Doesn't protect at all?!

Created on 29 October 2024, 3 months ago

Problem/Motivation

Installed on a fresh Drupal 10.3.6 site with standard profile, changed the Article > Image field formatter to Protect Image Viewer, with its defaults, and added a node.

The image is normally downloadable and the source is visibile.. I can even right click and "Save image as.." or "Copy image".

The only difference I noticed from the previous, default "Image" formatter are the CSS classes.. (but then why do you also apply a width of 50%?!)

Proposed resolution

Remaining tasks

🐛 Bug report
Status

Active

Version

2.5

Component

Code

Created by

🇮🇹Italy kopeboy Milan

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @kopeboy
  • 🇮🇹Italy kopeboy Milan

    No error in the logs nor in the browser console whatsoever, using Chrome on macOS.

  • 🇷🇺Russia i-grou

    Have the same issue on my site. Any suggestions how to fix it?

  • 🇧🇪Belgium ScriptCircle

    Hi, thanks for repoting the bug. I'm working on fixing that to be delivered. next week.

  • 🇧🇪Belgium ScriptCircle

    bug fixed with release 8.x-2.6

  • Status changed to Fixed 23 days ago
  • 🇷🇺Russia i-grou

    Thanks for that fix @g.mustapha, now there is no anything pointing to the real image in the Page Inspector tool:

    At the same time I can still see the direct image url in the page source:

    Basically it means that there is no protection for the image, as it's possible to get to the page source and get any image from there (it's also easy to write a script for that). Are there any other ideas to implement in the nearest future to achieve real protection?

  • 🇧🇪Belgium ScriptCircle

    There is a problem with the image you attached. It doesn't make sense if your field HTML has a Canva tag that means you can't see what's inside. The bout images are from different files. The first one is from a fuels where protect_photo is active, and the second one is from olde field. Try to reactivate the image view config on the corrupted file.

  • 🇷🇺Russia i-grou

    Well, I've tried to uninstall a module and install it again - results are the same. When I use Inspector/Console (Ctrl+Shift+I) I can see a canvas instead of image. But when I look at the page source (Ctrl+U) I can see normal img tag with direct url in it.

    And it's not surprising actually. As I've checked the source code of your module and can clearly see that it relies on js library. So the source html was never meant to be protected.

    As a conclusion I can say that this module offers good protection for images from average users. At the same time it provides zero protection from tech-savvy guys. Maybe you should note it somewhere in the module description.

Production build 0.71.5 2024