# Secure Media Uploads breaks Category Logos

**URL:** <https://meta.discourse.org/t/secure-media-uploads-breaks-category-logos/161693>\
**Category:** Bug\
**Created:** [August 21, 2020, 5:52pm UTC](https://meta.discourse.org/t/secure-media-uploads-breaks-category-logos/161693 "2020-08-21T17:52:08Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![martin](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/martin/32/491371_2.png) [@martin](https://meta.discourse.org/u/martin)\
**Post date:** [August 24, 2020, 6:30am UTC](https://meta.discourse.org/t/secure-media-uploads-breaks-category-logos/161693/5 "2020-08-24T06:30:55Z")

</div>

I think the main issue here is that the `secure_upload_analyse_and_update` is a little heavy-handed when it comes to determining what should and shouldn’t be secure, because the `UploadSecurity` class ([discourse/lib/upload\_security.rb at main · discourse/discourse · GitHub](https://github.com/discourse/discourse/blob/master/lib/upload_security.rb)) checks where these public type of uploads (e.g. avatars, category logos etc.) should be secure or not at upload time, and this `type` is not present when checking again in the rake task.

I have a task tracked internally to improve this by checking all the places an upload can live at the time of this security check but it is a way off, and is part of a larger plan to have upload references stored in a neater way.

Anyway, I have a PR building now to fix this issue by making category logos and backgrounds public types when considering whether they should be secure or not. Once this is merged and you have updated you will just have to re-upload the category images and things should be fine.

[https://github.com/discourse/discourse/pull/10513](https://github.com/discourse/discourse/pull/10513)

---

_[View the full topic](https://meta.discourse.org/t/secure-media-uploads-breaks-category-logos/161693)._