Hidden Folders + Storing images... am I missing the point?

TruckStuff

I am building a website that requires users to upload images. My understanding was that I would be able to have a "hidden" folder that allows me to store the images on the file system of the server such that the pictures could not be served up except via the interface I provide. I am finding that this is not the case.

For example, if I store pic.jpg using the path ../some_dir/pic.jpg, the image is successfully saved (where some_dir is outside my htdocs root dir). However, if I later want to view the image using the following code:

<img src="../some_dir/pic.jpg">

I get a box with a red x (indicating the image can't be served).

So am I doing something wrong or have I missed the point of hidden folders entirely? TIA.

Anarchyh

No, i think you have the point ... you are just going about it wrong 😛

Since they are saved outside of the document root you will not be able to access them by simply putting the path in an IMG tag since the server wont serve them up as they are not in its docroot.

What you will have to do if you would like to do this is create a small script that will act as an intermediary between the two (client and hidden files).

You can do this by opening the file as a stream and using fpassthru to output the file.

Then set the IMG SRC to something like "myIntermediary.php?img=moo.jpg" and that should work.

Please note though that you will want to make sure that it will ONLY serve files out of your image directory otherwise someone might have free roam of your server via the intermediary.

TruckStuff

OK, that get me headed in the right direction. I also remember reading from other topics that I need to use the output buffers to get the pages to display properly, but the image is not displaying.

Right now the page loads but when it tries to load the image, IE just sits there and says "Downloading imge..." The icon in the upper right of the window keeps spinning as if it is still loading something. Here is the code I have now:

$im = 'somepic.jpg';
echo "<img src=\"serveImage.php?im=$im\" border=0>";

serveImage.php looks like this:

<?php
session_start();

ob_start();
if (!isset($_GET['im']))
  die ('no type passed.');
 else $im = escapeshellcmd(basename($_GET['im']));
$path = $_SESSION['images_root'].'/'.$im;
$dims = getimagesize ($path);
$imtypes = array('GIF', 'JPG', 'PNG', 'SWF', 'PSD', 'BMP', 'TIF', 'TIF', 'JPC', 'JP2', 'JPX', 'JB2', 'SWC', 'IFF', 'WBMP', 'XBM');
$ext = $imtypes[$dims[2]-1];
header('Content-Type: image/'.$ext);
if (!$h = fopen ($path, 'r'))
  echo 'File open failed!';
 else
  {
   fpassthru($h);
   fclose($h);
  }
ob_end_flush();
?>