Uploaded image for project: 'CiviCRM'
  1. CiviCRM
  2. CRM-17717

Contact images with .jpg extension fail to display in Internet Explorer

    Details

    • Documentation Required?:
      None
    • Funding Source:
      Contributed Code

      Description

      Contact images with .jpg file extension fail to display in Internet Explorer 10 and 11 with recent Drupal. A broken image graphic appears instead. Replicated on demo by uploading a .jpg file as a contact image and viewing the contact in IE11 on Windows 10.

      We tracked this down to the recent addition in Drupal core of this HTTP header:
      X-Content-Type-Options: nosniff
      Without this header, the images load OK. The header was added for security reasons, see includes/bootstrap.inc:

          // Prevent browsers from sniffing a response and picking a MIME type
          // different from the declared content-type, since that can lead to
          // XSS and other vulnerabilities.
          'X-Content-Type-Options' => 'nosniff',
      

      But why don't the images display correctly with this header? Because they are sent by Civi with the wrong content type:
      Content-Type: image/jpg
      This isn't valid: it should be image/jpeg. So IE is behaving correctly here, other browsers are being more lenient.

      A simple fix in CRM/Contact/Page/ImageFile.php gets it working in 4.6.10. Looks like the code is similar enough that the same fix should work in master. Would be good to get the fix in 4.6 too.

      PR wanted against master, I assume.

        Attachments

          Activity

            People

            • Assignee:
              colemanw Coleman Watts
              Reporter:
              davej Dave Jenkins
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: