[RESOLVED] Image Below Root

abc123

Hello all,
I've been working on an online gallery and need a little help. Basically it is important that I protect the images in the gallery. To do this I thought it would be clever to have the images stored below the web root.

Unfortunately it does not seem to work. I have the an image that it refuses to display. If however I open this up outside of Apache then it works fine. For example if I just double click on an html page on my desktop then it will access the image fine.

I am fairly sure that there is some Apache security issue that does not allow access to all files on your computer. Makes sense I suppose. How though can I add a directory to this and give it permissions?

I've tried searching for a solution but don't seem to be getting anywhere. Don't think I'm quite getting how Apache sets file security.

Thanks in advance.

Weedpacket

Um..... you don't want the image to be available through the web site, so you put it outside the site's web root, and then you wonder why you can't get to it through the web site?

NogDog

If you're going to store images outside of the web document root, then the only way for your web pages to display them would be to reference a PHP (or other) server-side script to display them, e.g.: <img src="show.php?img=photo.jpg" alt="">. This only makes sense, however, if you're using session-controlled logins or other methods to limit access to your web page, or if you want to use the image display script to do on-the-fly watermarking of your images. (See http://bokehman.com/watermark for an example of this.)

Remember, once my browser displays an image from your site, it has already been downloaded to my computer, so at that point there is nothing you can do to stop me from copying it. (There are a few JavaScript and/or CSS things you can do to make it difficult for the computer illiterate, but they'll do nothing to stop anyone who knows a little bit about how their computer interacts with web sites.)

abc123

Thanks for the replies.

I have a login and I am using sessions to control this. I was looking for a way to stop people who have not logged in from accessing these pictures. I also now understand that when they view a picture on the page they have basically already downloaded it and there is nothing I can do about that.

I have got a php script that selects the images. I actually have the image names stored in a database so the script simply displays the images.

If an unathorised user knows the location of an image then good for them. They have worked hard and probably deserve the image. :-)

I have checked typing in the directory where the images are stored and it does not give a directory listing of them which is nice. I suppose that's secure enough.

Think I've got enough info now and have already started the development.

Wish me luck and thank you both for replying.