To prevent users from uploading future avatars, you can disable allow uploaded avatars and enable the selectable avatars site setting with a large selection.
I think you may need to upload a replacement placeholder in order for automatic deletion - the user record is still keeping the uploaded avatar image alive even though it’s not in use.
Upload files are named based on the SHA1 of the image content - that may help you to find the backing file?
I have over 7k registered users and only less than 5 users use illegal avatars w/o knowing it, so I don’t want to make it a 0 or 1 problem; I want to solve it case by case rather than stopping all users from using custom avatars.
As you can see these are 2 user avatars, which are memes of a former Chinese president. Again, the CDN provider asked me to delete these files on the server and refresh CDN.
I could see from the link that the users were “baal998” and “lincwee”. According to the code snippet in my last post, the uploaded avatar URL of “lincwee” was /uploads/default/original/2X/5/55512211b1c8969c8038b79840464952cd3eb089.jpeg while for “baal998” it was /uploads/default/original/2X/c/cb2188eaeecc3a648f021fa00da4734bd60ca183.jpg. I then run find /var/discourse/shared/ -name *55512211b1c8969c8038b79840464952cd3eb089* and deleted all files found, it worked for “lincwee”. But no luck on “baal998”, I could still access https://iosre.com/user_avatar/iosre.com/baal998/135/2210_2.png even though there were no more files with the name *cb2188eaeecc3a648f021fa00da4734bd60ca183*.
Or to make it simpler: How does Discourse parse a visit to https://iosre.com/user_avatar/iosre.com/baal998/135/2210_2.png? If someone familiar with the source code can tell me the source file or the class/function, that would be really helpful. Thanks!
Also, start with pulling from your server, not the CDN. You want to be sure that you are solving the problem in the right place. Once you’re sure that the server isn’t sending the images you can work with the CDN.
Yes and you see that it is getting sent by your server. So that’s the link to be trying to fix. After you make that stop sending the images you can clear the CDN
This is the goal that I have no idea how to achieve. As an iOS reverse engineer, my idea is that if I know in the source code how/where the server sends this image, I can track back and see where the server loads this image locally. But I read Ruby like reading seudo code, so locating where the server sends this image becomes a great great task for me That should be a lot easier for a person who’re familiar with the source code though
I saw the table uploads which stored all the uploads of a user. For user Baal998 whose user ID is 1637, I then run SELECT * FROM uploads WHERE user_id = '1637'; and the result is
Which is the same to running Upload.find(user_avatar.custom_upload_id).url with rails.
My guess is that after the user uploaded avatar, discourse will do something to the original avatar file and store the optimized files in somewhere else?
root@iosre:/var/discourse/shared/standalone# ls /uploads/default/optimized/2X/c/cb2188eaeecc3a648f021fa00da4734bd60ca183_2_135x135.jpg
ls: cannot access /uploads/default/optimized/2X/c/cb2188eaeecc3a648f021fa00da4734bd60ca183_2_135x135.jpg: No such file or directory
Someone from my forum told me that this avatar image might be stored in nginx cache under proxy_cache_path, which was usually /var/nginx/cache, but I couldn’t find either proxy_cache_path or /var/nginx/cache.
I was inspired by him that I entered the discourse app via launcher enter app and then found nginx cache:
root@iosre:/var/discourse/shared# /var/discourse/launcher enter app
WARNING: Docker version 17.05.0-ce deprecated, recommend upgrade to 17.06.2 or newer.
root@iosre-app:/var/www/discourse# cd /var/nginx/cache
root@iosre-app:/var/nginx/cache# ls
0 1 2 3 4 5 6 7 8 9 a b c d e f
root@iosre-app:/var/nginx/cache#
And deleted all the caches:
root@iosre-app:/var/nginx/cache# ls
root@iosre-app:/var/nginx/cache#