Media review is bypassed when image_sizes is empty

Contribute Bug
, ,
1

This bug is about the Skip review media groups setting.
When posting an image from mobile, the image upload succeeds and the post body correctly contains an image reference (for example, ...).

However, the subsequent POST /posts request contains:

“image_sizes”: {}

The server-side media review check only runs when manager.args[:image_sizes].present?:

if manager.args\[:image_sizes\].present? &&
       !user.in_any_groups?(SiteSetting.skip_review_media_groups_map)
    return :contains_media
  end

An empty hash is not present? in Ruby, so the post is not identified as containing media and is not sent for review. The skip_review_media_groups check is therefore never reached.

HAR evidence:

  • POST /uploads succeeded (2xx).
  • The POST /posts payload contains image Markdown in raw.
  • The same payload contains “image_sizes”: {}.
  • The post was not queued for review.

The web composer builds image_sizes from images in the editor preview DOM. This makes media review dependent on client-provided preview metadata, which may be missing on mobile clients
or if the preview image has not loaded.

Expected behavior: A post containing an uploaded/embedded image should enter media review regardless of whether the client sends image dimensions.

Suggested fix:

  1. Server-side media detection from post content — Determine whether a post contains media by inspecting the raw or cooked post content (or upload references) on the server, instead of relying solely on the client-supplied image_sizes field.

  2. Review all uploaded media files(better than 1) — Instead of only reviewing media files that appear within a post, directly review every media file uploaded by the user. This eliminates the dependency on post-level metadata entirely and ensures no uploaded media bypasses the review queue, regardless of the client or endpoint used.