Managing Users with PHP Sessionsn and MySQL

Jess1

My web site uses PHP sessiosn to manage users. My site is basically a dynamic site that contains a large number of pictures. Users must be registered and logged in to use my indexing system and view the pictures.

However, what can I do to stop users typing the address of the pictures directly into the navigation bar?? I.e (www.mysite.com/content/todays_pictures/example1.jpg) instead of using my site after logging in.

Once they know the path to my content directory they could just guess picture names by incrementing the filename.

I know you can lock directories with .htaccess but I don't want users to have to log in twice?

Any ideas?

Thanks very much

Jess

Shrike

Put the images outside of the document root.

Jess1

That would certainly stop people from being able to get to the images. BUT it would also stop registered users from accessing the images! Although PHP scripts are server side and can themselves access anywhere on the server. A users browser can only access images/files that are in the document root?

Any other ideas :-)

Thanks

Jess

yelvington

Although PHP scripts are server side and can themselves access anywhere on the server.

Jess, you've provided your own answer.

protect_page_with_your_own_code();
header('Content-type: image/jpeg');
readfile($true_image_path);

Jess1

Thanks yelvington

Would it be possible to give me a real example of:

protect_page_with_your_own_code(); (authenticate user no prob)
header('Content-type: image/jpeg'); (path to images folder or to exact file?)
readfile($true_image_path); (exact path to image rather than URL?)

I would be sooooo grateful if you could perhaps give me a working example????

Thank you VERY much

Jess

Shrike

I assumed that your 'indexing system' already served images, rather than having users browse directly to the files.

// A very Basic file server
$imagedir = "/home/users/you/images";
if(isset($_SESSION['userid'])){
  if(file_exists($imagedir . "/" . $_GET['image'])){
    header("Content-type: " . mime_content_type($_GET['image']));
    readfile($imagedir . "/" . $_GET['image']);
  }else{
    die("File does not exist!");
  }
}else{
  header("Location: myloginscript.php");
}
// Usage: mybasicfileserver.php?image=something.gif

Use and abuse.