# Add setting to disable hotlinking of large image files

**URL:** https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909
**Category:** Feature
**Created:** [11 Agosto , 2017 21:47 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909 "2017-08-11T21:47:31Z")
**Posts on this page:** 20
**Page:** 2

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [18 Agosto , 2017 18:22 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/21 "2017-08-18T18:22:40Z")

</div>

Hi @vinothkannans hoping its all going well, let us know if you are stuck on anything.

---

<div class="post-metadata">

### Author: ![vinothkannans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vinothkannans/32/86465_2.png) [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [19 Agosto , 2017 12:35 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/22 "2017-08-19T12:35:24Z")

</div>

I tried to overlay broken chain icon on broken pictures. Now browser still returns mixed content warnings. We have to replace original image url with our broken chain image in post raw. So I have idea like below

```plaintext
Lorem Ipsum is simply dummy text of the printing and typesetting industry.
![](http://external-site1.com/some-broken-url.jpg)
Lorem Ipsum has been the industry's standard dummy text ever since the 1500s.
<img src="http://external-site2.com/very-large-image-url.jpg">
When an unknown printer took a galley of type and scrambled it to make a type specimen book.

```

Let assume above is original post raw. Then I think we can replace it like below

```plaintext
Lorem Ipsum is simply dummy text of the printing and typesetting industry.
![](https://meta.discourse.org/broken-image-placeholder.jpg)
Lorem Ipsum has been the industry's standard dummy text ever since the 1500s.
<img src="http://meta.discourse.org/general-placeholder.jpg">
When an unknown printer took a galley of type and scrambled it to make a type specimen book.

<!---
Broken images:
 http://external-site1.com/some-broken-url.jpg

Large images:
 http://external-site2.com/very-large-image-url.jpg
-->

```

Is it ok to add comments like this in post raw?

---

<div class="post-metadata">

### Author: ![vinothkannans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vinothkannans/32/86465_2.png) [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [21 Agosto , 2017 15:38 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/23 "2017-08-21T15:38:29Z")

</div>

bump. just reminding @sam.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [21 Agosto , 2017 15:51 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/24 "2017-08-21T15:51:51Z")

</div>

Yeah I had it bookmarked was about to reply 🙂

Let’s go through the workflow:

Someone adds an image, which somehow renders an image tag into the post, like this:

[![Imgur](https://global.discourse-cdn.com/meta/original/4X/3/8/d/38d3604b2841adf6ee1ac26a6f3eb5c1baa96439.jpeg "Gilded Flicker (Colaptes chrysoides)") ](https://www.flickr.com/photos/donaldsducks/24921627616/)

```plaintext
<img src='//cdck-file-uploads-global.s3.dualstack.us-west-2.amazonaws.com/meta/original/3X/b/5/b52b10868d97bc52fa87e954705d2ff61acbb2d8.jpg' width="695" height="590" title="Gilded Flicker (Colaptes chrysoides)">

```

Our cooked post processor then download the image locally per earlier code.

If there are “problems” it replaces the image with a magic “span” that we can style.

`<span class='broken-image'></span>`

or if image is too big

`<a href='original image' class='large-image'><span></span><a>`

Not following why you need any magic comments here. It can be broken in the post temporarily till the post processor runs.

---

<div class="post-metadata">

### Author: ![vinothkannans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vinothkannans/32/86465_2.png) [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [21 Agosto , 2017 16:36 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/25 "2017-08-21T16:36:28Z")

</div>

Good idea.

Yes it will be broken until post processor. After post process broken image url will removed fully. So the user can’t see it again to correct it. In that point of view I added comments. If it is not necessary we can skip it.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [21 Agosto , 2017 16:39 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/26 "2017-08-21T16:39:49Z")

</div>

> [@vinothkannans](#):
>
> If it is not necessary we can skip it.

I don’t see why end users need to know the url of the broken image, the author can always get to it by looking in the markdown. If we must get all fancy you could make a tooltip or something.

---

<div class="post-metadata">

### Author: ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [21 Agosto , 2017 16:50 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/27 "2017-08-21T16:50:44Z")

</div>

2 Beiträge wurden in ein neues Thema verschoben: [System user replaces wrong URL when it downloads local copy of image](https://meta.discourse.org/t/system-user-replaces-wrong-url-when-it-downloads-local-copy-of-image/68487)

---

<div class="post-metadata">

### Author: ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [21 Agosto , 2017 16:48 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/29 "2017-08-21T16:48:32Z")

</div>

> [@vinothkannans](#):
>
> After post process broken image url will removed fully.

Why? From where is it removed fully?  
It’s still in raw, isn’t it? I guess what @sam is saying is that the span for “too large” or “broken image” should only be in cooked. At least that’s how I’m reading it.

---

<div class="post-metadata">

### Author: ![vinothkannans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vinothkannans/32/86465_2.png) [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [21 Agosto , 2017 16:49 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/30 "2017-08-21T16:49:19Z")

</div>

No. It is markdown comment only. It won’t visible to end users. I thought broken urls going to be replaced in markdown itself (since we are doing like that for other urls). Now no problem since we are going to replace it only on cooked html 👍

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [21 Agosto , 2017 16:50 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/31 "2017-08-21T16:50:10Z")

</div>

Yes this is only the case for cooked html and is only applied via post processor. No mucking with raw please.

---

<div class="post-metadata">

### Author: ![vinothkannans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vinothkannans/32/86465_2.png) [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [21 Agosto , 2017 16:55 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/32 "2017-08-21T16:55:04Z")

</div>

Yes it going to be replaced only in cookied html. I was wrongly understood. Please bear with my understanding level in english 🙂

---

<div class="post-metadata">

### Author: ![Nathan\_Dean](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nathan_dean/32/120260_2.png) [@Nathan\_Dean](https://meta.discourse.org/u/Nathan_Dean)
#### Post date: [21 Agosto , 2017 16:59 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/33 "2017-08-21T16:59:20Z")

</div>

I think there is a use case for keeping an anchor tag of the broken image in the page. Say there is an image that can only be viewed by users who are authenticated on a certain website. When they post it on Discourse, it may throw an error and not display, but we still want to have \<a href that links to the image, even if we don’t embed it in the page.

---

<div class="post-metadata">

### Author: ![vinothkannans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vinothkannans/32/86465_2.png) [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [21 Agosto , 2017 17:03 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/34 "2017-08-21T17:03:04Z")

</div>

May be in that case it is better if you link it instead of embedding the image directly.

---

<div class="post-metadata">

### Author: ![Nathan\_Dean](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/nathan_dean/32/120260_2.png) [@Nathan\_Dean](https://meta.discourse.org/u/Nathan_Dean)
#### Post date: [21 Agosto , 2017 17:26 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/35 "2017-08-21T17:26:58Z")

</div>

Aren’t images automatically embedded if you post the URL?

I pasted an image URL into this post without any other actions.

 ![](https://global.discourse-cdn.com/meta/original/4X/8/e/e/8eec2c6131a1777efdb2fed1f0da9878ac1d0278.jpeg)  
And it appears embedded. Now I post an invalid image URL

[![Imgur](https://global.discourse-cdn.com/meta/original/4X/d/c/9/dc956bbbafa744395f157d9010033bff60ec5422.jpeg "imgur.com") ](https://imgur.com/lRyq8za)

It appears as a link.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [21 Agosto , 2017 18:23 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/36 "2017-08-21T18:23:27Z")

</div>

This is literally covered in the topic of the title, if the image is very large (imagine a 1 gigabyte image) it won’t be downloaded to your local instance.

---

<div class="post-metadata">

### Author: ![vinothkannans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vinothkannans/32/86465_2.png) [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [23 Agosto , 2017 16:52 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/37 "2017-08-23T16:52:46Z")

</div>

Since we not changing the raw post I am unable to store which are the images broken or bigger size.

We are detecting broken & bigger images in `pull_hotlinked_images` job. There we only editing raw post and triggering the cooked `post_processor` job. Currently no way to send list of images should replace with placeholder to cooking process. Even if I try to cook in `pull_hotlinked_images` job itself or try to send list of images to `post_processor` job then again it will become problem when the post is recooked in future.

Can you please guide me to fix this problem?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [23 Agosto , 2017 16:58 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/38 "2017-08-23T16:58:01Z")

</div>

I can live with a 5 minute delay here.

PullHotlinkedImages is guaranteed to run every time after cooked post processor. It queues it.

So just have PullHotlinkedImages edit the “cooked” value direct on the post.

---

<div class="post-metadata">

### Author: ![vinothkannans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vinothkannans/32/86465_2.png) [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [23 Agosto , 2017 17:03 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/39 "2017-08-23T17:03:35Z")

</div>

Great idea. Thank you 👍

---

<div class="post-metadata">

### Author: ![vinothkannans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vinothkannans/32/86465_2.png) [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [30 Agosto , 2017 10:22 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/40 "2017-08-30T10:22:58Z")

</div>

[https://github.com/discourse/discourse/pull/5113](https://github.com/discourse/discourse/pull/5113)

Travis failed for some other reason.

---

<div class="post-metadata">

### Author: ![vinothkannans](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vinothkannans/32/86465_2.png) [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [1 Setembro , 2017 16:13 UTC](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909/41 "2017-09-01T16:13:32Z")

</div>

Now it is merged. Broken and large images will be replaced with placeholders.

[Previous page](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909.md?page=1)

[Next page](https://meta.discourse.org/t/add-setting-to-disable-hotlinking-of-large-image-files/67909.md?page=3)
