Image disappears from Page Description when page shared to other users

[Teresa Brady]

- exact version of Mahara: 1.4.2 & 1.5 (demo.mahara.org)
- operating system: Windows for the 1.4.2 version (I think)
- database: MySQL (I think)
- Chrome 20, IE8 & 9, FireFox 13, Safari 5

If an image is inserted into a Page Description (for example, as a decorative heading or title) and then that page is shared by Secret URL, the image disappears.

Any other images, such as those inserted as an image block and those inserted inline within a text box, appear without issue.

I have tested this in our installation of Mahara (1.4.2) and the demo.mahara.org version. The screen capture is taken from when I tested the demo.mahara.org version. In our version we get identical results, where the Page Description image disappears.

Addendum: if the images are hosted externally, e.g. at Flickr, they actually do appear in the Page Description area! It might take a few seconds for the image to load, though.

[Kristina Hoeppner (kris-hoeppner)]

Hello Teresa,

Thank you very much for your detailed bug report and also testing it on demo.mahara.org where we have access to as well. That was excellent work and helps us in general to get to the root of the problem being able to rule out an issue on your particular instance.

This is a permissions issue if I am not mistaken (a developer can correct me if necessary). The images in the blocks appear for users viewing the page via the Secret URL because they were inserted into the page as true artefacts via blocks.

External images are also displayed because they are freely accessible via the URL.

However, the Mahara permissions system cannot read the internal URL of the image you put into the descriptions text box as it just sees it as any URLs and thus cannot see it as an internal artefact. Internal artefacts are correctly put into pages via blocks, which aren't available for the description.

You can see the image in the description because it is your page. If you share the page with logged-in users, they can also see the image in the description, but anyone who doesn't have a login cannot see it. I can't say right now if that was intended that way or not as I can't read program code.

Hope that helps until a developer can provide more insight.

Cheers
Kristina

[Teresa Brady (tess-brady)]

This still occurs in Mahara 1.6 at http://demo.mahara.org/.
Please see attached image.

[Teresa Brady (tess-brady)]

This still occurs in Mahara 1.7.1.
Please see attached document.

[Robert Lyon (robertl-9)]

I wonder if this still is a problem in v1.8. I know there was the tightening up of restrictions regarding access to artefacts.

What sort of image urls are you adding to the description field?
Are they like this: http://mahara-testing/artefact/file/download.php?file=79

From my initial test with 1.8 I can see the image in description if I am the user who added it - but I can't see it if I am another user with access to the page. This is because the description field is not designed to have internal to Mahara artefacts like images added there.

Now that Mahara 1.8 has flexible layouts there is probably a greatly reduced need for page descriptions to contain images (or even have descriptions displayed on page at all) as you can have a multiple rows of columns. So you can have a full width row for row one before getting to the various other rows/columns.

What might be needed instead is to have the ability for an image or textbox to have no header bar on page view allowing them to mimic what the description field does currently but in a better way.

[Son Nguyen (ngson2000)]

This issue also happens in mahara 1.9, 1.10, and master.

When a page is shared to other users, the images in the page description disappear as well.

I'd change the priority to high as it was reported ages ago.

[Mahara Bot (dev-mahara)]

Patch for "master" branch: https://reviews.mahara.org/4124

[Ghada El-Zoghbi (ghada-z)]

Hi Son,

I'm also getting this issue on master (15.04). There are 2 scenarios:

1. /artefact/file/download.php

A file is embedded in any artefact that can have an image embedded (i.e. 'comment', 'blog', 'textbox', 'editnote', 'text').

We need to check EmbeddedImage::can_see_embedded_image() when embedded = 1 and the file is instanceof ArtefactTypeImage.

The code in download.php checks this but only for resume elements and groups.

It also needs to check:
- when 'view' is specified
- when view is not specified and is still not visible after all those other checks.

2. When an artefact/block is deleted from a view, it uses:

EmbeddedImage::delete_embedded_images()

which deletes based on the fileid.

So, if the fileid is used in more than one place by the user, it will delete all records in the 'artefact_file_embedded' table.

It should delete based on the resourceid.

I'm not sure what the original business case was for using fileid. We'll need to investigate further and see where it's required by fileid.

I hope this makes sense.

Thanks,
Ghada

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/4124
Committed: http://gitorious.org/mahara/mahara/commit/77527e58a0519816e687aa1c6e17ddc6b47adc1b
Submitter: Robert Lyon (<email address hidden>)
Branch: master

commit 77527e58a0519816e687aa1c6e17ddc6b47adc1b
Author: Son Nguyen <email address hidden>
Date: Wed Jan 7 08:02:40 2015 +1300

Enable embedded images in view description. Bug 1045138

- Add new resourcetype 'description' for the view
description
- Display embedded images in view description
- Update embedded image urls when copy and export/import view

Change-Id: I8088be317ddb1659de2d091a2940bea6665e4af0
Signed-off-by: Son Nguyen <email address hidden>

[Mahara Bot (dev-mahara)]

Patch for "15.04_STABLE" branch: https://reviews.mahara.org/4558

[Robert Lyon (robertl-9)]

As this is not a security bug - nor does it merge nicely - we won't back port it to the earlier versions

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/4558
Committed: http://gitorious.org/mahara/mahara/commit/8161c213a02cd0cc7a332a80b26f2556a01515f9
Submitter: Robert Lyon (<email address hidden>)
Branch: 15.04_STABLE

commit 8161c213a02cd0cc7a332a80b26f2556a01515f9
Author: Son Nguyen <email address hidden>
Date: Wed Jan 7 08:02:40 2015 +1300

Enable embedded images in view description. Bug 1045138

- Add new resourcetype 'description' for the view
description
- Display embedded images in view description
- Update embedded image urls when copy and export/import view

Change-Id: I8088be317ddb1659de2d091a2940bea6665e4af0
Signed-off-by: Son Nguyen <email address hidden>