Image styles - thumbnails are broken in config page when private file system is used

Created on 13 April 2020, over 4 years ago
Updated 11 March 2024, 8 months ago

Problem/Motivation

While using private files to create image styles, thumbnail images are broken.
Thumbnails are being created on the server, but Drupal can't seem to find them to display.

System says that private file path is writeable and is also not the problem with .htaccess.

I have tried to fix the issue with the below patch. please let me know if this works or someone has a better solution.

This has been reported here as well
https://www.drupal.org/forum/support/post-installation/2020-01-15/image-... โ†’

Steps to reproduce

To replicate the issue, Change the file system like below
Configuration->Media->File system -> Default download method (Set to private)

and then go to Configuration->Media->Image Styles->Edit style (Any style).

The system successfully writes the thumbnail file to the private folder, and I can download and view the file. (Attempting to access the private path in the browser gives a "page not found" result).

Proposed resolution

- Generate an 'itok' token for a sample preview image on the Image Style admin page.
- Grant access in image_file_download if the image path corresponds to preview image.

$samplePath = \Drupal::config('image.settings')->get('preview_image');
  if ($path === $samplePath) {
    $image = \Drupal::service('image.factory')->get($samplePath);
    return [
      // Send headers describing the image's size, and MIME-type.
      'Content-Type' => $image->getMimeType(),
      'Content-Length' => $image->getFileSize(),
      // By not explicitly setting them here, this uses normal Drupal
      // Expires, Cache-Control and ETag headers to prevent proxy or
      // browser caching of private images.
    ];
  }

Questions about security were answered in #12 ๐Ÿ› Image styles - thumbnails are broken in config page when private file system is used RTBC

Remaining tasks

- Waiting for review

User interface changes

NA

API changes

NA

Data model changes

NA

Release notes snippet

๐Ÿ› Bug report
Status

Fixed

Version

10.2 โœจ

Component
Image moduleย  โ†’

Last updated 10 days ago

Created by

๐Ÿ‡ฎ๐Ÿ‡ณIndia AmbyH

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • ๐Ÿ‡บ๐Ÿ‡ธUnited States SocialNicheGuru

    Reroll for Drupal 9.5+

  • ๐Ÿ‡บ๐Ÿ‡ธUnited States jcontreras

    fixed issue:

    Error messageWarning: Undefined variable $sample_image_uri in Drupal\image\Controller\ImageStyleDownloadController->deliver() (line 184 of core/modules/image/src/Controller/ImageStyleDownloadController.php).

    Reroll for Drupal 9.5+ #21

  • ๐Ÿ‡บ๐Ÿ‡ธUnited States cmlara

    #23 does not appear to be a complete patch, parts of it are already in Drupal Core 9.5 and on first glance it appears to be missing the previous work without an explanation as to why. Hiding the patch to avoid confusion.

    Back to 11.x as the mainline, as a bug itโ€™s going to need to be solved in latest version and backported.

  • Status changed to Needs review 12 months ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States DamienMcKenna NH, USA

    Rerolled for 10.1.x.

  • last update 12 months ago
    Custom Commands Failed
  • Status changed to Needs work 12 months ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States smustgrave

    For the tests.

  • ๐Ÿ‡ฎ๐Ÿ‡ณIndia Nitin shrivastava

    Fix CCF Errors.

  • last update 12 months ago
    30,605 pass
  • Status changed to Needs review 12 months ago
  • Status changed to Needs work 12 months ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States smustgrave

    Please also check the tags. Was tagged for tests which are still needed

    Issue summary will probably need work too

  • Status changed to Needs review 12 months ago
  • ๐Ÿ‡ป๐Ÿ‡ณVietnam phthlaap

    Hello, I've dedicated the last two days to creating tests for the 3127116-27.patch. This marks my first attempt at contributing a patch. I would appreciate it if you could review the changes and let me know if everything is in order. Thank you.

  • last update 12 months ago
    Custom Commands Failed
  • ๐Ÿ‡ป๐Ÿ‡ณVietnam phthlaap
  • last update 12 months ago
    30,635 pass
  • Status changed to Needs work 12 months ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States smustgrave

    Ran the tests locally and they failed with

    Behat\Mink\Exception\ExpectationException : Current response status code is 403, but 200 expected.

    It's recommended to start using MRs as patches are going away.

    Looking at your test though and for your first time think you did a pretty good job

    $original_path = \Drupal::config('image.settings')->get('preview_image');

    Could probably use the local config reference

    Some comments throughout would help too for example here

        $preview_file = $style->buildUri($original_path);
        if (!file_exists($preview_file)) {
          $style->createDerivative($original_path, $preview_file);
        }
    

    Also why the need for the file_exist?

    Overall though good work!

    Moving to NW for the issue summary update I meant to tag before. Filled in some sections but left the rest to TBD, if not applicable to this issue just replace with NA. Helps the review

  • Status changed to Needs review 12 months ago
  • ๐Ÿ‡ป๐Ÿ‡ณVietnam phthlaap
  • Status changed to Needs work 12 months ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States smustgrave

    Issue summary looks good.

    Were some code suggestions in #32 also

  • ๐Ÿ‡ป๐Ÿ‡ณVietnam phthlaap

    I've created a merge request and made the suggested code modifications. Could you please review and confirm if everything is in order?

  • Status changed to Needs review 12 months ago
  • ๐Ÿ‡ป๐Ÿ‡ณVietnam phthlaap
  • Status changed to RTBC 12 months ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States smustgrave

    Ran test-only feature

    There was 1 error:
    1) Drupal\Tests\image\Functional\ImageAdminStylesTest::testPreviewImageShowInPrivateScheme
    Behat\Mink\Exception\ExpectationException: Current response status code is 403, but 200 expected.
    /builds/issue/drupal-3127116/vendor/behat/mink/src/WebAssert.php:794
    /builds/issue/drupal-3127116/vendor/behat/mink/src/WebAssert.php:130
    /builds/issue/drupal-3127116/core/modules/image/tests/src/Functional/ImageAdminStylesTest.php:561
    /builds/issue/drupal-3127116/vendor/phpunit/phpunit/src/Framework/TestResult.php:728
    ERRORS!
    Tests: 8, Assertions: 184, Errors: 1.
    

    Which matches/followed the steps in the issue summary.

    Not 100% sure about checking for a sample image but the issue is solved.

  • Status changed to Needs work 11 months ago
  • ๐Ÿ‡ณ๐Ÿ‡ฟNew Zealand quietone

    I'm triaging RTBC issues โ†’ . I skimmed the IS and the comments. I did not find any unanswered questions. However, there is an unresolved comment from alexpott.

    I added a link to the answers about security to the Issue Summary to help anyone working on this to find that discussion.

    I then read the MR and there are comments that should be changed. Because of the existing unresolved comment and my further ones, I am setting this back to Needs work. There isn't much to do though.

  • Status changed to Needs review 11 months ago
  • ๐Ÿ‡ป๐Ÿ‡ณVietnam phthlaap
  • Status changed to Needs work 11 months ago
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States smustgrave

    1 small nitpicky item. But appears rest of feedback has been resolved. Free to self RTBC after that 1 change.

  • Status changed to RTBC 11 months ago
  • ๐Ÿ‡ป๐Ÿ‡ณVietnam phthlaap
    • catch โ†’ committed e8b89f34 on 10.2.x
      Issue #3127116 by phthlaap, AjitS, cmlara, AmbyH, smustgrave, alexpott,...
    • catch โ†’ committed d95dc67e on 10.3.x
      Issue #3127116 by phthlaap, AjitS, cmlara, AmbyH, smustgrave, alexpott,...
    • catch โ†’ committed fcc1ba65 on 11.x
      Issue #3127116 by phthlaap, AjitS, cmlara, AmbyH, smustgrave, alexpott,...
  • Status changed to Fixed 9 months ago
  • ๐Ÿ‡ฌ๐Ÿ‡งUnited Kingdom catch

    Committed/pushed to 11.x, cherry-picked to 10.3.x and 10.2.x, thanks!

  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024