Forum Moderators: coopster

Message Too Old, No Replies

A real riddle

php outside of web root images

         

dstonefeather

3:02 am on Jun 12, 2007 (gmt 0)

10+ Year Member



Hi all, can someone help me out here? This is a real conundrum for me (probably not for you all).

For security, my file structure has two branches and is set up like this. the common root is called "base". Web access available only to public_html and below.

base/secured/secure_images

base/public_html/working_dir/images

A little background, I am simply trying to access some images outside of the webroot by using a script which reads the image file as binary and uses passthru() to show it on the screen. It works like a charm when the image and page (show_image.php) are in the web accessible directory, but nce I try to get to them through another page, nothing works.

ANYWAY...

I have a page called "base/secured/member_page.php"

member page has a php include() to another file called "base/secured/stuff.php". "member_page.php" accesses "stuff.php" with the line:

<?php
include("stuff.php");
?>

No path, no nothing. Works fine. *** I have never changed the include path in my php.ini ***

now, when I want to access an image from "base/public_html/working_dir/images" in "member_page.php" I simply write:

<img src="images/image.gif">

and it appears. My question is this...

how can member_pages.php access two pages in two entirely different branches of my directory tree without moving up a directory? I have looked at the files, there are no duplicates or anyhting...

Shouldn't one path have to include a little "../../whatever"?

I am sorry if this is so stupid, it has had me stumped for days. It is really preventing me from accessing files outside the root, which I need to do for security purposes.

Any help would be greatly appreciated.

Thanks for helping a n00b.

dstonefeather

3:06 am on Jun 12, 2007 (gmt 0)

10+ Year Member



oh yeah...

member_page.php is accessed through the web by using an include statement in a file called...

base/public_html/working_dir/home.php

darrenG

10:59 am on Jun 12, 2007 (gmt 0)

10+ Year Member



I think you'll find that the browser calls up the image, not the script, so the image location will be relative to the location the browser is making a request from, not the location of the script.

All the script does is instruct the server to send <img src"wotever.jpg"/> to the browser, it doesnt tell the server which image it is on about it tells the client.

Make sense?