htaccess preventing image display

or wrecking havoc

[jackson]

Not sure if this a new one for the books or playing along with one of the old themes.

On my site I have a random image gallery. Each time the page is refreshed a new image pops up. Had this feature working on my test serve - as in running PHP in doz environment and no htaccess. No issue.

On the hosted site loaded all this up together with htaccess and - couldn't get it to work. The app uses getimagesize(). Apparently there were issues with earlier versions of PHP 4.2.x. Had my host upgrade to 4.3.4. Still no go. Peddled all the images through fireworks instead of the PS where I originally did the work.

As a last resort, took a look through the error logs and this is what came up:

web host ip address - - [05/Dec/2003:21:35:52 -0600] "GET /images/dir/IMG_2581.jpg HTTP/1.0" 403 - "-" "-"
isp ip address - - [05/Dec/2003:21:35:54 -0600] "GET /images/dir/IMG_2581.jpg HTTP/1.0" 200 45799 "http://www.****.org/dir/page.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Q312461)"

In my .htaccess file I have banned hot-linking and blank refers and US's. This with the following:

# Forbid hot-linking of specified file-types - *blank and* local referers are ok
RewriteCond %{HTTP_REFERER}!^$
RewriteCond %{HTTP_REFERER}!^http://(www\.)?****\.org [NC]
RewriteRule \.(avi在mp圭ss圬oc圯xe夙if夸pg夸s妃db妃id妃ov妃p3妃pg如df如ng如ps如pt字a字am存wf安av安ma寺ls屹ip)$ - [F]

# Forbid if blank (or "-") Referer *and* UA
RewriteCond %{HTTP_REFERER} ^-?$
RewriteCond %{HTTP_USER_AGENT} ^-?$
RewriteRule .* - [F]

Removing the above and the random picture feature works. Obviously I dont't want to do this as it will leave my site open to the usual abuse. I've tried adding in the line: RewriteCond %{HTTP_REFERER}!**** = the host's IP address. I've tried various permutations but to no avail.

Is there away of letting this one address through so that this app can work and having htaccess do its work as it should?

[jdMorgan]

The first line in your log shows that it is the second block of mod_rewrite code causing the trouble.

So, just add the webhost IP address in here, escaped with backslashes as shown:

# Forbid if blank (or "-") Referer *and* UA and NOT an image request from my own server
RewriteCond %{HTTP_REFERER} ^-?$
RewriteCond %{HTTP_USER_AGENT} ^-?$
RewriteCond %{REMOTE_ADDRESS} !^192\.168\.0\.1$
RewriteRule .* - [F]

Since the request appears to the server as coming from itself as a client (requestor), you use REMOTE_ADDRESS, not HTTP_REFERER.

Jim

[jackson]

Jim,

appreciate the follow up but - we're not having much luck on this one.

Its definitely that block. As soon as I pull it out, the feature functions as it should. Put it back in and, no show.

Might have to live without this item in the htaccess or,
rewrite that app. Weird, weird ...

Just wondering, why is the host calling this/these image/s anyway? This ought to be the job of my browser, not so?

[jdMorgan]

If it's in the logs, it's an HTTP access. Something to do with how your script accesses the images, I guess...

Since these are images, make sure you flush your caches (browser, local proxy, etc.) before each and every test, too.

Jim

[jackson]

Jim,

Coming close to providing my own solution here. The bug(ger) might be in the app code.

In this random picture thing, I'm using PHP and getimagesize(). I suspect that to work the host's server needs to call - as in "Get" - the image to perform the image "resize" task before delivering it to the browser.

This seems to be a reasonable conclusion to draw on this matter. So, it looks like an app rewrite.

Anyway, thanks for all your help.