Forum Moderators: phranque

Message Too Old, No Replies

Block images directory from being shown

         

treeleaf20

4:37 pm on Mar 8, 2011 (gmt 0)

10+ Year Member



All,
I allow my users to upload files and once they do I only want these files to be accessed from a PHP script. So if someone views the source and sees the img src and they put in that URL I don't want them to be able to view the image. These files go to uploaded and full_size. Any ideas on how to do this. I did find this [perishablepress.com...]

But not sure how to update it so that it satisfies my requirements. Thanks for any help in advance.

ergophobe

5:27 pm on Mar 8, 2011 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



The essence of what you say is not possible. If the URL viewable in view source is not accessible, the image will not show on the page.

You can check for the referrer and block people who don't have your site name as the referrer in an attempt to stop hotlinking, but you will also block regular users who for a variety of reasons are not sending referrer data and it won't stop anyone who spoofs the referrer.

You can prevent access to the original image. You can do this through obscurity (i.e. resize and rename) or through protected storage (plus resize and rename). Most apps that I know that will do the latter (Menalto Gallery, Drupal with certain settings) store the images outside of web root or block access (Deny from all) to the directory that holds the images, and then pull them in with a script dynamically that grabs the file using the filesystem rather than an HTTP request (at least that's how I think they work it) and adds a fair bit of overhead. But the image as pulled in the src attribute of the img tag is always accessible.

The page you link to has a ton of stuff on it - which example are you talking about specifically?

By the way - it would help to know WHY you want to do this, because that might affect what sort of solution you need.