last day (14 days later) » 

2:19 AM
0
A: Protect images through .htaccess and PHP

MrTuxUpdate your .htaccess RewriteRule to pass the matched filename to the PHP script as follows (your RewriteCondition is superfluous): RewriteEngine On RewriteRule ^((.*)\.jpg)$ /protect.php/$1 Then you can access the passes value using $_SERVER['PATH_INFO'] or $_SERVER['PATH_TRANSLATED'] (then A...

 
Seems great, but I get strange characters
When I directly access the file ex: url/filename.jpg
 
if you are talking about the forbidden case, you are missing the correct content type. Updated answer to reflect this.
I don't understand what you mean by strange characters.
 
It came from the missing header in else, thanks!
 
Looks like wrong content type, this is the content of a PNG file interpreted as text and not as a PNG (Content-Type: image/png)
Btw. I forgot to mention: In the filename= case beware of directory traversals...
 
Hi, We almost got it
 
2:22 AM
Sorry, don't have much time, need to go to bed ;) 4am here :-D
 
I now receive the fobidden image whe not logged in. But when logged in, no image is sent.
Ok I see, thanks for your help
Have a great night
 
I suppose the path is not correct
hint: disable the header('Content-Type: image/jpg'); header and echo the filename you got. Then you can see how to check and adjust it.
But make sure you only deliver data you want to deliver, I just added some notes about directory traversals in the answer
 
Yes the path is correct I already tried it
string(64) "https:/fullpath/filename.jpg"
 
no https:/fullpath/filename.jpg is not correct
readfile needs the correct absolute or relative path to the file.
 
Changed it to:
$fileurl = $_SERVER["DOCUMENT_ROOT"].'/'.$filename;
and got
string(71) "/home/user/public_html/wp-content/uploads/2016/08/DSC00306.jpg"
 
2:29 AM
that looks better
 
I now print a really long page with strange characters.
 
did you reenable the content type?
 
Yes
$filename = $_GET['filename'];
$fileurl = $_SERVER["DOCUMENT_ROOT"].'/'.$filename;
header('Content-Type: image/jpeg');
header("Content-Length: " . filesize($fileurl));
readfile($fileurl);
 
how does the content start?
 
�����ExifII*  �� ���(1�2�i�l��j.� SONYILCE-6000^^ILCE-6000 v2.002016:04:20 17:53:08PrintIM0300" ' '�
 
2:34 AM
Looks like jpeg file interpreted as text
Make sure there is nothing send before the header commands
PS: You should still check in the script that only .jpg files are delivered and that filename cannot be ../../../etc/something when someone accesses protect.php?filename=../../../etc/something or protect.php?filename=protect.php
 
Works, I just move the
$filename = $_GET['filename'];
$fileurl = $_SERVER["DOCUMENT_ROOT"].'/'.$filename;
before the if()
 
strange, moving these lines should not cause this behavior
 
Thank you for your time; I appreciate!
 
k, gn8
 

last day (14 days later) »