5

I'm getting a problem with image styles being created. The files are there but the styles are not getting created. I have tried changing permissions recursively on the folder (udo chmod -R 777 /Applications/MAMP/htdocs/geoslate/sites/default/files/)but this isn't solving it. I've tried deleting the styles folder but it doesn't get recreated. There is an error in the log:

access denied
Date    Wednesday, May 1, 2013 - 11:03
User    admin
Location    http://localhost:8888/geoslate/sites/default/files/styles/thumbnail/public/image-file-name-325x250.jpg?itok=zPXsGtyX
Referrer    http://localhost:8888/geoslate/node/1
Message sites/default/files/styles/thumbnail/publicimage-file-name-325x250.jpg
Severity    warning
Improve this question
4
  • Are you using Drupal 7.20?
    – 4life
    Commented May 1, 2013 at 11:18
  • Yes. I am using Drupal 7.20.
    – Andrew Welch
    Commented May 1, 2013 at 11:20
  • 1
    Never 777. Are you using image module API to generate the URL? since drupal 7.21, direct references to image styles will not work to prevent ddos.
    – AKS
    Commented May 1, 2013 at 11:36
  • maybe permission issue, who is the folder user:group?
    – khaled_webdev
    Commented Oct 2, 2015 at 8:41

2 Answers 2

Reset to default
6

It is either you update your Drupal core to the latest version or you You can add the following line to your settings.php to get the images in the site working:

$conf['image_allow_insecure_derivatives'] = TRUE;
Improve this answer
1
  • 1
    actually it will be the contributed modules that are creating the links to the style that need updating (to use the image module's API so they can generate allowed links). In my case it was the Galleria module creating links to image styles that did not use the new API. When your affected contrib module gets updated to use the new API, you can then safely remove this setting again from your settings.php. This change was made to core in order to stop anonymous users DOS'ing your site by requesting image derivates over and over again.
    – Professor Falken
    Commented May 21, 2013 at 17:32
5

Take care with this configuration:

$conf['image_allow_insecure_derivatives'] = TRUE;

The main purpose of the 7.20 release is to prevent a denial of service security issue. With this setting turned on, you site is still vulnerable.

If you want to keep this configuration I strongly recommend you to upgrade, at least, 7.21. The purpose of this release is to allow sites using this variable to have a partial protection.

I'm not sure if this should be a answer, but I don't have enough reputation to post a comment yet.

Improve this answer
1
  • You are absolutely correct here—the purpose of the update was to mitigate DOS attacks. Even apart from Drupal, many Web hosts have been going this route to avoid broken sites.
    – karolus
    Commented Nov 12, 2018 at 22:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.