From cfe4604d879dc8b2cb6d29629c3ded4e25b740dd Mon Sep 17 00:00:00 2001 From: Dane Powell Date: Wed, 17 Jun 2015 14:22:31 -0500 Subject: [PATCH] Issue #2211429 by Dane Powell, cambraca: Fixed incorrect image style URL should return 404. --- core/modules/image/src/Controller/ImageStyleDownloadController.php | 5 ++++- core/modules/image/src/Tests/ImageStylesPathAndUrlTest.php | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/core/modules/image/src/Controller/ImageStyleDownloadController.php b/core/modules/image/src/Controller/ImageStyleDownloadController.php index 2b2d89f..b69abd6 100644 --- a/core/modules/image/src/Controller/ImageStyleDownloadController.php +++ b/core/modules/image/src/Controller/ImageStyleDownloadController.php @@ -17,6 +17,7 @@ use Symfony\Component\HttpFoundation\BinaryFileResponse; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Response; +use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException; use Symfony\Component\HttpKernel\Exception\ServiceUnavailableHttpException; @@ -85,6 +86,8 @@ public static function create(ContainerInterface $container) { * @param \Drupal\image\ImageStyleInterface $image_style * The image style to deliver. * + * @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException + * Thrown when the file request is invalid. * @throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException * Thrown when the user does not have access to the file. * @throws \Symfony\Component\HttpKernel\Exception\ServiceUnavailableHttpException @@ -108,7 +111,7 @@ public function deliver(Request $request, $scheme, ImageStyleInterface $image_st $valid &= $request->query->get(IMAGE_DERIVATIVE_TOKEN) === $image_style->getPathToken($image_uri); } if (!$valid) { - throw new AccessDeniedHttpException(); + throw new NotFoundHttpException(); } $derivative_uri = $image_style->buildUri($image_uri); diff --git a/core/modules/image/src/Tests/ImageStylesPathAndUrlTest.php b/core/modules/image/src/Tests/ImageStylesPathAndUrlTest.php index 16fc8e6..74f3464 100644 --- a/core/modules/image/src/Tests/ImageStylesPathAndUrlTest.php +++ b/core/modules/image/src/Tests/ImageStylesPathAndUrlTest.php @@ -137,10 +137,10 @@ function doImageStyleUrlAndPathTests($scheme, $clean_url = TRUE, $extra_slash = } // Add some extra chars to the token. $this->drupalGet(str_replace(IMAGE_DERIVATIVE_TOKEN . '=', IMAGE_DERIVATIVE_TOKEN . '=Zo', $generate_url)); - $this->assertResponse(403, 'Image was inaccessible at the URL with an invalid token.'); + $this->assertResponse(404, 'Image was inaccessible at the URL with an invalid token.'); // Change the parameter name so the token is missing. $this->drupalGet(str_replace(IMAGE_DERIVATIVE_TOKEN . '=', 'wrongparam=', $generate_url)); - $this->assertResponse(403, 'Image was inaccessible at the URL with a missing token.'); + $this->assertResponse(404, 'Image was inaccessible at the URL with a missing token.'); // Check that the generated URL is the same when we pass in a relative path // rather than a URI. We need to temporarily switch the default scheme to -- 2.1.4