update thumbnail, allow user to choose output format by kouz75 · Pull Request #3714 · bolt/core

kouz75 · 2026-04-28T09:33:02Z

Add output format support to thumbnail URLs

Add optional format parameter to ThumbnailHelper, ImageExtension, and the thumbnail() Twig function
Encode the output format as a filename suffix in the URL (e.g. image.jpg.avif) instead of in the param string
Parse the format suffix in ImageController to set Glide's fm parameter and resolve the correct source file
Backward compatible: URLs without a format suffix continue to work unchanged

Update thumbnail file path in Twig and filesystem to match image URL structure, allowing Apache/Nginx to serve them directly without any PHP call

Vondry · 2026-05-04T16:46:48Z

As a general question - is there a command that would "warm up" thumbnail cache so that even first user can benefit from fast loading image?

kouz75 · 2026-05-04T20:15:46Z

There is no command for that yet.
One way to fix this is to add a new command that parses all media files (or the content) and generates their thumbnails. The thumbnail settings can be defined in theme.yaml or passed as parameters to the command.

This command may generate a lot of thumbnails that will never be displayed on the website.

… structure, allowing Apache/Nginx to serve them directly without any PHP call

bobvandevijver

I will need more time to definitively check this, but here's already my first findings. I also believe that are changes in this PR that are not necessarily needed to fix the main issue (which is fixing the webserver direct file serving).

bobvandevijver · 2026-05-09T19:52:36Z


+        $this->parseParameters($paramString);
+        $urlFilename = $filename;
+        $sourceFilename = $this->parseFormatFromFilename($filename);


Direct usage of the filename will cause a regression into a security incident (#3661) we had in the past, namely a path traversal. Paths can only be used after a canonicalize call.

The filename is still used directly without sanitation, this needs to be resolved first.

* Using PathCanonicalize::canonicalize() instead of Symfony's Path::canonicalize() closes a path traversal vulnerability. * fix rector * fix BadRequestHttpException

Bumps [systeminformation](https://github.com/sebhildebrandt/systeminformation) from 5.31.1 to 5.31.6. - [Release notes](https://github.com/sebhildebrandt/systeminformation/releases) - [Changelog](https://github.com/sebhildebrandt/systeminformation/blob/master/CHANGELOG.md) - [Commits](sebhildebrandt/systeminformation@v5.31.1...v5.31.6) --- updated-dependencies: - dependency-name: systeminformation dependency-version: 5.31.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Backport the default value from Symfony 7.1+ for easy configuration against Host Header Injection

bobvandevijver

Lets target this for 6.2 as it changes the paths. Also, can you enable edits from maintainers? If that was enabled I could have fixed the pipeline issues for you.

bobvandevijver · 2026-05-16T19:16:25Z


+        $this->parseParameters($paramString);
+        $urlFilename = $filename;
+        $sourceFilename = $this->parseFormatFromFilename($filename);


The filename is still used directly without sanitation, this needs to be resolved first.

bobvandevijver · 2026-05-16T19:19:54Z

+        $ext = mb_strtolower(pathinfo($filename, PATHINFO_EXTENSION));
+        if ($this->isSupportedFormat($ext) && pathinfo(pathinfo($filename, PATHINFO_FILENAME), PATHINFO_EXTENSION) !== '') {
+            $this->parameters['fm'] = $ext;
+
+            return mb_substr($filename, 0, -(mb_strlen($ext) + 1));
+        }
+
+        return $filename;


If I understand correctly, the goal is to retrieve the last part of the path here. Why not just explode on ., and validate if the match is one of the supported extensions?

I'm not able to allow maintainers to edit the PR ???
I switch the PR to 6.2 and fix both issues.

Copilot

Pull request overview

This PR prepares a 6.1.3 release with thumbnail URL/output-format updates plus related security hardening for SVG uploads, filemanager path handling, and trusted host configuration.

Changes:

Adds thumbnail output format support by encoding the target format as a filename suffix and parsing it in ImageController.
Updates thumbnail filesystem paths to mirror public thumbnail URLs for direct web-server serving.
Adds security/release updates: SVG sanitization, trusted hosts configuration, filemanager path canonicalization, dependency/version/changelog updates.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`src/Utils/ThumbnailHelper.php`	Adds optional thumbnail output format suffix and includes default fit/location in generated paths.
`src/Twig/ImageExtension.php`	Exposes the new thumbnail `format` argument through Twig.
`src/Controller/ImageController.php`	Parses format suffixes, sets Glide format, and saves thumbnails under URL-matching paths.
`public/theme/skeleton/partials/_image.twig`	Uses AVIF thumbnails with explicit quality in the skeleton theme.
`src/Controller/Backend/FilemanagerController.php`	Uses path canonicalization for create/delete filemanager actions.
`src/Controller/Backend/Async/UploadController.php`	Replaces manual SVG script checks with SVG sanitization.
`composer.json`	Adds the SVG sanitizer dependency.
`phpstan-baseline.php`	Updates baseline entries for the renamed SVG sanitizer callback.
`config/packages/framework.yaml`	Enables trusted hosts configuration via environment variable.
`.env`	Documents the trusted hosts environment variable.
`yaml-migrations/m_2026-05-14-framework.yaml`	Adds a config migration for trusted hosts.
`src/Version.php`	Bumps the PHP application version to 6.1.3.
`assets/js/version.js`	Bumps the frontend-generated version to 6.1.3.
`package.json`	Bumps the npm package version to 6.1.3.
`package-lock.json`	Updates a locked transitive npm dependency.
`CHANGELOG.md`	Adds release notes for 6.1.3.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+        $parts = explode('.', pathinfo($filename, PATHINFO_BASENAME));
+
+        if (count($parts) < 3) {
+            return $filename;
+        }
+
+        $ext = mb_strtolower(end($parts));
+
+        if ($this->isSupportedFormat($ext)) {
+            $this->parameters['fm'] = $ext;
+            return mb_substr($filename, 0, -(mb_strlen($ext) + 1));


+        file_put_contents($file['tmp_name'], $sanitizedSvg);
+
+        return true;


bobvandevijver · 2026-05-29T20:55:46Z

Okay, so I really wanted to take a real look at this PR and test it locally, but my time has run out working on a stupid failing a11y test (!3730), setting up a fully functional test environment with a complete nginx setup instead of the local symfony server and the recent responsible disclosures. So, rest assured, I haven't forgotten, I'm just lacking some time!

kouz75 added 2 commits April 28, 2026 11:26

update thumbnail, allow user to choose output format

67fdcf7

typo

00d5b9f

kouz75 marked this pull request as ready for review April 28, 2026 09:43

kouz75 marked this pull request as draft April 30, 2026 14:42

kouz75 marked this pull request as ready for review April 30, 2026 14:58

kouz75 added 4 commits May 4, 2026 22:44

Update thumbnail file path in Twig and filesystem to match image URL…

d105147

… structure, allowing Apache/Nginx to serve them directly without any PHP call

fix ecs check

e2fc162

fix phpstan

d712370

Merge branch '6.1' into thumbnail

7bb2889

bobvandevijver requested changes May 9, 2026

View reviewed changes

kouz75 and others added 12 commits May 10, 2026 11:39

fix traversal

c4ed3a0

add default value for fit/quality

1b1eb1a

add default fit value in thumb url

41e21a0

Merge branch '6.1' into thumbnail

4d6ef76

Prevent user to create/delete folder/files anywhere (bolt#3717)

5b7f93c

* Using PathCanonicalize::canonicalize() instead of Symfony's Path::canonicalize() closes a path traversal vulnerability. * fix rector * fix BadRequestHttpException

fix phpstan

af0a675

Merge remote-tracking branch 'origin/thumbnail' into thumbnail

a58165a

Add missing release notes

f03121f

Switch to SVG-sanitation library to sanitise uploaded SVG files

4a6e9ab

Enable SYMFONY_TRUSTED_HOSTS configuration by default

da6f8af

Backport the default value from Symfony 7.1+ for easy configuration against Host Header Injection

Create changelog for 6.1.3

ec33d5e

bobvandevijver requested changes May 16, 2026

View reviewed changes

bobvandevijver and others added 4 commits May 16, 2026 19:34

Release 6.1.3

fbf648a

check filename before using it

bd53344

check filename before using it

f4f2ad8

Merge branch '6.1' into thumbnail

7f70ff9

kouz75 changed the base branch from 6.1 to 6.2 May 18, 2026 16:12

Merge branch '6.2' into thumbnail

1379159

kouz75 requested a review from bobvandevijver May 20, 2026 04:55

bobvandevijver requested a review from Copilot May 29, 2026 19:33

Copilot started reviewing on behalf of bobvandevijver May 29, 2026 19:33 View session

Copilot AI reviewed May 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

update thumbnail, allow user to choose output format#3714

update thumbnail, allow user to choose output format#3714
kouz75 wants to merge 23 commits into
bolt:6.2from
shirkalab:thumbnail

kouz75 commented Apr 28, 2026 •

edited

Loading

Uh oh!

Vondry commented May 4, 2026

Uh oh!

kouz75 commented May 4, 2026

Uh oh!

bobvandevijver left a comment

Uh oh!

Uh oh!

bobvandevijver May 9, 2026

Uh oh!

bobvandevijver May 16, 2026

Uh oh!

bobvandevijver left a comment

Uh oh!

bobvandevijver May 16, 2026

Uh oh!

bobvandevijver May 16, 2026

Uh oh!

kouz75 May 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

bobvandevijver commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		file_put_contents($file['tmp_name'], $sanitizedSvg);

		return true;

Uh oh!

Conversation

kouz75 commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Vondry commented May 4, 2026

Uh oh!

kouz75 commented May 4, 2026

Uh oh!

bobvandevijver left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bobvandevijver May 9, 2026

Choose a reason for hiding this comment

Uh oh!

bobvandevijver May 16, 2026

Choose a reason for hiding this comment

Uh oh!

bobvandevijver left a comment

Choose a reason for hiding this comment

Uh oh!

bobvandevijver May 16, 2026

Choose a reason for hiding this comment

Uh oh!

bobvandevijver May 16, 2026

Choose a reason for hiding this comment

Uh oh!

kouz75 May 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

bobvandevijver commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kouz75 commented Apr 28, 2026 •

edited

Loading