Control access to files based on DB values with PHP/Apache

Question

What i want

I'm making a system where, when a user uploads an image it goes to the folder images, where there is two copies of the image, a thumb and a bigger one.

Now, when a user uploads an image it's done alongside insertion of a row in a MySQL database, where the image gets an id, and the row holds a value that determines if the images is available to the public or not (1 for only thumb available, 2 for both) along with the owner(admin) of the image.

What i wan't to do is, if a user tries to reach the image by going to the image's URL, and the value in the database says that it should not be publicly available, and the session of that user is not the owner of the image, (admin not logged in) it should either say image not found or access denied.

What i imagine

If it could be done with php i imagine something like this:

//User tries to go to URL "images/IMAGE-ID_thumb.jpg"
if($img['access'] >= 1 || $_SESSION['admin_ID'] == $img['owner_ID']) {
  //Show image thumb
}
else {
  //Access denied
}

I could maybe hide the images in a .htaccess protected folder, make a imgae_get.php that accepts URL variables, sees if the image is available, and loads the image if so. I just want to avoid having to de/re-compile the image and other server power consuming processes.

My question is, can i control the image like this? Is there a way to make a php script appear as an image it loads internally? Or is there maybe some other/better way than through PHP? (Apache maybe?) Any suggestions is much appreciated.

score 5 · Accepted Answer · answered May 17 '11 at 12:43

5

//get_image.php

//Do session/mysql checks as outlined in your code above.

header("Content-Disposition: filename=$imagename.$filetype");
header("Content-type: $mimetype");
readfile(PROTECTED_IMAGE_FOLDER . "$imagename.$filetype");

answered May 17 '11 at 12:43

Explosion Pills

188,624
52
326
405

score 4 · Answer 2 · answered May 17 '11 at 12:46

You can redirect all requests for certain filetypes (or filenames, anything you can regex) with an '.htaccess' file in your DocumentRoot:

RewriteEngine On

RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule \.(gif|jpg|jpeg|png)$ imageHandler.php [NC,L]

You can determine the original request from the $_SERVER superglobal, and use the appropriate headers to alert the browser you're returning an image. Then you read the image from disk (with file_get_contents() or similar) and write it to the browser with echo, in the same way you'd output HTML.

Thanks, combining your answer with @tandu's would be my final solution, actually hiding the php behind it from the users as well. +1 :) — Kristoffer la Cour, May 17 '11 at 12:54

Lawrence Cherone · Answer 3 · 2015-04-02T14:22:28.303

.htaccess

#mod_rewrite
RewriteRule ^(.*)_(full|thumb).(jpg|png|gif)$ image.php?i=$1&type=$2&ext=$3

HTML

<img src="http://example.com/image-1_thumb.png" />
=
<img src="image.php?i=image-1&type=thumb&ext=png" />

PHP (image.php)

<?php 
// do basic sanity checks on input
$_GET['i'] = isset($_GET['i']) ? basename($_GET['i']) : null;
$_GET['type'] = isset($_GET['type']) ? basename($_GET['type']) : null;
//unsafe way
//$_GET['ext'] = isset($_GET['ext']) ?  basename($_GET['ext']) : null;
//safe way
$_GET['ext'] = in_array($_GET['ext'], array('png','gif', 'png')) ? $_GET['ext'] : null;

## Do DB Checks on session to owner ect 
/* $_GET
    [i] => image-1
    [type] => thumb
    [ext] => png
*/

// then output
if (file_exists('hiddenimagesfolder/images/'.$_GET['i'].'_'.$_GET['type'].'.'.$_GET['ext'])) {
    header("Content-Type:image/png");
    readfile('hiddenimagesfolder/images/'.$_GET['i'].'_'.$_GET['type'].'.'.$_GET['ext']);
} else {
    //not found
}
?>

score 0 · Answer 4 · answered May 17 '11 at 12:49

"mod_rewrite" all attempts to access image via a fake path name to PHP file with the image file name as a query param and then do your magic there. Storing the images outside of the public folder should prevent any unwanted public access. Alternatively store the actual image in the DB itself.

Control access to files based on DB values with PHP/Apache

What i want

What i imagine

4 Answers4