re: imagefield / imagecache
'imagefield'[1] is its own project. If you've been experimenting with cck and imagefield, please post issues to the 'imagefield' project. I'm going to keep it on its own until JonBob comes back and includes it in the mainline cck. imagefield requires the cvs HEAD version of cck. 'imagecache'[2] is a dynamic image resizer and caching tool. I use it with imagefield for thumbnail generation so I don't have to track data about derivative media in the database. I generate and trash as needed. It requires .htaccess and clean urls to function properly. The current cvs version is free of the DOS exploit in the prior version and allows multiple actions to be performed to create a derivative image. Only scale and resize are implemented. I'd appreciate feedback/patches/bugs if you play. *note: recent security fixes seems to have broken the preview feature in 'imagefield' when using clean urls. To enable previews, in the .htaccess in your files directory, comment out RewriteEngine Off, and add +FollowSymlinks to the Options line. ciao. .darrel. Footnotes: [1] imagefield: http://drupal.org/project/imagefield [2] imagecache: http://drupal.org/project/imagecache
*note: recent security fixes seems to have broken the preview feature in 'imagefield' when using clean urls. To enable previews, in the .htaccess in your files directory, comment out RewriteEngine Off, and add +FollowSymlinks to the Options line.
if possible, please elaborate on the security implications of this.
On Fri, 2006-07-07 at 10:04 -0400, Moshe Weitzman wrote:
*note: recent security fixes seems to have broken the preview feature in 'imagefield' when using clean urls. To enable previews, in the .htaccess in your files directory, comment out RewriteEngine Off, and add +FollowSymlinks to the Options line.
if possible, please elaborate on the security implications of this.
I'm not sure of the security implications. I can't see how turning off rewrite rules for that folder, or setting options to None has any impact on the file/mime mapping problems that were occurring. I think with the handler alone you're still covered, and the rewrite and Options line were added salt for good measure. Someone on the sec team correct me if I am wrong.
participants (2)
-
Darrel O'Pry -
Moshe Weitzman