readfile() on external images effect on bandwidth?

[cdunn]

Hello everyone!

If I am reading jpegs off an external site (like flickr), will something like the following actually use my bandwidth for loading the image?...I guess the better way to say it is, does the image actually go through my server if I do this?

<?
$path = $_GET['image'];
header("Content-type: image/jpg");
@readfile($path);
?>

Cheers!
Cary

[bradgrafelman]

Read the manual page for [man]readfile/man:

Reads a file and writes it to the output buffer.

[MarkR]

Yes, it will.

Moreover, the above can be used by an attacker to read any local file on your server; I hope this code is not going to be used in production like that!

Mark

[bradgrafelman]

MarkR wrote:

the above can be used by an attacker to read any local file on your server

Or help a coordinated DDoS attack on another host. Dangerous code like this is what can get a server host in a lot of trouble.