I use (and need) Private Upload (which requires the public file download method to be set !), however it seems to be incompatible with Inline.

When the Private checkbox is off, Inline works fine for me, and I can see images displayed ok (both as image and linked file under /files). This is so with imagecache (image resizing) on, or without it as long as the Image Upload size restriction is opened up enough to handle the test image I used.

When the Private Upload checkbox is off (in the edit form for the node to which an image is attached), Inline does not work for me, I get a a box where the image should be, with the image filename in the top left corner, and a missing image icon (depends on browser) but no image.

This is irrespective of use of Imagecache.

Useful Drupal 6 References:

- Download method

- Setting private download method tutorial

- Restrict specific folders from public download (via .htaccess)

(which points out that when thumbnails are generated by imagecache into a separate directory then the generated image "slip through" the Private Upload strategy anyway).

Finding a truly secure image solution (that ideally offers also dynamic resizing) is becoming a big problem for me (and for my client), as I discuss under #574606: Request advice on private image access solution compatible with Private Upload, Inline, and ImageCache, so I'd be very glad for any assistance.

Comments

webel’s picture

webel commented

Visit also: http://drupal.org/node/574606#comment-2447012

webel’s picture

webel commented

A possible solution path: #292446: What about private upload for ImageField?: reopened

webel’s picture

webel commented

Oops, this last comment should have been under the general posting:
Request advice on private image access solution compatible with Private Upload, Inline, and ImageCache

glasswool’s picture

glasswool commented

I installed Inline and want to use it with imagecache to display inline images on a node, I cant seem to get it to display an image where the upload|file=# is placed in the text. All images display at the top of the page and 'Not Found:#' is displayed in red where the image should be. I tried using both Private and Public download methods. Can someone tell me what I could be doing wrong?

webel’s picture

webel commented

The following change to (complete overwrite of) files/private/.htaccess (adapted from the .htaccess written by the Private Downloads) seems to work for inline images, although I am not sure what the security consequences are:

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteBase /system/files/private
  RewriteRule ^(.*)$ $1 [L,R=301]
</IfModule>

It forces the direct access path written to the src attributes of the img tag by inline to be routed through the system/files/private handler, and then the inline image appears ok. Again, I can't vouch for the security of it, but it seems to still safely prevent anonymous access to the images by either direct or rewritten path to images.