From e7842b36351660faf3b0376a2fd6a4c5b6fd30eb Mon Sep 17 00:00:00 2001 From: FFXN Date: Fri, 8 May 2026 13:55:05 +0800 Subject: [PATCH 1/3] fix: Image rendering in the knowledge base failed. --- api/core/rag/extractor/pdf_extractor.py | 2 +- api/core/rag/extractor/word_extractor.py | 2 +- api/core/tools/signature.py | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/api/core/rag/extractor/pdf_extractor.py b/api/core/rag/extractor/pdf_extractor.py index 9abdb31325..59440e78b9 100644 --- a/api/core/rag/extractor/pdf_extractor.py +++ b/api/core/rag/extractor/pdf_extractor.py @@ -115,7 +115,7 @@ class PdfExtractor(BaseExtractor): """ image_content = [] upload_files = [] - base_url = dify_config.INTERNAL_FILES_URL or dify_config.FILES_URL + base_url = dify_config.FILES_URL try: image_objects = page.get_objects(filter=(pdfium_c.FPDF_PAGEOBJ_IMAGE,)) diff --git a/api/core/rag/extractor/word_extractor.py b/api/core/rag/extractor/word_extractor.py index 052fca930d..5d56ed4456 100644 --- a/api/core/rag/extractor/word_extractor.py +++ b/api/core/rag/extractor/word_extractor.py @@ -88,7 +88,7 @@ class WordExtractor(BaseExtractor): def _extract_images_from_docx(self, doc): image_count = 0 image_map = {} - base_url = dify_config.INTERNAL_FILES_URL or dify_config.FILES_URL + base_url = dify_config.FILES_URL for r_id, rel in doc.part.rels.items(): if "image" in rel.target_ref: diff --git a/api/core/tools/signature.py b/api/core/tools/signature.py index 22e099deba..1f3e1b26ec 100644 --- a/api/core/tools/signature.py +++ b/api/core/tools/signature.py @@ -25,12 +25,12 @@ def sign_tool_file(tool_file_id: str, extension: str, for_external: bool = True) return f"{file_preview_url}?timestamp={timestamp}&nonce={nonce}&sign={encoded_sign}" -def sign_upload_file(upload_file_id: str, extension: str) -> str: +def sign_upload_file(upload_file_id: str, extension: str, for_external: bool = True) -> str: """ sign file to get a temporary url for plugin access """ # Use internal URL for plugin/tool file access in Docker environments - base_url = dify_config.INTERNAL_FILES_URL or dify_config.FILES_URL + base_url = dify_config.FILES_URL if for_external else (dify_config.INTERNAL_FILES_URL or dify_config.FILES_URL) file_preview_url = f"{base_url}/files/{upload_file_id}/image-preview" timestamp = str(int(time.time())) From 414f9542e44b418ccd810a2c3220037bc3856e38 Mon Sep 17 00:00:00 2001 From: FFXN Date: Fri, 8 May 2026 14:16:25 +0800 Subject: [PATCH 2/3] fix: Image rendering in the knowledge base failed. --- api/core/tools/signature.py | 7 +++++-- .../unit_tests/core/tools/test_signature.py | 20 ++++++++++++++++++- 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/api/core/tools/signature.py b/api/core/tools/signature.py index 1f3e1b26ec..fc22d1e4ef 100644 --- a/api/core/tools/signature.py +++ b/api/core/tools/signature.py @@ -27,9 +27,12 @@ def sign_tool_file(tool_file_id: str, extension: str, for_external: bool = True) def sign_upload_file(upload_file_id: str, extension: str, for_external: bool = True) -> str: """ - sign file to get a temporary url for plugin access + Sign an upload file to get a temporary image preview URL. + + External URLs are the default because uploaded-file previews are returned to + user-facing retrieval responses. Internal URLs remain available for callers + that need to access files inside the deployment network. """ - # Use internal URL for plugin/tool file access in Docker environments base_url = dify_config.FILES_URL if for_external else (dify_config.INTERNAL_FILES_URL or dify_config.FILES_URL) file_preview_url = f"{base_url}/files/{upload_file_id}/image-preview" diff --git a/api/tests/unit_tests/core/tools/test_signature.py b/api/tests/unit_tests/core/tools/test_signature.py index a5242a78c5..6801bdfdc3 100644 --- a/api/tests/unit_tests/core/tools/test_signature.py +++ b/api/tests/unit_tests/core/tools/test_signature.py @@ -83,7 +83,7 @@ def test_verify_tool_file_signature_rejects_expired_signature(monkeypatch: pytes assert verify_tool_file_signature("tool-file-id", timestamp, nonce, sign) is False -def test_sign_upload_file_prefers_internal_url(monkeypatch: pytest.MonkeyPatch) -> None: +def test_sign_upload_file_for_external_uses_files_url(monkeypatch: pytest.MonkeyPatch) -> None: monkeypatch.setattr("core.tools.signature.time.time", lambda: 1700000000) monkeypatch.setattr("core.tools.signature.os.urandom", lambda _: b"\x03" * 16) monkeypatch.setattr("core.tools.signature.dify_config.SECRET_KEY", "unit-secret") @@ -94,6 +94,24 @@ def test_sign_upload_file_prefers_internal_url(monkeypatch: pytest.MonkeyPatch) parsed = urlparse(url) query = parse_qs(parsed.query) + assert parsed.netloc == "files.example.com" + assert parsed.path == "/files/upload-id/image-preview" + assert query["timestamp"][0] + assert query["nonce"][0] + assert query["sign"][0] + + +def test_sign_upload_file_for_internal_prefers_internal_url(monkeypatch: pytest.MonkeyPatch) -> None: + monkeypatch.setattr("core.tools.signature.time.time", lambda: 1700000000) + monkeypatch.setattr("core.tools.signature.os.urandom", lambda _: b"\x08" * 16) + monkeypatch.setattr("core.tools.signature.dify_config.SECRET_KEY", "unit-secret") + monkeypatch.setattr("core.tools.signature.dify_config.FILES_URL", "https://files.example.com") + monkeypatch.setattr("core.tools.signature.dify_config.INTERNAL_FILES_URL", "https://internal.example.com") + + url = sign_upload_file("upload-id", ".png", for_external=False) + parsed = urlparse(url) + query = parse_qs(parsed.query) + assert parsed.netloc == "internal.example.com" assert parsed.path == "/files/upload-id/image-preview" assert query["timestamp"][0] From 1e02f5dafd90c57ffa252b5490bd806db1a175d6 Mon Sep 17 00:00:00 2001 From: FFXN Date: Sat, 9 May 2026 10:34:44 +0800 Subject: [PATCH 3/3] fix: Using CONSOLE_API_URL to generate an image preview URL causes the image preview to fail on the chunks details page of the knowledge base. --- api/models/dataset.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/api/models/dataset.py b/api/models/dataset.py index e323ccfd7f..7e8efee217 100644 --- a/api/models/dataset.py +++ b/api/models/dataset.py @@ -965,7 +965,7 @@ class DocumentSegment(Base): encoded_sign = base64.urlsafe_b64encode(sign).decode() params = f"timestamp={timestamp}&nonce={nonce}&sign={encoded_sign}" - reference_url = dify_config.CONSOLE_API_URL or "" + reference_url = dify_config.FILES_URL or dify_config.CONSOLE_API_URL or "" base_url = f"{reference_url}/files/{upload_file_id}/image-preview" source_url = f"{base_url}?{params}" attachment_list.append(