PHP Security Issue

[samvb]

Hi,
Sorry if this question has been asked before. I am doin a website that requests users to upload their photos, articles. I put those in a folder outside the root folder of my website. But the visitor can easily see the folders they r located in by viewin the src of the html. How can i sort of encypt that? What security measures should I take to protect those datas basically?

NOTE: I am a newbie n this is a project i am tryin to finish successfully.

[Markus]

If they're outside of the webroot, ie:

- host
- safe
    - user_photos
    - user_articles
- web_root(html)
     index.php
 

where safe is the location of user_photos and user_articles, it shouldn't matter whether the user can see the location of the files because they're stored somewhere where they are inaccessible to the browser.

If I am misunderstanding, please correct me.

Markus.

[bnashenas1984]

Hi
The problem is that if you don't allow the user to have access to an image then you can not use the image in a HTML because the user will still need access to view it.

But there is one thing I could come up with to protect images.

Put your images in a folder which users don't have access to. Then you can use PHP GD to serve the image only to a specified user.

Here is the code to serve the image by PHP GD:
imageviewer.php

<?PHP 
    // if the image in a GIF use imagecreatefromgif 
    // if the image in a PNG use imagecreatefrompng 
 
    $img=imagecreatefromjpeg("yourImage.jpg"); 
    imagePNG($img); 
    imagedestroy($img); 
   ?> 
 
 

Then as the SRC of your image tags of your HTML code use the above PHP file like this:

   <img src="imageviewer.php"> 
 

There are currently many websites using this method to protect their photos.
In some websites when you right click on an image and go to properties the only address you can see is a PHP file.

And don't forget that GD must be enabled on the server you are excuting your script on. Most of the servers have GD enabled by default.

Hope this helps you

[Atli]

Hi.

And alternate way of serving images through a PHP file would be to simply set the appropriate headers and read the contents of the file into the output buffer:

<?php
$file = "/path/to/file.jpg";
$info = getimagesize($file);
header("Content-Type: ". $info['mime']);
header("Content-Length: ". filesize($file));
readfile($file);
?>
 

This would not require the GD extension and would work regardless of the image type.
Also, this should use less memory than it's GD counterpart, as the image would not need to be loaded into memory before it is sent. (Although that would depend on the internals of the readfile function)

[samvb]

Thanks Guys!

that was very helpful!

U ROCK!

[samvb]

Hi.

And alternate way of serving images through a PHP file would be to simply set the appropriate headers and read the contents of the file into the output buffer:

<?php
$file = "/path/to/file.jpg";
$info = getimagesize($file);
header("Content-Type: ". $info['mime']);
header("Content-Length: ". filesize($file));
readfile($file);
?>
 

This would not require the GD extension and would work regardless of the image type.
Also, this should use less memory than it's GD counterpart, as the image would not need to be loaded into memory before it is sent. (Although that would depend on the internals of the readfile function)

Dear,
Help out here plz. I actually like ur tip cos it takes less memory, but how wld i ve to it from a function? I need to call it from various files, send paramters, then store the image that i can use in img src?

[Atli]

It's like bnashenas says. You will have to put this code into a seperate file which is called by an <img> tag's src attribute.

The code acts as an image, so it can not be called directly from your other scrips. You have to let the browser call it as an image.

Like, for example, if I did this:

<?php
// Create a list of available files
// This could be done using a database instead.
$dir = "/path/to/secure/image/location/";
$files = array("image1.jpg", "image2.jpg", "image3.jpg");
$errorImage = "error404.jpg";
 
// Find the requested file from $_GET
if(isset($_GET['id']) && isset($files[$_GET['id']])) {
  $file = $dir . $files[$_GET['id']];
}
else {
  $file = $dir . $errorImage;
}
 
// Print the image
$info = getimagesize($file);
header("Content-Type: ". $info['mime']);
header("Content-Length: ". filesize($file));
readfile($file);
?>
 

And put this into a file name "imageviewer.php".

I could use this to show the images.

<?php
for($i = 0; $i < 4; $i++) {
  echo '<img src="imageviewer.php?id='. $i .'" alt="Image #'. $i .'" />';
}
?>
 

The first 3 would show images 0 to 2 from the array, but the last one would show the error image.