Problem
GalleryController::uploadImageCkeditor() returns an absolute URL when responding to CKEditor after an image upload:
'url' => $this->generateUrl(
'gallery_uploaded_ckeditor',
['id' => ..., 'fileInfo' => ...],
UrlGeneratorInterface::ABSOLUTE_URL // ← hardcoded to production domain
),
CKEditor embeds this URL directly into the post HTML as an <img src="...">. Because the URL is absolute (https://bewelcome.org/...), images uploaded on production are broken when the same post is viewed on stage.bewelcome.org or any other domain — the browser fetches from bewelcome.org, which requires authentication there.
Fix
Change ABSOLUTE_URL to RELATIVE_PATH (Symfony default) so the embedded URL is /gallery/show/uploaded/{id}/{fileInfo}, which resolves against whatever domain the post is viewed on.
File: src/Controller/GalleryController.php
Change: UrlGeneratorInterface::ABSOLUTE_URL → UrlGeneratorInterface::RELATIVE_PATH
Impact
- Newly uploaded images will display correctly on stage.bewelcome.org and any other environment
- Existing posts with hardcoded
https://bewelcome.org/... URLs are not retroactively fixed
- The
/gallery/show/uploaded route still requires authentication — no change to access control
Problem
GalleryController::uploadImageCkeditor()returns an absolute URL when responding to CKEditor after an image upload:CKEditor embeds this URL directly into the post HTML as an
<img src="...">. Because the URL is absolute (https://bewelcome.org/...), images uploaded on production are broken when the same post is viewed onstage.bewelcome.orgor any other domain — the browser fetches from bewelcome.org, which requires authentication there.Fix
Change
ABSOLUTE_URLtoRELATIVE_PATH(Symfony default) so the embedded URL is/gallery/show/uploaded/{id}/{fileInfo}, which resolves against whatever domain the post is viewed on.File:
src/Controller/GalleryController.phpChange:
UrlGeneratorInterface::ABSOLUTE_URL→UrlGeneratorInterface::RELATIVE_PATHImpact
https://bewelcome.org/...URLs are not retroactively fixed/gallery/show/uploadedroute still requires authentication — no change to access control