Forum Moderators: phranque

Message Too Old, No Replies

.htaccess and image referral prevention...not working!

         

RedScourge

7:42 am on Nov 5, 2004 (gmt 0)

10+ Year Member



ok, ive got a website, [example.com....] <snip> I am trying to make a .htaccess file that prevents outside users from accessing my images, but i want to be able to access them from ANY PAGE anywhere in my site. example.com is just a redirect, so i only need it to work for pages on my IP address, port 8088.

heres what i got so far:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://142\.***\.**\.**/jokes/funnypics/ [NC,OR]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?142\.***\.**\.**/.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?142\.***\.**\.**:8088(/)?.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?localhost:8088(/)?.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} !^http://(www\.)?localhost(/)?.*$ [NC,OR]
RewriteRule .*.(gif¦jpg¦jpeg¦png)$ - [F,NC]

as some of you can probably tell, i dont know fully what im doing, but ive tried ALOT of stuff and it wont work. is what im doing going to work, in theory? is there something that needs to be turned on in httpd.conf to make it work besides the mod_rewrite module? i uncommented the only two lines in the httpd.conf file that contained the text 'rewrite', and i only use the rewrite module in this one .htaccess file.

im baffled though, it wont let me access my images at all.

the images im trying to access are in [142.***.**.**:8088...] and i suppose in ...:8088/img/ as well, so i have to put a copy of the .htaccess file there too i suppose, but i dunno.

it just wont work, and theres nothing online about how the actually WORKS that i can understand, theres just a bunch of websites that say stuff like "simply put this in a .htaccess file and change 'mydomain.com' to your domain."

well this doesnt work, at all! it sure stops ALL sites from seeing the images though.

i also cannot access the images if i type their names in manually, nothing works.

HELP PLZ! ACK!

[edited by: jdMorgan at 6:54 pm (utc) on Nov. 5, 2004]
[edit reason] Obscured specifics per TOS [/edit]

RedScourge

6:27 pm on Nov 5, 2004 (gmt 0)

10+ Year Member



ok if anyone has viewed the site and assumed i fix my problem merely because you can see the images youre wrong. i killed the .htaccess file off in order to allow access.

i still have a problem with it, and still need help incase you were wondering.

Robino

7:08 pm on Nov 5, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member





'mod_rewrite' needs to be on.

jdMorgan

8:07 pm on Nov 5, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Your code is too complicated, and you have copied many errors from other sources. The main problem is that you do not want to use the [OR] flag on your RewriteConds. That introduces a logic error that guarantees that no-one will be able to see your images, including you.

Your logic above reads:
IF ((not blank) OR (not your IP address) OR (not your local host)) THEN block images.
In order to allow image fetches, your http_referer would have to be simultaneously equal to blank AND your IP address AND your localhost. Since http_referrer can have only one value at a time, that is clearly impossible.

What you need is:
IF ((not blank) AND (not your IP address) AND (not your local host)) THEN block images.
RewriteCond's default behaviour in the absense of an [OR] flag is to AND the conditions.

I suspect you'll also need to include your own domain name to allow images to show on your entry page.

A comment directed to anyone thinking about getting into this: You cannot "guess" or "copy" your way through mod_rewrite any more than through brain surgery; Both require planning, precision, and flawless execution to succeed. Mod_rewrite's syntax is obscure. The regular expressions it uses in pattern-matching are obscure. Mod_rewrite makes up for this obscurity with its power -- Compact, concise code can make big changes to your URL-to-filename mapping and access policies. Study the references cited in our forum charter [webmasterworld.com] well before grabbing the surgical gloves.

Cleaning up the code above yields:


Options +FollowSymLinks
RewriteEngine On
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER} !^http://(www\.)?142\.***\.**\.**(:8080)?
RewriteCond %{HTTP_REFERER} !^http://(www\.)?example\.com(:8080)?
RewriteCond %{HTTP_REFERER} !^http://localhost(:8088)?
RewriteRule \.(gif¦jpe?g¦png)$ - [F]

Flush your browser cache (Temporary Internet Files) before testing any change to your access policies; If a page is cached in your browser, it won't be fetched from the server. If it is not fetched from the server, then the access policies on the server can have no effect.

Posting on this board modifies some characters. Change all broken pipe "¦" characters in the code above to solid pipes, and be sure that there is a space between "}" and "!" in RewriteConds.

Hope this helps,
Jim

RedScourge

11:32 pm on Nov 5, 2004 (gmt 0)

10+ Year Member



ok, i understand that the or thing probably wasnt helping me, but i saw it in the apache documentation and i thought id try it, i didnt just try it in all of my lines then immediately give up, i tried all sorts of things, but the thing that saved my butt, was the "(:8088)?" you provided me with and the "RewriteCond %{HTTP_REFERER} . " instead of having the $ or * or whatever was there before. this is the only place anywhere ive seen doing it this way, and i couldnt find anywhere anything useful for domains that uses port addresses, so this help you gave me REALLY saved my butt.

i cannot thank you enough for bothering to help an apache configuration newbie like me, there should be more of you in the world and less of the greedy people who like to keep this information locked away unless people like me pay for it. the whole point of me putting up this website is that i wanted to see if i could do something free that most people have to pay for by doing it all myself, and it hasnt been easy finding out how to install php+apache+mysql on windows 2000, but eventually after trial and error i got this far, and you helped me past this part, which i was about to give up on.

thank you, thank you, thank you!

* btw ive got one more question, but its not an apache question its more of a php/mail question but maybe you could help me out on it. ill try and post the question in the "PHP Server Side Scripting" section.

thanks a million!

RedScourge

3:33 pm on Nov 7, 2004 (gmt 0)

10+ Year Member



ok i tried that .htaccess file and tried linking it from a 50megs.com account, <snip>.

it shows one of the files off my server, and well, that means the .htaccess file isnt working, the .htaccess file im using is:

Options +FollowSymLinks
RewriteEngine On
RewriteCond %{HTTP_REFERER} .
RewriteCond %{HTTP_REFERER}!^http://(www\.)?142\.*\.*\.*(:8080)?
RewriteCond %{HTTP_REFERER}!^http://(www\.)?example\.com?
RewriteCond %{HTTP_REFERER}!^http://localhost(:8088)?
RewriteRule \.(gif¦jpe?g¦png)$ - [F]

and this should stop ppl from linking to my images right? the 142.*.*.* is the actual address of the server, and it is correct in there.

is it possible that this particular website does not do a http referal, or could it be because my computer isnt able to check the hhtp referral for some reason or another?

[edited by: jdMorgan at 3:41 pm (utc) on Nov. 7, 2004]
[edit reason] No specific URLs, please. See TOS. [/edit]

RedScourge

3:35 pm on Nov 7, 2004 (gmt 0)

10+ Year Member



NEVERMIND! thank you again!

"Posting on this board modifies some characters. Change all broken pipe "¦" characters in the code above to solid pipes, and be sure that there is a space between "}" and "!" in RewriteConds. "

RedScourge

10:35 pm on Nov 11, 2004 (gmt 0)

10+ Year Member



how would one go about modifying this so that you can match this condition to any files, such as .exe, but still have it so that people who access theu corporate environments or AOL wont get blocked from viewing the page? perhaps theres a way i can have it block by all except .html or .php files? im having trouble finding places that tell me anything at all about the proper syntax of the RewriteRule

jdMorgan

12:36 am on Nov 12, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



To block all except php and html files, you can use the "!" (NOT) operator and then "¦" OR the two filetypes.

RewriteRule !^\.(php¦html)$ - [F]

The syntax of RewriteRule is described in the Apache mod_rewrite documentation -- see the references in our forum charter.

Jim