CDN module is not compatible with security fix in Drupal core update 7.20
>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #1926884. --> Reported by: [jonmcl](https://www.drupal.org/user/762238) >>> <p>Drupal version 7.20 has a security fix to the core Image module that is incompatible with the CDN module:</p> <p><a href="http://drupal.org/drupal-7.20-release-notes">http://drupal.org/drupal-7.20-release-notes</a></p> <blockquote><p>In rare cases, this change may alter the way HTTP caches or CDNs handle the images. Sites using HTTP caches or CDNs should examine their configuration and test this release carefully before deploying it to a production site.</p></blockquote> <p>The final image URLs now look like:<br> <code>http://example.com/sites/default/files/styles/style_name/public/example-image.png?itok=YcnYp23B</code></p> <p>I believe the issue is happening in _cdn_html_alter_file_url.<br> I haven't fully examined the regex used in there, but I think the query parameter is match position 5 and not 6, but the module is specifying position 6 for the query parameters. The 'itok' query parameter is removed by the CDN module and then the core Image module refused to make new image style variations for images.</p>
issue