golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(cabana): serve public image thumbnails on the admin thumb routes

Browse Source 
The record and relation-child thumb routes now also serve the thumbnail
of a public JPEG, PNG, GIF or WebP file, under the same record or
pending-session scope and D-10 headers as a protected one, so the admin
can preview a public image whose public URL does not load. The download
routes still answer 404 for every public file, and a public non-image
thumb stays 404.

TestPublicImageThumb covers owner, foreign and hidden records, image
types, a public row under a protected field, another admin's pending
upload and the relation-child route.
This commit is contained in:
Jakub Zych
2026-10-20 01:05:42 +02:00
parent 5978998ea6
commit e4302bf60b
7 changed files with 128 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
admin/openapi/admin.json
View File

@@ -7252,7 +7252,7 @@
},
"/{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}/thumb": {
"get": {
"description": "The preview thumbnail (imageWidth by imageHeight, 240 by 240 by default, in thumbOptions.mode) of a protected image file, scoped like the download route. A file that is not a JPEG, PNG, GIF or WebP image is 404.",
"description": "The preview thumbnail (imageWidth by imageHeight, 240 by 240 by default, in thumbOptions.mode) of a JPEG, PNG, GIF or WebP file of the field, protected or public, scoped like the download route (a record the admin may load, or an upload pending in the admin's own session) and sent with the download route's headers. The admin SPA uses it for protected images and for a public image whose public URL does not load. Any other file type is 404.",
"parameters": [
{
"description": "Vendor",
@@ -7375,7 +7375,7 @@
"BackendBearer": []
}
],
"summary": "Thumbnail of a protected image",
"summary": "Thumbnail of an image file",
"tags": [
"admin"
]
@@ -9672,7 +9672,7 @@
},
"/{vendor}/{plugin}/{controller}/{id}/relations/{name}/records/{child}/files/{field}/{file}/thumb": {
"get": {
"description": "As the record thumb route, for a protected image of the related record or of the child session.",
"description": "As the record thumb route, for an image file, protected or public, of the related record or of the child session.",
"parameters": [
{
"description": "Vendor",
@@ -9821,7 +9821,7 @@
"BackendBearer": []
}
],
"summary": "Thumbnail of a related record's protected image",
"summary": "Thumbnail of a related record's image file",
"tags": [
"admin"
]

8
admin/src/api/schema.d.ts vendored
View File

@@ -3641,8 +3641,8 @@ export interface paths {
cookie?: never;
};
/**
* Thumbnail of a protected image
* @description The preview thumbnail (imageWidth by imageHeight, 240 by 240 by default, in thumbOptions.mode) of a protected image file, scoped like the download route. A file that is not a JPEG, PNG, GIF or WebP image is 404.
* Thumbnail of an image file
* @description The preview thumbnail (imageWidth by imageHeight, 240 by 240 by default, in thumbOptions.mode) of a JPEG, PNG, GIF or WebP file of the field, protected or public, scoped like the download route (a record the admin may load, or an upload pending in the admin's own session) and sent with the download route's headers. The admin SPA uses it for protected images and for a public image whose public URL does not load. Any other file type is 404.
*/
get: {
parameters: {
@@ -5178,8 +5178,8 @@ export interface paths {
cookie?: never;
};
/**
* Thumbnail of a related record's protected image
* @description As the record thumb route, for a protected image of the related record or of the child session.
* Thumbnail of a related record's image file
* @description As the record thumb route, for an image file, protected or public, of the related record or of the child session.
*/
get: {
parameters: {