Hiding Image Location

bcgeek

Hi All:

I'm trying to find a way to HIDE the location of images on my linux server to prevent non-authorized users from determining the location and stealing my bandwidth.

In other words, the tag <img src="http://server.com/images/img.jpg"> SHOWS anyone who cares to peek at the html code exactly where and how I store my images.
I want to prevent this ability.

I THINK I should be able to do this with Linux permissions, but can't seem to restrict access to others without restricting access to my scripts.

So, I was thinking I may be able to use PHP to create a link on the fly and then delete it when done.

Kinda like this:

If picture exists Then
Create link (in another directory)
Reference the Link in the HTML
(<img srs="http://server.com/LINKED/img.jpg">)
Delete the link
else
Display NoPicture...
end if

Does this method sound feasible to anyone? Or is there a simpler solution I haven't seen?

Any and all comments are appreciated.

Thanks,
Brian

plutoplanet

Hi Brian,

You could store the Images as Blob in a database. I did that on www.zappa.at and it works fine.

... I mean this could be one way...

Herwig

bcgeek

Just to let everyone know, killing the link happens <b>BEFORE</b> the image is served... So, my solution won't work.

Any other suggestions?

Thanks,
Brian

bcgeek

Herwig:
I'm <i>almost</i> at that point. I was just hoping I could keep it as simple as possible.

Thanks for the suggetion.

Brian

Anon

...another way is to create a PHP's image libraries.

Store all of your images outside the webspace on your server. Use PHP's image-handling to write a script which, when passed an image name, can read it in from the "hidden" folder and display them on the fly. You can also add a check at the start of the program to ensure that it is called from your server - displaying the image or a "stop thief!" graphic as appropriate.

So, the img tag on your server points to yourserver.com/image.php?i=logo.gif

Anyone who tries to use the same link on their site will get the "Stop Thief!" graphic, while your pages display fine.

Jack

Anon

ok... this is really easy...

store your images outside the document root or in a directory nobody would guess...
and save the names in a database

next call your img by using:
<img src="showimage.php?id=1">

then in showimage.php:

<?
$filename=mysql_result(mysql_query('select filename from images where id=$id'), 0, 'filename');
$filename= "path/to/hidden/directory".$filename;

header("Content-Type: image/gif");
//or image/pjpg offcourse
passthru($filename);
?>

offcourse you could also instead of using a db pass only the filename to the showimage.php script, and in showimage only prepending the path to the hidden directory.

Anon

cool... even easier than I had imagined!

bcgeek

FINAL RESULTS, (I hope!!! {🙂)

Hello All:
For those of you who may be interested, I read all of the suggestions and here's what seems to work. Thank you to all who helped!

Brian

==============================================

First, the calling HTML file

<body>
This is text BEFORE the picture
<img src="showpic.php?img=805101">
This is text after the picture
</body>

==============================================

Now the php script that will server the picture ONLY if called from my server.

<?
// this script should only show a picture IF the calling script is on MY server?
$url = parse_url($HTTP_REFERER);
$checkurl = strtolower($url["host"]);
if ($checkurl != "mydomain.com") {
echo "I'm sorry, but we are unable to respond to your request at this time...";
exit;
}

if (!isset($img)) {
echo "No Picture Specified...";
} else {
$picpath = "http://mydomain.com/picdir/";
$picdir = substr($img,0,3);
$filename = $picpath . $picdir . "/" . $img . ".jpg";
header("Content-Type: image/jpeg");
$image = fread(fopen($filename,"r"),100000);
echo $image;
fclose($image);

}

==============================================
That's it! Anyone see any holes?

Thanks,
Brian

rodif_bl

who's to say somone couldn't put in their page

<img src="yourdomanin.com/showpic.php?img=805101">
its still sending a normal http request to your webserver so the 'host' should be the same

and you might wanna change
$image = fread(fopen($filename,"r"),100000);
to
$image = fread(fopen($filename,"r"),filesize($filename));

/brad/

Anon

Looks good.

But for optimum security, I would move the images folder right out of your webtree.

So, if your webroot is, say, /var/www/html
I'd store the files in a new folder called /var/www/protected

That way, they just can't be accessed via http.

Jack

bcgeek

Brad:

I tried that (sending the url from page on another site) and, lo and behold, it just returned the dreaded "X" in place of the picture!

Also, the filesize command just wouldn't work. Not sure why, I may have corrupted or not quite valid jpegs.. Anyway, manual says "fread()" will stop at eof regardless of supplied length....

Thanks for the feedback!

Brian

Brad LaFountain wrote:

who's to say somone couldn't put in their page

<img src="yourdomanin.com/showpic.php?img=805101">
its still sending a normal http request to your webserver so the 'host' should be the same

and you might wanna change
$image = fread(fopen($filename,"r"),100000);
to
$image = fread(fopen($filename,"r"),filesize($filename));

/brad/

mctyler

Has anyone tried this? I got this to work once but for some reason the browser just sits there now and wont ever return the image. Any ideas?