>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #528682. --> Reported by: [mfer](https://www.drupal.org/user/25701) >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>Currently, images are only allowed on drupal.org to users with the "documentation team" role or higher (a role that is manually assigned). This creates the following problems:</p> <ol> <li>The masses not having images cripples our collaboration opportunities. We block participation of designers to play "Photoshop ping-pong", new members of our community adding helpful screenshots to our documentation, users are prevented from posting screenshots of errors they're experiencing, and module developers can't add screenshots to their own documentation.</li> <li>Our documentation has a reputation for generally looking like ass, because only a handful of people can put pictures in it. And once they do put pictures in it, only a very small group of people can edit it. Yet another lost collaboration opportunity.</li> <li>Because the "documentation team" role grants access to a "Documentation" input format with &lt;img&gt; turned on, membership in that role is almost entirely bogus. It's overloaded with people who do absolutely nothing on the docs team, but needed to post a screenshot somewhere at some point. This is problematic for the docs team in figuring out who's who. </li> </ol> <p>Opening image posting up more has traditionally been opposed by the security and infrastructure teams, because:</p> <ol> <li>We want to switch Drupal.org to HTTPS at some point soon, and we don't want to deal with mixed content errors.</li> <li>Not-nice people can spy on drupal.org visitors by linking to remote images on their servers.</li> <li>People can upload not-nice images, such as porn.</li> </ol> <p>Luckily, sun has worked out a solution for #1 and #2 (and we always have users.status = 0 for #3).</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>The <a href="http://drupal.org/project/filter_html_image_secure">Local image input filter module</a>, which provides an input filter to munge img srcs to ensure that images are only rendered if they point to a locally hosted image. See <a href="http://drupal.org/node/528682#comment-4968978">http://drupal.org/node/528682#comment-4968978</a> for the full "spec" we came up with in IRC.</p> <p>Here's a screenshot of it in action:</p> <p><img src="https://img.skitch.com/20110910-mpbuwn43fdcrw195kp28p9k3ks.png" alt="Only images that have relative paths are shown; the rest are red Xs."></p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <p> Mainly what we need now are <strong>code reviews and testing</strong>. There is a test site set up at:</p> <p><a href="http://issue-summaries-drupal.redesign.devdrupal.org">http://issue-summaries-drupal.redesign.devdrupal.org</a><br> Apache user/pass: drupal/drupal<br> Drupal user/pass: bananas/bananas</p> <p>Specifically:</p> <ul> <li><del>We need all kinds of scenarios of image posting to be tested, <strong>especially nefarious things</strong>. We are having a lot of fun with this at <a href="http://issue-summaries-drupal.redesign.devdrupal.org/node/1237686">http://issue-summaries-drupal.redesign.devdrupal.org/node/1237686</a> ;)</del></li> <li><del>Security team sign-off of Local image input filter module.</del> Done! <a href="http://drupal.org/node/1281194#comment-5037238">http://drupal.org/node/1281194#comment-5037238</a></li> <li><del>The following patches need to be reviewed on the Local image input filter module: <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/filter_html_image_secure/issues/1274838" title="Status: Closed (fixed)">#1274838: Prevent logout CSRF, rip host, allow any image inside this Drupal</a></span> <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/filter_html_image_secure/issues/1274888" title="Status: Closed (fixed)">#1274888: Add filter tip to explain what's happening with images</a></span> </del></li> <li><del>The one-line patch against Drupal.org module at <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/drupalorg/-/work_items/1274938" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/drupalorg/-/work_items/1274938</a></span> needs to be reviewed.</del></li> <li><del>Need resolution of what to do about big images that break layout. See <a href="https://www.drupal.org#comment-5030496">#65</a></del> For now, we're punting on this. If it becomes a problem in the future, will need a server-side solution to it (e.g. imagecache)</li> <li><del>Roll a 1.0 release of <a href="http://drupal.org/project/filter_html_image_secure:">http://drupal.org/project/filter_html_image_secure:</a> <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/filter_html_image_secure/issues/1281194" title="Status: Closed (fixed)">#1281194: Roll a 1.0 release of this module</a></span></del></li> </ul> <h3 id="summary-deployment">Deployment steps</h3> <ol> <li>Add <a href="https://www.drupal.org/project/filter_html_image_secure">Local image input filter</a> module to BZR.</li> <li>Commit and deploy the patch in <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/drupalorg/-/work_items/1274938" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/drupalorg/-/work_items/1274938</a></span> against the Drupal.org customizations project.</li> <li>Enable the Local image input filter module.</li> <li>Go to admin/settings/filters/1 and turn on the "Restrict images to this site" filter.</li> <li>Go to admin/settings/filters/1/order and move "Restrict images to this site" just above "HTML corrector"</li> <li>Go to admin/settings/filters/1/configure and add &lt;img&gt; to the list of allowed tags.</li> <li>Go to admin/project/project-issue-settings and blank out the field for "Issue directory".</li> <li>Sing, dance, and rejoice! :D</li> </ol> <h3 id="summary-ui-changes">User interface changes</h3> <ul> <li>Images that are referenced by the input format without a local, relative path, would turn into red Xs.</li> <li>Book nodes would un-hide the "File attachments" fieldset on the add/edit form.</li> <li>A new filter tip would appear in the "Input format" fieldset, describing this filter.</li> </ul> <h3 id="summary-api-changes">API changes</h3> <p>None. </p> <h3 id="summary-original-report">Original report by mfer</h3> <p>Users can upload images to a comment on a issue. But, they aren't displayed. You need to be a site admin or on the documentation team to add the html to the body of the comment for it to display. This isn't a great workflow and you have to rely on the person inputting the image to be concerned with size, etc.</p> <p>In an effort to work with design/UX people who do upload images and work visually can we get a different workflow that's better for images.</p> <p>Here is what I envision.</p> <ul> <li>A new upload field on issues and comments for images (gif, jpg, png).</li> <li>These images are displayed as thumbnail at the bottom of the issue/comment.</li> <li>When clicked the images are displayed in a modal/pop-up.</li> </ul> <p>Thoughts?</p>