Right now, allow_insecure_derivates can only be set for the entire site. Add a new config so that it can be enabled only for certain styles.

CommentFileSizeAuthor
#29 3059836-8.patch2.37 KBshubhangi1995
#27 3059836-27.patch2.38 KBsupreetam09
#25 3059836-25.patch2.3 KBsupreetam09
#21 3059836-21.patch2.3 KBsanket1007
#15 3059836-15.patch2.32 KBjoshi.rohit100
#14 add_a_new_setting_allow_insecure_derivates-3059836-14.patch2.3 KBbibliophileaxe
#13 add_a_new_setting_allow_insecure_derivates-3059836-13.patch2.24 KBbibliophileaxe
#12 add_a_new_setting_allow_insecure_derivates-3059836-12.patch2.3 KBpiyuesh23
#8 add_a_new_setting_allow_insecure_derivates-3059836-8.patch2.24 KBbibliophileaxe
#7 add_a_new_setting_allow_insecure_derivates-3059836-7.patch2.27 KBbibliophileaxe
#6 add_a_new_setting_allow_insecure_derivates-3059836-6.patch2.27 KBbibliophileaxe
#5 add_a_new_setting_allow_insecure_derivates-3059836-5.patch2.2 KBbibliophileaxe
#4 add_a_new_setting_allow_insecure_derivates-3059836-4.patch2.2 KBbibliophileaxe
#2 add_a_new_setting_allow_insecure_derivates-3059836-2.patch1.73 KBbibliophileaxe

Comments

akanksha-hp created an issue. See original summary.

bibliophileaxe’s picture

bibliophileaxe
she/her
commented
StatusFileSize
new add_a_new_setting_allow_insecure_derivates-3059836-2.patch1.73 KB

Adding a patch for config and ignoring check on whitelisted image styles.

nikunjkotecha’s picture

nikunjkotecha
he/him
Primary language Gujarati
Location India, Gujarat, Rajkot
commented
Status: Active » Needs work

Please add config default value, config schema (with description about purpose) and a test (if there is one available for existing stuff)

bibliophileaxe’s picture

bibliophileaxe
she/her
commented
StatusFileSize
new add_a_new_setting_allow_insecure_derivates-3059836-4.patch2.2 KB

Adding a patch against 8.6.x

bibliophileaxe’s picture

bibliophileaxe
she/her
commented
StatusFileSize
new add_a_new_setting_allow_insecure_derivates-3059836-5.patch2.2 KB

Changing type in schema.

bibliophileaxe’s picture

bibliophileaxe
she/her
commented
StatusFileSize
new add_a_new_setting_allow_insecure_derivates-3059836-6.patch2.27 KB

Updating the schema.yml file.

bibliophileaxe’s picture

bibliophileaxe
she/her
commented
StatusFileSize
new add_a_new_setting_allow_insecure_derivates-3059836-7.patch2.27 KB

Fixing a few bugs.

bibliophileaxe’s picture

bibliophileaxe
she/her
commented
StatusFileSize
new add_a_new_setting_allow_insecure_derivates-3059836-8.patch2.24 KB

Correcting $config->get

bibliophileaxe’s picture

bibliophileaxe
she/her
commented
nikunjkotecha’s picture

nikunjkotecha
he/him
Primary language Gujarati
Location India, Gujarat, Rajkot
commented
Status: Needs work » Needs review
Issue tags: +Needs tests

Status: Needs review » Needs work

The last submitted patch, 8: add_a_new_setting_allow_insecure_derivates-3059836-8.patch, failed testing. View results

piyuesh23’s picture

piyuesh23 commented
StatusFileSize
new add_a_new_setting_allow_insecure_derivates-3059836-12.patch2.3 KB

Ported this patch to be usable with Drupal 8.7 release.

bibliophileaxe’s picture

bibliophileaxe
she/her
commented
StatusFileSize
new add_a_new_setting_allow_insecure_derivates-3059836-13.patch2.24 KB

Changed the condition for image derivatives.

bibliophileaxe’s picture

bibliophileaxe
she/her
commented
StatusFileSize
new add_a_new_setting_allow_insecure_derivates-3059836-14.patch2.3 KB

Correct condition for image derivative.

joshi.rohit100’s picture

joshi.rohit100
he/him
Primary language Hindi
Location Delhi, India
commented
Status: Needs work » Needs review
StatusFileSize
new 3059836-15.patch2.32 KB

Patch in #14 is not applying, so re-rolled the patch from #14

johncionci’s picture

johncionci commented

I have added this patch but can you direct me to where I would go to configure these settings?

nikunjkotecha’s picture

nikunjkotecha
he/him
Primary language Gujarati
Location India, Gujarat, Rajkot
commented

@johncionci there is no interface it (at-least in the patch), you will need to do it using drush

For instance:
drush cset image.settings allowed_insecure_styles.0 "thumbnail"

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.9 was released on November 6 and is the final full bugfix release for the Drupal 8.7.x series. Drupal 8.7.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.8.0 on December 4, 2019. (Drupal 8.8.0-beta1 is available for testing.)

Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

bibliophileaxe’s picture

bibliophileaxe
she/her
commented
Assigned: bibliophileaxe » Unassigned

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

sanket1007’s picture

sanket1007 commented
StatusFileSize
new 3059836-21.patch2.3 KB

Version: 8.9.x-dev » 9.2.x-dev

Drupal 8 is end-of-life as of November 17, 2021. There will not be further changes made to Drupal 8. Bugfixes are now made to the 9.3.x and higher branches only. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

supreetam09’s picture

supreetam09 commented
Version: 9.4.x-dev » 9.5.x-dev
Status: Needs review » Needs work
StatusFileSize
new 3059836-25.patch2.3 KB

Reroll for D9.5.x
Marking NW since needs tests.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

supreetam09’s picture

supreetam09 commented
StatusFileSize
new 3059836-27.patch2.38 KB

The previous 9.5.x patch is not applicable anymore after Drupal 9.5.8 release as ImageStyleDownloadController.php has been changed in this release. Adding new patch for 9.5.8+

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

shubhangi1995’s picture

shubhangi1995
Location GURGAON
commented
StatusFileSize
new 3059836-8.patch2.37 KB

Patch as per 10.1.6

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.