"Far Future expiration" setting is incompatible with image style tokens (security fix in Drupal core update 7.20)
>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #2407287. --> Reported by: [das-peter](https://www.drupal.org/user/762870) >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>This is basically an follow-up to <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/cdn/-/work_items/1926884" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/cdn/-/work_items/1926884</a></span>.<br> It looks like the farfuture option doesn't properly work with image style tokens in <code>_cdn_basic_farfuture_generate_file()</code>.<br> The url's generated and called by that function won't contain the image style token and thus the idea of having a loop to ensure a file is available / generated doesn't work out anymore.</p> <p>This presents in the watchdog log as numerous errors of the type <b>cdn: Nested HTTP request to generate</b></p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Use the limited information we have about to url to figure out if it is an image style token is needed. If so generate the token and add it to the url before making the request.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <p>Not yet tested with private files. But I assume it should work since the stream wrappers are handled dynamically.</p> <h3 id="summary-ui-changes">User interface changes</h3> <p>None.</p> <h3 id="summary-api-changes">API changes</h3> <p><code>_cdn_basic_farfuture_generate_file()</code> has new parameter as we need the orignal url with the stream wrapper prefix.</p>
issue