We had this same issue on a client site, there were actually quite a few elements at play, and I can offer a probably explanation as to how the non-existent image issue was trigged, even though it seemingly should not be possible:
The issue as described above was present, whereby Magento was checking for media/wysiwyg/.thumbs/image.jpg
, as opposed to the correct location of media/wysiwyg/.thumbs/wysiwyg/image.jpg
, and if present displaying a link to the incorrect URL of http://example.com/media//wysiwyg/.thumbs/image.jpg
fd
We had APPSEC-212 installed, which introduced the use of realpath()
to remove a security issue, however the combination of this and the usage of a symlink on our media
directory was causing Mage_Cms_Model_Wysiwyg_Images_Storage::getThumbsPath()
to return a directory of media/wysiwyg/.thumbs
, as opposed to media/wysiwyg/.thumbs/wysiwyg
- the reason is because this method makes a conditional check which did not evaluate to true, as our media directory had been expanded via realpath()
and as such did not return 0 for the strpos()
check, see the check below, line 6:
public function getThumbsPath($filePath = false)
{
$mediaRootDir = Mage::getConfig()->getOptions()->getMediaDir();
$thumbnailDir = $this->getThumbnailRoot();
if ($filePath && strpos($filePath, $mediaRootDir) === 0) {
$thumbnailDir .= DS . dirname(substr($filePath, strlen($mediaRootDir)));
}
return $thumbnailDir;
}
This is unique to us, but we were also denying access to dotfile directories, and had not previously noticed this as a problem because we had never served them until we installed APPSEC-212, so even when we fixed the problem we were getting 404's on anything in .thumbs
The problem we have experienced still exists in 1.9.1.0 (the latest version at the time of writing) - I'm going to assume no-one notices because the images still serve 'on the fly' without using the .thumbs
directory, it was only with the introduction of APPSEC-212, combined with a symlinked media
directory, that caused the thumb files to be generated in the incorrect location, which then caused the incorrectly checked path to return true, and for us to subsequently see 404's on our images.
Funnily enough, APPSEC-212 would have fixed the issue if it weren't for our symlinked media
directory.
By the way, here are our modifications:
In app/code/core/Mage/Cms/Helper/Wysiwyg/Images.php:
@@ -89,7 +89,7 @@ public function getStorageRoot()
*/
public function getBaseUrl()
{
- return Mage::getBaseUrl('media') . '/';
+ return Mage::getBaseUrl('media') . '/' . Mage_Cms_Model_Wysiwyg_Config::IMAGE_DIRECTORY . '/';
}
/**
In app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php:
@@ -336,7 +336,7 @@ public function getThumbnailUrl($filePath, $checkFile = false)
$mediaRootDir = $this->getHelper()->getStorageRoot();
if (strpos($filePath, $mediaRootDir) === 0) {
- $thumbSuffix = self::THUMBS_DIRECTORY_NAME . DS . substr($filePath, strlen($mediaRootDir));
+ $thumbSuffix = self::THUMBS_DIRECTORY_NAME . DS . substr($filePath, strlen(realpath(Mage::getConfig()->getOptions()->getMediaDir())));
if (! $checkFile || is_readable($mediaRootDir . $thumbSuffix)) {
$randomIndex = '?rand=' . time();
@@ -405,8 +405,8 @@ public function resizeOnTheFly($filename)
*/
public function getThumbsPath($filePath = false)
{
- $mediaRootDir = Mage::getConfig()->getOptions()->getMediaDir();
- $thumbnailDir = $this->getThumbnailRoot();
+ $mediaRootDir = realpath(Mage::getConfig()->getOptions()->getMediaDir());
+ $thumbnailDir = realpath($this->getThumbnailRoot());
if ($filePath && strpos($filePath, $mediaRootDir) === 0) {
$thumbnailDir .= DS . dirname(substr($filePath, strlen($mediaRootDir)));