XF 2.3 Problems with file upload after upgrade

[uab9876]

I've just upgraded to the latest forum software from v1 and most things are working but I can't upload files in posts.

When I try the image just shows 0% upload. I assume there are some permissions that are not right somewhere but the data directories are writable.

 

[uab9876]

Further to this it looks like its a not an issue for all users.
Could there have been some permission changes somewhere?

[Updated]

It worked from someones phone then after trying from a PC the upload failed from a phone again. Weird behaviour and I'm not sure where to look,

[Adding more]
Firefox console error

Content-Security-Policy: The page’s settings blocked the loading of a resource (img-src) at blob:https://www.xxx.ixxx/70fa76ed-ee65-405e-af26-5b99f0ef87da because it violates the following directive: “default-src https: data: 'unsafe-inline' 'unsafe-eval'”

 

[Seeker-Smith]

Further to this it looks like its a not an issue for all users.
Could there have been some permission changes somewhere?

[Updated]

It worked from someones phone then after trying from a PC the upload failed from a phone again. Weird behaviour and I'm not sure where to look,

[Adding more]
Firefox console error

You’re dealing with a new image type webp it’s supported on most current browsers. Go to ACP > settings > attachments and turn off Optimize images.

 

[uab9876]

You’re dealing with a new image type webp it’s supported on most current browsers. Go to ACP > settings > attachments and turn off Optimize images.

The optimize images is turned off (I've never enabled that) so that isn't the issue.

 

[Seeker-Smith]

The optimize images is turned off (I've never enabled that) so that isn't the issue.

But your test image is webp try another type and see if it fixes the problem.

 

[uab9876]

But your test image is webp try another type and see if it fixes the problem.

I've tried png and jpg neither worked. I'm thinking the console error is suggesting that it may be a webserver issue it seems to be suggesting its a some sort of policy error (I will check my webserver setup).

Refused to load the image 'blob:https://www.xxx.xxx/086daac9-64d4-4cdb-b753-55413adf10a2' because it violates the following Content Security Policy directive: "default-src https: data: 'unsafe-inline' 'unsafe-eval'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

 

[Paul B]

It is a server issue.

Your host should be able to resolve it if you aren't sure how to.

 

[Chromaniac]

So, I have this issue on Chrome Android. Sometimes the image does get uploaded. But most of the times it gets stuck like mentioned here. It is just not converted and stays stuck on 0%. On desktop Chrome, it uploads just fine. I wonder if @uab9876 ever managed to find a fix for this at server side. If it was a CSP thing, I imagine, it would affect the mobile browser every single time and should also affect Chrome desktop. Not sure if it is even possible to check for console error on mobile browsers.

Did a bit more testing and I have 100% upload success rate with webp files on Chrome Android. Problem appears to be with JPGs/PNGs but again sometimes they do get converted and upload. So, this might not be a CSP thing. On desktop I have 100% success rate with all three file types. I am on Cloudflare and using the @digitalpoint addon to stop images on R2. Though that should not matter as R2 only gets involved when files are actually uploaded.

 

[uab9876]

So, I have this issue on Chrome Android. Sometimes the image does get uploaded. But most of the times it gets stuck like mentioned here. It is just not converted and stays stuck on 0%. On desktop Chrome, it uploads just fine. I wonder if @uab9876 ever managed to find a fix for this at server side. If it was a CSP thing, I imagine, it would affect the mobile browser every single time and should also affect Chrome desktop. Not sure if it is even possible to check for console error on mobile browsers.

Did a bit more testing and I have 100% upload success rate with webp files on Chrome Android. Problem appears to be with JPGs/PNGs but again sometimes they do get converted and upload. So, this might not be a CSP thing. On desktop I have 100% success rate with all three file types. I am on Cloudflare and using the @digitalpoint addon to stop images on R2. Though that should not matter as R2 only gets involved when files are actually uploaded.

Yes I changed some of the server settings around the content security policy. Although I'm not sure that is a good thing as they are meant to protect against cross site scripting (although that is one attack area I've never really been able to get good mental model of so not sure of the issues.