Skip to content

Changelog and upgrading

Unreleased (1.0.x)

Security

  • Sending captured frames needs permission to create or edit media and the session's CSRF token. In 1.0.0 the upload route only needed Access content, which anonymous users usually have, so anyone could store files in the public file system and plant a frame that became the thumbnail of another user's video.
  • Frames must be JPEG images of 10 MB or less, and wait for their media item in each user's own private or temporary directory instead of public://client-video-thumbs.
  • The Regenerate Thumbnail form saves a new file instead of writing over the current thumbnail. In 1.0.0, regenerating a video that still had Media's generic icon replaced that icon for every video.

Fixes

  • Media Thumbnails works again on Drupal 11.1 and later. 1.0.0 removed its hook_media_presave() implementation there, so no Media Thumbnails plugin created any thumbnail.
  • The browser captures frames on Drupal 10 and 11, and in the media library. 1.0.0 used a hook that Drupal 10 removed.
  • The plugin returns a file entity, so new video media get the captured frame as their thumbnail, with its width and height.
  • Saving a video media item again keeps its thumbnail instead of removing it.
  • Videos shorter than two seconds no longer stop the capture.
  • The Regenerate Thumbnail tab only appears on video media.
  • Posters are set for the source field of any video media type, not only field_media_video_file on the video type.
  • The Regenerate Thumbnail script's messages are translatable.
  • Cron deletes frames that no media item claimed within a day, and uninstalling deletes all of them.

Changes

  • Drupal 10.3 or later is required. 1.0.0 claimed Drupal 9.3, but its Regenerate Thumbnail form already needed 10.3.
  • Video files in file fields that are not media sources no longer get a poster. 1.0.0 looked up a media item for every video file it rendered.

Upgrading from 1.0.0

  1. Update the code:

    composer require drupal/media_thumbnails_client_video

  2. Run database updates, which also rebuilds the service container:

    drush updb

    media_thumbnails_client_video_post_update_delete_public_frames deletes .jpg and .json files in public://client-video-thumbs that no file entity uses. These are frames 1.0.0 received but no media item claimed, including any uploaded by anonymous users. Thumbnails in use, including ones saved by the Regenerate Thumbnail form, are kept.

  3. Check that editors who add videos can create or edit media. Users with only Access content can no longer send frames.

On Drupal 11.1 and later, Media Thumbnails starts creating thumbnails again for every plugin you have installed. Video media saved while 1.0.0 was active may show Media's generic icon; open their Regenerate Thumbnail tab to pick a frame.

1.0.0

First release.