Problem/Motivation
When Drupal try to generate webp derivative from an image search for filename with some extensions on uppercase first and then in lowercase. When we have on files two files like image.png and image.PNG or something similiar webp will find first image.PNG and if we have the other one in the content Drupal will generate a different token for that image and it will return a 403 error.
Steps to reproduce
- Install a clean Drupal installation
- Activate responsive_image
- Add webp module and enable it
- Create a content type and add an image field on it with responsive image display
- Create a test content and upload an image like image.png
- Create another test content and upload an image like image.PNG
- Execute drush if --all and drush cr to clean caches
- Reload first content and check that the image is not regenerated
Proposed resolution
On deliver method from ImageStyleDownloadController try to detect this case.
Issue fork webp-3189967
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
abarrioHi all,
I have fixed it with this patch. I just try to detect that case on token check to return valid path for the generation.
Comment #3
luksakI am experiencing a similar, but slightly diffrerent issue: if two files have the same file name, but a different extension, I also get a 404 error. Eg:
Should I open a second issue or could we handle this in this one as well?
Comment #4
abarrioHi Lukas
I think we can handle that in this issue.
Can you add steps to reproduce the problem?
Comment #5
luksak@abarrio great. sure, I'll try to provide them later today.
Comment #6
WebbehGiven the work of #3186383: Access Denied on WebP images with Image Optimize API (see patch in #10), can y'all see if that patch solves the issue here as well? If so, we may want to close this as a duplicate issue.
Comment #7
luksakI was unable to reproduce my issue on a clean install. The patch in #3186383: Access Denied on WebP images with Image Optimize API doesn't resolve it either.
This is the error I get in the logs:
Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: in Drupal\webp\Controller\ImageStyleDownloadController->deliver() (line 174 of /app/web/modules/contrib/webp/src/Controller/ImageStyleDownloadController.php).I tried downloading the source image an re-upoad it, which fixed the issue with that particular image. What could I do to debug this?
My issue is solved, but this not what this issue is actually about. I actually am having trouble to reproduce the issue at all. The images are being displayed correctly with different cased file extensions
Comment #8
luksakComment #9
luksakActually... My last comment was only regarding my issue, not regarding upper- and lowercase file names.
Comment #10
bember commented@Lukas von Blarer@ I'm experiencing issue you described. Here are the steps to replicate it (pretty analogous to the ticket description):
Now here's another issue - continuing the steps:
This looks like a major issue to me. I'm attaching a patch that disambiguates the WebP files by including the extension into the file name (e.g. image.png.webp, image.jpg.webp). That should fix it.
re @Webbeh: at first glance it seems that patch #10 from #3186383: Access Denied on WebP images with Image Optimize API solves the upper/lower case issue, but I didn't have time to test it.
Comment #11
bember commentedMarking this as "needs review".
Comment #12
bember commentedI just realized that #10 fixes the upper/lower case issue too. Adding the original extension to the webp filename handles well ambiguities such as image.png vs image.PNG, since the resulting webp files in that case are image.png.webp and image.PNG.webp - which means no naming conflicts. I ran some tests and it looks good.
Comment #13
bember commentedHere's the updated patch with unit test and documentation fixes.
Comment #14
bember commentedWhoops, I accidentally included packaging info into the previous patch.
Comment #15
gregglesMoving to https://security.drupal.org/node/174524#new
If you need access to that, mail security@drupal.org and ask.
Comment #16
gregglesComment #17
nanobyt3 commentedHi!
When is it planned to release this fix into beta or stable release
Comment #18
WebbehThis is marked Needs Review, so it'll need Review that the supplied patch works and applies cleanly, then a move to RTBC for community approval, pending fix or feedback by a maintainer.
Right now, having folks confirm the supplied patch fixes the issue can help us move to RTBC.
Comment #19
alexmoreno commentedComment #20
alexmoreno commentedsrc/Webp.php has been refactored, which means this patch does not apply anymore
Comment #21
alexmoreno commentedComment #22
alexmoreno commentedif someone could confirm, I think this is fixed already in this issue: https://www.drupal.org/project/webp/issues/3210821
I'll mark for now duplicated, but if confirmed it would be already fixed. Otherwise please re-submit a working patch.
Thanks a lot
Comment #23
dj1999 commented@alexmoreno in Jan 15. 2022 prepared this commit https://git.drupalcode.org/project/webp/-/commit/33fb22624108c6c6d173a20....
Just this row is different to working properly this issue:
public function getWebpSrcset($srcset) {
return preg_replace('/\.(png|jpg|jpeg)(\\?.*?)?(,| |$)/i', '.\\1.webp\\2\\3', $srcset);
}
Unfortunately this is not true. Randomly prepare broken image.
Comment #24
dj1999 commentedComment #25
alexmoreno commentedthanks @dj1999. Apologies but I did not understand your message. Do you mean the issue is still there?
Thanks.
Comment #26
dj1999 commented@alexmoreno we testing with different images same name and different extension (eg.: foo.jpg and foo.jpeg). Without patch #23 display the two image in site will show the first image two time. With patch #23 will show randomly the images if reload page and often got broken image.
Comment #27
alexmoreno commentedgot it @greggles, thanks for the patience.
So neither the issue is fixed, neither it gets fixed with the patch.
The use case is different though, as the title mentions that is regarding lower case/upper case, but happy to keep it open as long as we can track both issues (as they seem very related to me)
Comment #28
tdroden commented@alexmoreno while it is a similar looking error, https://www.drupal.org/project/webp/issues/3210821 has not fixed this issue which still remains in Beta6 for me.
This case-sensitivity seems to be popping up as the root cause of a number of things. https://www.drupal.org/project/webp/issues/3186383 seems to be the farthest along towards a working patch.