When i try to uploade a image with a user that is not a admin or moderator i get the success : “OK” insted of the image url. Hobe some one can help with a answer. $.ajax({ url: "/uploads.json", type: "post", data: formData, processData: false, contentType: false, headers: { 'X-CSRF-Token': getCsrftoken() }, success: function (data) {}, error: function (XMLHttpRequest, textStatus, errorThrown) {} });

Sure, @techapj will take a look and get back to you

Hi Kenneth, I am not understanding what is the issue here. I just verified that image upload works fine for both staff and non-staff users.

Hi I am using the api with the synchronous true parameter to get the image url back with the responce. But this only works with admin and moderators and i cant find out why. admin formdata send ------WebKitFormBoundary6ez66C4lWix1aPev Content-Disposition: form-data; name="username" kenneth ------WebKitFormBoundary6ez66C4lWix1aPev Content-Disposition: form-data; name="type" image/jpeg ------WebKitFormBoundary6ez66C4lWix1aPev Content-Disposition: form-data; name="file"; filename="Ballocity4.jpg" Content-Type: image/jpeg ------WebKitFormBoundary6ez66C4lWix1aPev Content-Disposition: form-data; name="synchronous" true ------WebKitFormBoundary6ez66C4lWix1aPev-- normal user ------WebKitFormBoundary1ntANOhhef17w01u Content-Disposition: form-data; name="username" Kenneth_Jakobsen ------WebKitFormBoundary1ntANOhhef17w01u Content-Disposition: form-data; name="type" image/jpeg ------WebKitFormBoundary1ntANOhhef17w01u Content-Disposition: form-data; name="file"; filename="8589655248_7fe6db1efc_b.jpg" Content-Type: image/jpeg ------WebKitFormBoundary1ntANOhhef17w01u Content-Disposition: form-data; name="synchronous" true ------WebKitFormBoundary1ntANOhhef17w01u-- Admin is working but not the normal one.

Can you explain what you’re doing exactly? Why/how are you uploading images with “synchronous=true”?

Im creating a new editor for the company pleasecreate and are using the file upload api with the synchronous true parameter. When the image is uploaded i use the url from the response data in the post. The problem is that when a user that is not admin or moderator upload a image the response data only contains {“success”:“OK”}. and not the url. The code working for admin and moderators is shown below. post request $.ajax({ url: "/uploads.json", type: "post", data: formData, processData: false, contentType: false, headers: { 'X-CSRF-Token': getCsrftoken() }, success: function (data) { var image = " "; }, error: function (XMLHttpRequest, textStatus, errorThrown) {} }); formdata ------WebKitFormBoundary6ez66C4lWix1aPev Content-Disposition: form-data; name="username" kenneth ------WebKitFormBoundary6ez66C4lWix1aPev Content-Disposition: form-data; name="type" image/jpeg ------WebKitFormBoundary6ez66C4lWix1aPev Content-Disposition: form-data; name="file"; filename="Ballocity4.jpg" Content-Type: image/jpeg ------WebKitFormBoundary6ez66C4lWix1aPev Content-Disposition: form-data; name="synchronous" true ------WebKitFormBoundary6ez66C4lWix1aPev--

[תמונה] techAPJ: I just verified that image upload works fine for both staff and non-staff users. There is an explicit check in the code for staff users with regard to synchronous uploads. I don’t know why this is done but this is clearly the cause. Why is the synchronous upload limited to staff users or API usage? app/controllers/uploads_controller.rb main # frozen_string_literal: true require "mini_mime" class UploadsController < ApplicationController include ExternalUploadHelpers include SecureUploadEndpointHelpers requires_login except: %i[show show_short _show_secure_deprecated show_secure] skip_before_action :preload_json, :check_xhr, :redirect_to_login_if_required, :redirect_to_profile_if_required, only: %i[show show_short _show_secure_deprecated show_secure] protect_from_forgery except: :show before_action :is_asset_path, :apply_cdn_headers, only: %i[show show_short _show_secure_deprecated show_secure]

[תמונה] RGJ: Why is the synchronous upload limited to staff users or API usage? Its a security concern opening this up any wider, it would make it trivial exhaust unicorn workers really fast we opened this up.

[תמונה] RGJ: Why is the synchronous upload limited to staff users or API usage? Since we might do a CPU-intensive process when images are uploaded, we have to ensure users don’t DDoS the instance by uploading lots of very large images. Initially, synchronous mode was only available via the API. @eviltrout recently allowed staff members too when he added the wizard. (ninja’d)

Image upload with synchronous true for new users

Product Support

Kenneth85 (Kenneth L. Jakobsen) 17 בנובמבר,‏ 2016,‏ 7:38am 10

hi thanks for the clarification and answer

נושא		תגובות	צפיות
How to get uploaded image url using the Discourse API? Development rest-api	28	12292	7 בדצמבר,‏ 2017
Cannot upload a file through the API with the synchronous parameter Development rest-api	5	2088	6 בינואר,‏ 2017
How to post pictures via API? Development	11	769	5 ביולי,‏ 2024
How to upload image using Discourse API Development rest-api	5	2725	28 באוגוסט,‏ 2024
Upload avatar image with API Development rest-api	13	7507	12 באוגוסט,‏ 2020

Image upload with synchronous true for new users

נושאים קשורים