Images not displaying

[lemACD]

Since upgrading to 3.3.3 I've found that some images don't appear.

If I right-click the image and click 'open image in new tab' then the pictures are there so nothing obviously wrong and they used to work.

At first I thought that the ones that aren't showing had http: addresses and the ones that are OK were https: but I've just found one http: picture that's working fine so that doesn't seem to be the pattern.

Any suggestions please?

[warmweer]

Since upgrading to 3.3.3 I've found that some images don't appear.

If I right-click the image and click 'open image in new tab' then the pictures are there so nothing obviously wrong and they used to work.

At first I thought that the ones that aren't showing had http: addresses and the ones that are OK were https: but I've just found one http: picture that's working fine so that doesn't seem to be the pattern.

Any suggestions please?

How are the images posted? BBcode (default or custom), a plain link, an extension?

A link to your site with an example post (e.g. the http one that's OK, and one that's not OK) could help (or better even the Support Request Template providing information about your site specifics.

[lemACD]

Since upgrading to 3.3.3 I've found that some images don't appear.

If I right-click the image and click 'open image in new tab' then the pictures are there so nothing obviously wrong and they used to work.

At first I thought that the ones that aren't showing had http: addresses and the ones that are OK were https: but I've just found one http: picture that's working fine so that doesn't seem to be the pattern.

Any suggestions please?

How are the images posted? BBcode (default or custom), a plain link, an extension?

A link to your site with an example post (e.g. the http one that's OK, and one that's not OK) could help (or better even the Support Request Template providing information about your site specifics.

Sure.

Here's a post with 1 working image and 2 not working:

https://www.coffeeshopdirect.com/forum/ ... 29#p402729

All 3 of these are http: I'm sure they were working last time I looked. This is the BBcode within the post:

Code: Select all

[img]http://www.ukrockfestivals.com/henge-84-dude-van.jpg[/img]

[img]http://www.ukrockfestivals.com/convoy-steve-van-400.jpg[/img]

[img]http://www.andyworthington.co.uk/images/stonehenge1984.jpg[/img]

Weirdly, when I included the BBcode in this post, the images appeared here!
Assuming this forum is on 3.3.3, it looks like the problem is specific to my forum.

[warmweer]

I don't see any problem.
All 3 images load perfectly, as do images in other posts (all http)

[lemACD]

I don't see any problem.
All 3 images load perfectly, as do images in other posts (all http)

Really?!
That's even more weird.
Sounds like it's my PC. I just tried it on my phone, though, and got the same thing.
This is what it looks like for me:

[3Di]

Everything is ok also by my side.

[warmweer]

This is what it looks like for me:

Purge forum cache and browser cache and then look at that post again.

[lemACD]

Purge forum cache and browser cache and then look at that post again.

Purged cache in phpBB, cleared cached files and images in Chrome and even tried MS Edge but still looks the same

[EA117]

Purged cache in phpBB, cleared cached files and images in Chrome and even tried MS Edge but still looks the same

The issue described happens for me, for what it's worth:

mixed.png

And it's a mixed-content issue: I'm accessing your site via HTTPS, but these images that don't appear are from non-secure / non-HTTPS sources.

That's not an uncommon issue even for non-phpBB sites where users can specify whatever source URL they want, but the site is using HTTPS to deliver the page that presents those links.

One solution for phpBB is Senky's HTTPProxy extension: https://phpbb.pro/httpproxy/. That would continue to let your users specify whatever image source they wanted, but instead of allowing those parts of your page content to be delivered from non-HTTPS sources, HTTPProxy makes it's own HTTP connection to retrieve the content, and then delivers that content over the same HTTPS connection the visitor is accessing your site with.

Or you could disallow HTTP to prevent it from happening in the future; but that wouldn't fix any of the existing links.

[warmweer]

And it's a mixed-content issue: I'm accessing your site via HTTPS, but these images that don't appear are from non-secure / non-HTTPS sources.

I'm also accessing it via HTTPs but ... I was using FF ad didn't think about other browsers : now tested with the others

FF shows all
Opera, Chrome, Edge only show the third one
Now going to search in the browser settings for anything that could cause that behaviour.

Added: just reinstalled Brave and it also doesn't show the top images.

[EA117]

Yeah, I figured you guys must be looking at it with something else. But from what I saw, even FireFox claimed to block by default.

I do presume you're at least getting the non-secure icon in FireFox on that site, indicating that mixed content is present but isn't being blocked. I'm assuming if you're seeing it without having explicitly allowed it, FireFox must consider an image "passive" content. And so will still declare that the page is no longer fully secure, but will show that passive content.

But the problem is expected, intentional, and "universal" without being specific to any browser. Which is why things like HTTPProxy exist.

[lemACD]

Thanks for looking into this everyone.

I was wondering whether it was something to do with the mixed content.

Thing is though, all 3 of the images in that post are http rather than https and yet one of them is displayed.

[lemACD]

I just tried Firefox and, yep, as you say, all works perfectly with that.

A few strange things about this:

1. I've been using https for ages and yet this problem has only shown up recently.
2. Not all http images are failing, even in Chrome.
3. I can embed the same images in a post on this phpbb community forum and they display fine, even in Chrome. This forum also appears to be https.

As in, this image below. The same bbCode in the original post doesn't appear in Chrome and yet does appear here, at least for me.



Is this using some kind of http fix?

[Even more weird, I just put the original bbCode into code tags here and previewed the post and the code text appeared to change! I've taken it out.]

[warmweer]

I just tried Firefox and, yep, as you say, all works perfectly with that.

Concerning FF, thanks to EA117 I found the "culprit" quickly.

Privacy and Security
HTTPS-Only Mode
HTTPS provides a secure, encrypted connection between Firefox and the web sites you visit. Most websites support HTTPS, and if HTTPS-Only Mode is enabled, then Firefox will upgrade all connections to HTTPS.Learn more
Enable HTTPS-Only Mode in all windows
Enable HTTPS-Only Mode in private windows only
Don’t enable HTTPS-Only Mode

I guess the other browser will have similar configuration options (something to look into later).

[EA117]

HTTPS-Only Mode

For what it's worth, I think that's different than the mixed-content control, which FireFox also provides. HTTPS-only mode would upgrade even your connection to a single page, if that page were available on HTTPS and HTTP. Mixed context control is, of course, when mixed sources exist. HTTP-only mode might attempt to upgrade those to HTTPS, but whether or not it can depends on the source, not on FireFox. Mixed-content control decides "what to do when the content is coming from HTTP", whether HTTP-only attempted to upgrade the connection or not.

A few strange things about this:

I think part of the "why now" is that the browsers themselves are evolving, and both providing & reacting to things differently in order to increase their default security posture as compared to previous versions.

I do recall seeing that Chrome also had a feature similar to the "HTTP only" mode that warmweer mentioned. Where Chrome would automatically attempt for an HTTPS version of the resource being accessed, even if you hadn't explicitly requested that.


As to what's happening right here on phpbb.com/community, check the source of the image you just linked to, in the way it's being displayed here on this forum. It's coming from https://camo.phpbb.com/, and not from the HTTP source you linked to. Which means phpbb.com/community is presumably using something like the phpBB Camo SSL Image Proxy Extension, similar to the HTTProxy solution described earlier.