search

Orckestra / C1-CMS-Foundation

C1 CMS Foundation - .NET based, open source and a bundle of joy!
https://c1.orckestra.com/
Other
250 stars 109 forks source link

ImageResizer not working if not logged in (after upgrade to 6.12) #806

Closed MarcoDieleman closed 2 years ago

MarcoDieleman commented 2 years ago

After we've upgraded a website to 6.12 we found out the image resizer doesn't work anymore. Adding ?w=640 or ?mw=640 to image URL's doesn't resize the image.

https://kvadratverosol.didonline.nl/media/efff3c9f-90f0-4ab7-8a83-86e3a7bf35ed/vBBGtw/Images/Pages/bedroom-verocell.jpg?mw=800

MarcoDieleman commented 2 years ago

There has been a breaking change/security feature in C1 CMS 6.11 - image URLs with resizing options how require to have a server generated hash to be added to the URL. It was done in order to protect C1 sites against attacks where a malicious website user can iterate through the set of all possible image sizes, and consequently exhaust the available disk space.

The check is ignored when there's a logged-in user, but otherwise CMS should generate correct URLs.