When adding an image to a node using the Imagefield module, the image is associated to this node only after saving the node. With the private download method enabled, the Filefield module denies access to files that are not associated to a node. Therefore, using the Insert module to add an unassociated image to the body of a node fails because access is denied by the Filefield module.

This behaviour can be reproduced by
- setting the download method to "private"
- creating a new node or editing an existing node
- adding a new image to this node by means of an image field (and not saving the node yet)
- trying to insert this image into the body of the node by means of the Insert module - PRIOR to saving the node

I'm wondering, is this rather a Filefield issue? Or can Insert do something about it?

#5 filefield_temp_file_access2.patch4.95 KBquicksketch
Members fund testing for the Drupal project. Drupal Association Learn more


nimrarizwan’s picture

Title: Insert + File/Imagefield + Private Downloads does not work with (new) images that are not yet associated to a node » image module 6.x-1.0-beta3/beta5 not on drupal 6.17
Project: Insert » Image
Version: 6.x-1.0-beta4 » 6.x-1.0-beta5
Component: Code » image.module
Assigned: Unassigned » nimrarizwan
Category: bug » feature
Priority: Minor » Normal

im having a problem with image gallery and im a new user of drupal im not sure about wat image modules will work for me the best, im trying to make image galleries n meanwhile i want to edit images as well i already tried 6.x-1.0-beta3/beta5 in Administer » Site building » modules its showing

Image Attach 6.x-1.0-beta5 Allows easy attaching of image nodes to other content types.
Depends on: Image (missing)
Image Gallery 6.x-1.0-beta5 Allows sorting and displaying of image galleries based on categories.
Depends on: Image (missing), Taxonomy (enabled)
Image Import 6.x-1.0-beta5 Allows batches of images to be imported from a directory on the server.
Depends on: Image (missing)
ImageMagick Advanced Options 6.x-1.0-beta5 Adds advanced options to the ImageMagick image toolkit.

please guid me through this. recommend the image module tht will work best for me.. thankz

morenstrat’s picture

Title: image module 6.x-1.0-beta3/beta5 not on drupal 6.17 » Insert + File/Imagefield + Private Downloads does not work with (new) images that are not yet associated to a node
Project: Image » Insert
Version: 6.x-1.0-beta5 » 6.x-1.0-beta4
Component: image.module » Code
Assigned: nimrarizwan » Unassigned
Category: feature » bug
Priority: Normal » Minor

Guess that was a mistake... Reverting.

quicksketch’s picture

Title: Insert + File/Imagefield + Private Downloads does not work with (new) images that are not yet associated to a node » File/Imagefield + Private Downloads allow access to (new) images that are not yet associated to a node
Project: Insert » FileField
Version: 6.x-1.0-beta4 » 6.x-3.7

Yes, this is actually a FileField issue, since it's the module denying access to the file. I've reproduced this on the latest versions of FileField/ImageField. The fact that Insert is used to add the HTML isn't actually affecting this issue at all, the same thing happens if you manually type out the HTML.

Edit: fixed typo.

jfhovinne’s picture

First of all, thank you for the great work.

I've exactly the same problem described here, and have spent hours on this :(

The bug also occurs with Imagecache presets, since Imagecache calls the file_download hook from all modules in imagecache_cache_private().
Filefield is the only module which returns -1 from filefield_file_download(), thus Imagecache outputs a '403 Forbidden'.
BTW Anonymous has access to the image (even if the node hasn't been updated), but not uid 1 for instance (who does the upload).

I would put this issue as major, or even critical, since it prevents users to actually see the image they want to insert, so it's quite unusable.

FYI, as a quick and ugly fix, I've temporarily removed the check from imagecache_cache_private().
Yes, I know...

quicksketch’s picture

Status: Active » Fixed
4.95 KB

This patch should fix the problem. It looks like FileField was set up at one time to properly handle these temporary files in new nodes, but when we added more strict access checking to prevent access to unpublished nodes, it broke the normal handling.

This patch essentially checks if the file was uploaded in the user's active session (since only the person creating the new node can see the edit screen of that new node until they save), and grants access directly. Not only does it solve the bug, but it's much faster for this particular situation.

The patch looks big but it's really just an added IF/ELSE statement. I've committed it to CVS and it will be in the 3.8 version.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.