & tested by the community

This looks good.

dalin’s picture

Status: Reviewed & tested by the community » Needs review
StatusFileSize
new1.52 KB

Hold on a sec, #1 doesn't work if the image does not require resizing. In that case we need to retain the query and add it back later.

Also let's make the world a better place by not using regex unless it's necessary :)

mariacha1’s picture

#8 clears it up for me. I'll test out and set to rtbc if I don't find errors, but the code looks solid.

pipboy-1’s picture

StatusFileSize
new1.58 KB

If a link to the original image is generated, the patch does not add the query string back to the href value, only to the src of the resized img element. That is, the generated code is:

<a href="/drupal/sites/default/files/styles/large/public/IMG_4726.JPG" ... >
  <img src="/drupal/sites/default/files/resize/styles/large/public/IMG_4726-262x197.JPG?itok=eVCeMAe4" ...>
</a>

instead of

<a href="/drupal/sites/default/files/styles/large/public/IMG_4726.JPG?itok=eVCeMAe4" ...>
  <img src="/drupal/sites/default/files/resize/styles/large/public/IMG_4726-262x197.JPG?itok=eVCeMAe4" ...>
</a>

I've attached a minor modification to your patch to handle that.

  if ($image['original_query']) {
    $src .= '?' . $image['original_query'];
  }

becomes

  if ($image['original_query']) {
    $src .= '?' . $image['original_query'];
    $image['original'] .= '?' . $image['original_query'];
  }

BTW: is it necessary to add the query string to the img element in this case at all?

pipboy-1’s picture

Issue summary: View changes

forgot reason tagging it major

anybody’s picture

Issue summary: View changes

#8 works great for us. #10 lets notices pop up. I think

if ($image['original_query']) {

should better be checked by isset() or !empty().

Anyway... what's about a progress here? This is truely critical and breaks integration with insert.module completely for example, if you use the colorbox format. Other issues like #905912: Image Resize Filter and Insert module already mentioned the problem.

webcultist’s picture

Patch works great. Was looking all the time for a problem with my media module, but this patch just made it work. Please just commit 10#!

anybody’s picture

Status: Needs review » Needs work
liam morland’s picture

Status: Needs work » Needs review
StatusFileSize
new1.58 KB

Reroll.

joelpittet’s picture

Status: Needs review » Reviewed & tested by the community

Been using this for a while, the re-roll looks good. Setting as RTBC.

anybody’s picture

Confirming RTBC. Can we have that in the next release? :)

Thank you very much for your work!

  • ram4nd committed a01f85e on 7.x-1.x authored by Liam Morland
    Issue #1929710 by circuscowboy, pipboy, dalin, Liam Morland, Anybody:...
ram4nd’s picture

Priority: Critical » Normal
Status: Reviewed & tested by the community » Fixed
anybody’s picture

Thank you!

liam morland’s picture

Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.