# Media review is bypassed when image\_sizes is empty
**URL:** https://meta.discourse.org/t/media-review-is-bypassed-when-image-sizes-is-empty/408608
**Category:** Bug
**Tags:** uploads, composer, review-queue
**Created:** [July 27, 2026, 1:55pm UTC](https://meta.discourse.org/t/media-review-is-bypassed-when-image-sizes-is-empty/408608 "2026-07-27T13:55:41Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Editor0732](https://meta.discourse.org/u/Editor0732)
#### Post date: [July 27, 2026, 1:55pm UTC](https://meta.discourse.org/t/media-review-is-bypassed-when-image-sizes-is-empty/408608/1 "2026-07-27T13:55:41Z")
This bug is about the `Skip review media groups` setting.
When posting an image from mobile, the image upload succeeds and the post body correctly contains an image reference (for example, ).
However, the subsequent POST /posts request contains:
“image\_sizes”: {}
The server-side media review check only runs when manager.args[:image\_sizes].present?:
```ruby
if manager.args\[:image_sizes\].present? &&
!user.in_any_groups?(SiteSetting.skip_review_media_groups_map)
return :contains_media
end
```
An empty hash is not present? in Ruby, so the post is not identified as containing media and is not sent for review. The skip\_review\_media\_groups check is therefore never reached.
HAR evidence:
- POST /uploads succeeded (2xx).
- The POST /posts payload contains image Markdown in raw.
- The same payload contains “image\_sizes”: {}.
- The post was not queued for review.
The web composer builds image\_sizes from images in the editor preview DOM. This makes media review dependent on client-provided preview metadata, which may be missing on mobile clients
or if the preview image has not loaded.
Expected behavior: A post containing an uploaded/embedded image should enter media review regardless of whether the client sends image dimensions.
Suggested fix:
1. **Server-side media detection from post content** — Determine whether a post contains media by inspecting the `raw` or `cooked` post content (or upload references) on the server, instead of relying solely on the client-supplied `image_sizes` field.
2. **Review all uploaded media files(better than 1)** — Instead of only reviewing media files that appear within a post, directly review **every** media file uploaded by the user. This eliminates the dependency on post-level metadata entirely and ensures no uploaded media bypasses the review queue, regardless of the client or endpoint used.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [July 28, 2026, 4:43am UTC](https://meta.discourse.org/t/media-review-is-bypassed-when-image-sizes-is-empty/408608/2 "2026-07-28T04:43:13Z")
This should fix it 🤗
Thanks for reporting.
>
>
> Detect embedded images and videos from post content when image size metadata is …absent. This prevents untrusted media posts from bypassing the review queue while leaving plain text and emoji unaffected.
2 feels more complicated to me.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [July 28, 2026, 10:00pm UTC](https://meta.discourse.org/t/media-review-is-bypassed-when-image-sizes-is-empty/408608/3 "2026-07-28T22:00:08Z")
This topic was automatically closed after 14 hours. New replies are no longer allowed.