Images outside of webroot

[dgiglio]

Hi,

For security purposes, I am trying to make an image appear on my page from outside of the web root. It works in two files, both of which I have taken from a book and modified. The first file (display.php) is actually the page which displays the image, and the second file (show_image.php ) takes the file out of the web root and sends it to the first file. All the images I am trying to access are gifs. Simple enough, or so it would seem...

Here is the important part of (display.php):

<?php 
 
if($image = getimagesize("../../secured/member_images/{$row['mem_img_file']}")) {
echo "<img src=\"../../secured/show_image.php?image={$row['mem_img_file']}\" $image[3] alt=\"member photo\" />";
} else {
echo "<font color=\"white\" size=\"3\">No Image Available <a href=\"get_id_card.php\">(Click Here)</a></font>";
}
 
?>
 

[Please use CODE tags when posting source code. Thanks! --pbmods]

The code for (show_image.php ) is:

<?php
 
if (isset($_GET['image'])) {
$image = "../../testing/member_images/{$_GET['image']}";
 
if(file_exists($image) AND (is_file($image))) {
$name = $_GET['image'];
 
} else {
$image = 'images/unavailable.gif';
$name = 'unavailable.gif';
}
 
} else {
$image = 'images/unavailable.gif';
$name = 'unavailable.gif';
}
 
$fs = filesize($image);
 
header ("Content-type: image/gif");
header ("Content-disposition: inline; filename=\"$name\"\n");
header ("Content-length: 4fs\n");
readfile ($image);
 
?>
 

Problem is, it just doesn't work at all. It will not display the image. Thanks for any help....

[epots9]

what OS is the site on? cuz it might be a permissions issue

[dgiglio]

It is on a server running Linux.

I looked at the permissions they are granted on my machine, and there is no problem there.

[epots9]

i've heard that using

[PHP]$image = "../../testing/member_images/{$_GET['image']}";[/PHP]

isn't the greatest, so try

[PHP]$image = "../../testing/member_images/".$_GET["image"];[/PHP]

try applying that to your other lines.

[pbmods]

Heya, dgiglio. Welcome to TSDN!

header ("Content-disposition: inline; filename=\"$name\"\n");
header ("Content-length: 4fs\n");

I doubt you need to include these headers. I never bother with them.
Also, the content-length is supposed to be the filesize in bytes.

Incidentally, you don't need to put '\n' in your headers. PHP does that for you automatically :)