I'm using the Insert module to allow users to insert images with a specific image style into a page. After upgrading to Drupal 7.20, the images are not stored in the files/styles folders, and the image url returns a 403 (access denied) error. I checked the folder permissions, and they are all set to 777.

  • I also installed the media_flickr module, but I believe my image styles were working after the installation. I could be wrong. Feb 22, 2013 at 4:54

5 Answers 5


It is always recommended to read the release notes of the new release before updating, to make sure that the update doesn't break some of the current features.

The release notes of Drupal 7.20 mentions:

The security fixes in this release change all image derivative URLs generated by Drupal to append a token as a query string. (As an example, links that previously pointed to a URL like http://example.com/sites/default/files/styles/thumbnail/public/field/image/example.png will now point to a URL like http://example.com/sites/default/files/styles/thumbnail/public/field/image/example.png?itok=zD_VaCaD.)

You can add the following line to your settings.php to get the images in the site working:

$conf['image_allow_insecure_derivatives'] = TRUE;

but it would be as good as updating the core and not using the updates ;-)

Some useful links from the page:


From the release notes of Drupal 7.21, the update includes fixes for incompatibilities introduced in the Drupal 7.20 security release only. So, it is recommended to update to the latest version i.e. 7.21 to use the security fixes in version 7.20.

  • 2
    doh! yes, reading the release notes are good. I have a bad habit of just typing 'drush up drupal'. Thank you!!! Feb 22, 2013 at 6:44
  • the patch in #1923554 worked for my issue
    – rémy
    Feb 26, 2013 at 11:14
  • @rémy please see the edit.
    – AjitS
    Mar 8, 2013 at 12:49
  • i dont want to allow insecure derivatives. the weird thing is, when i try to create an image from within an image style, it does give me the url and the security token, but still prints access denied. any ideas?
    – Alex
    Apr 2, 2013 at 10:47
  • 3
    This issue will also persist if anywhere in code you were calling image_style_path() to generate the image path, this needs to be changed to image_style_url() to correctly generate the token. Jun 13, 2013 at 0:24

For what it's worth I also found that somehow my image style directories were no longer set the correct permissions after an upgrade and clear cache.

They root styles/[your style] and styles/[your style]/public should be 755 in order for things to load properly.

Changing them all caused the images to appear properly agaain!


Fix your File system: /admin/config/media/file-system

Here are my settings:

Set up the public system path: sites/default/files

Private file system path is empty.

Temporary directory: /tmp

Default download method (selected) Public local files served by the webserver.


Performing this edit did NOT fix the problem and produced errors:

line 775 of modules/image/image.admin.inc needs a patch...

775> - $preview_file = image_style_path($style['name'], $original_path);
775> + $preview_file = image_style_url($style['name'], $original_path);

(since my reputation is low I can't comment yet under that separate answer)

I've implemented this way back and it fixed a lot of things when that issue first arose:

$conf['image_allow_insecure_derivatives'] = TRUE;

I've also implemented changing all +FollowSymLinks to +SymLinksIfOwnerMatch but still am not able to get image styles previews to work properly.

Next and last option is to change the server-size user permissions, ack. I'll either fix it or break it all.


line 775 of modules/image/image.admin.inc needs a patch...

775> - $preview_file = image_style_path($style['name'], $original_path);
775> + $preview_file = image_style_url($style['name'], $original_path);
  • 4
    Kittens will die if this is used. (Never hack core). Nov 27, 2013 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.