Image upload with synchronous true for new users

support
1

When i try to uploade a image with a user that is not a admin or moderator i get the success : “OK” insted of the image url. Hobe some one can help with a answer.

$.ajax({
    url: "/uploads.json",
    type: "post",
    data: formData,
    processData: false,
    contentType: false,
    headers: {
         'X-CSRF-Token': getCsrftoken()
   },
   success: function (data) {},
   error: function (XMLHttpRequest, textStatus, errorThrown) {}
});
1 Like
2

Sure, @techapj will take a look and get back to you

3

Hi Kenneth,

I am not understanding what is the issue here.

I just verified that image upload works fine for both staff and non-staff users.

4

Hi
I am using the api with the synchronous true parameter to get the image url back with the responce. But this only works with admin and moderators and i cant find out why.

admin formdata send

    ------WebKitFormBoundary6ez66C4lWix1aPev
Content-Disposition: form-data; name="username"

kenneth
------WebKitFormBoundary6ez66C4lWix1aPev
Content-Disposition: form-data; name="type"

image/jpeg
------WebKitFormBoundary6ez66C4lWix1aPev
Content-Disposition: form-data; name="file"; filename="Ballocity4.jpg"
Content-Type: image/jpeg


------WebKitFormBoundary6ez66C4lWix1aPev
Content-Disposition: form-data; name="synchronous"

true
------WebKitFormBoundary6ez66C4lWix1aPev--

normal user

------WebKitFormBoundary1ntANOhhef17w01u
Content-Disposition: form-data; name="username"

Kenneth_Jakobsen
------WebKitFormBoundary1ntANOhhef17w01u
Content-Disposition: form-data; name="type"

image/jpeg
------WebKitFormBoundary1ntANOhhef17w01u
Content-Disposition: form-data; name="file"; filename="8589655248_7fe6db1efc_b.jpg"
Content-Type: image/jpeg


------WebKitFormBoundary1ntANOhhef17w01u
Content-Disposition: form-data; name="synchronous"

true
------WebKitFormBoundary1ntANOhhef17w01u--

Admin is working but not the normal one.

5

Can you explain what you’re doing exactly? Why/how are you uploading images with “synchronous=true”?

1 Like
6

Im creating a new editor for the company pleasecreate and are using the file upload api with the synchronous true parameter. When the image is uploaded i use the url from the response data in the post. The problem is that when a user that is not admin or moderator upload a image the response data only contains {“success”:“OK”}. and not the url. The code working for admin and moderators is shown below.

post request

$.ajax({
        url: "/uploads.json",
        type: "post",
        data: formData,
        processData: false,
        contentType: false,
        headers: {
             'X-CSRF-Token': getCsrftoken()
       },
       success: function (data) {
             var image = "<img src='" + data.url + "' width='" + data.width + "' height='" + data.height + "'/>";
       },
       error: function (XMLHttpRequest, textStatus, errorThrown) {}
    });

formdata

------WebKitFormBoundary6ez66C4lWix1aPev
Content-Disposition: form-data; name="username"

kenneth
------WebKitFormBoundary6ez66C4lWix1aPev
Content-Disposition: form-data; name="type"

image/jpeg
------WebKitFormBoundary6ez66C4lWix1aPev
Content-Disposition: form-data; name="file"; filename="Ballocity4.jpg"
Content-Type: image/jpeg


------WebKitFormBoundary6ez66C4lWix1aPev
Content-Disposition: form-data; name="synchronous"

true
------WebKitFormBoundary6ez66C4lWix1aPev--
7

There is an explicit check in the code for staff users with regard to synchronous uploads. I don’t know why this is done but this is clearly the cause.
Why is the synchronous upload limited to staff users or API usage?

https://github.com/discourse/discourse/blob/master/app/controllers/uploads_controller.rb#L10

3 Likes
8

Its a security concern opening this up any wider, it would make it trivial exhaust unicorn workers really fast we opened this up.

6 Likes
9

Since we might do a CPU-intensive process when images are uploaded, we have to ensure users don’t DDoS the instance by uploading lots of very large images.

Initially, synchronous mode was only available via the API. @eviltrout recently allowed staff members too when he added the wizard.

(ninja’d)

6 Likes
10

hi thanks for the clarification and answer