Attachment 'thumbnails' are the full-size original image — no actual resized thumbnail is ever generated #98

New Issue

2026-09-01T00:13:38-04:00

jared commented

2026-09-01 00:13:38 -04:00

Severity: Medium (performance/UX)

assets/js/ticket.js (~lines 1052-1057) points both the grid <img> thumbnail and the lightbox <a href> at the same download_attachment.php?...&inline=1 URL serving the original file. There is no server-side image resizing anywhere in the app.

Impact: A multi-MB photo attachment costs a full multi-MB download just to render a small preview thumbnail in the grid. Opening the attachments tab on a ticket with several large photos is bandwidth- and load-time-expensive; loading="lazy" only defers off-screen images, it doesn't reduce per-image transfer size.

Fix: Generate a resized thumbnail (e.g. GD imagecreatefromstring() + resize, with an explicit dimension/pixel-count cap before processing to guard against a decompression-bomb-style crafted image causing memory exhaustion) at upload time, and serve that for the grid view — reserve the full-size original for the lightbox/actual download.

**Severity:** Medium (performance/UX) `assets/js/ticket.js` (~lines 1052-1057) points both the grid `<img>` thumbnail and the lightbox `<a href>` at the same `download_attachment.php?...&inline=1` URL serving the original file. There is no server-side image resizing anywhere in the app. **Impact:** A multi-MB photo attachment costs a full multi-MB download just to render a small preview thumbnail in the grid. Opening the attachments tab on a ticket with several large photos is bandwidth- and load-time-expensive; `loading="lazy"` only defers off-screen images, it doesn't reduce per-image transfer size. **Fix:** Generate a resized thumbnail (e.g. GD `imagecreatefromstring()` + resize, with an explicit dimension/pixel-count cap before processing to guard against a decompression-bomb-style crafted image causing memory exhaustion) at upload time, and serve that for the grid view — reserve the full-size original for the lightbox/actual download.

jared added the performance priority/medium labels 2026-09-08 10:15:50 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#98