Hiding image filenames

**Pedro Graca** · Jul 17 '05, 04:41 AM

Re: Hiding image filenames

Steve Loft wrote:[color=blue]
> I know I can reference a php script in an img tag, and pass in a
> parameter to specify which image to return, and I can use $HTTP_REFERER
> to check that the script is being invoked by my page only. But the PHP
> manual warns that this is set by the browser and cannot be relied upon.
>
> So, is there a better solution?[/color]

You might want to use session variables.

On a script somewhere, set, for instance

$_SESSION['images'] = array(1, 4, 19, 55); // maybe you prefer names

to view a image put the script in the img tag

<img src="image.php? id=19">

and in image.php check that the id passed as a parameter to image.php is
set in the $_SESSION['images'] array.

So, if the user want to get cute and try image.php?id=13 nothing will
show (or display a error message, or a blank picture, ...)
--
USENET would be a better place if everybody read: : mail address :
http://www.catb.org/~esr/faqs/smart-questions.html : is valid for :
http://www.netmeister.org/news/learn2quote2.html : "text/plain" :
http://www.expita.com/nomime.html : to 10K bytes :

**Chung Leong** · Jul 17 '05, 04:42 AM

Re: Hiding image filenames

"Steve Loft" <steve@nybbles. co.uk> wrote in message
news:vm6ek1-19p.ln1@nybbles .co.uk...[color=blue]
> I have a PHP script which generates responses to answers submitted by a
> form. The responses contain links to images. I'd like to stop users
> guessing the names of other images and viewing them. I know I could use
> random unguessable filenames, but I wondered if there was a more elegant
> solution using PHP?
>
> I know I can reference a php script in an img tag, and pass in a
> parameter to specify which image to return, and I can use $HTTP_REFERER
> to check that the script is being invoked by my page only. But the PHP
> manual warns that this is set by the browser and cannot be relied upon.
>
> So, is there a better solution?[/color]

Use a session variable to store a list of image names. Your PHP script will
add the file names that the user can see at the given stage. The script that
outputs the image will check this list to keep the user from getting ahead
of himself.

In your response script:

// images viewable at each particular step
$image_lists = array(
1 => array('cow1.gif ', 'cow2.gif'),
2 => array('cow3.gif ', 'cow4.gif'),
3 => array('cow5.gif ', 'beef.gif')
);

$_SESSION['cow_pix'] = @array_merge($_ SESSION['cow_pix'],
$image_lists[$step]);

In the image script:

$filename = $_GET['img'];

if(@in_array($f ilename, $_SESSION['cow_pix'])) {
header("Content-type: image/cow");
readfile("$IMAG E_PATH/$filename");
}
else {
header("HTTP/1.0 404 Not found");
}

**Steve Loft** · Jul 17 '05, 04:42 AM

Re: Hiding image filenames

Chung Leong wrote:
[color=blue]
> Use a session variable to store a list of image names. Your PHP script will
> add the file names that the user can see at the given stage. The script that
> outputs the image will check this list to keep the user from getting ahead
> of himself.[/color]

That's great. Thanks to both you and Pedro for the suggestion, it's perfect.

--
Steve Loft

**Steve Loft** · Jul 17 '05, 04:42 AM

Re: Hiding image filenames

I wrote:
[color=blue]
> That's great. Thanks to both you and Pedro for the suggestion, it's
> perfect.
>[/color]

Except I'm having trouble getting it working. I decided to use the
following method: The name of the current image to be displayed is
stored in a session variable, then the script which displays the image
just uses the session variable to fetch the file.

My first script has this at the start:

<?php
session_start() ;
$_SESSION['imagename']= "../../hidden_files/default.jpg";

Then, later, in the path where I decide which image the user is going to
see, I do this:

$_SESSION['imagename']= "../../hidden_files/images/1tree.jpg";

and inside the HTML which follows I have:

<img src="images.php " />

The images.php file looks like this:

<?php
session_start()
$im =imagecreatefro mjpeg($_SESSION["imagename"]);
imagejpeg($im);
?>

But the image doesn't get displayed. The session_start() seems to screw
things up. If I put the actual filename in the images.php script instead
of using the session variable, it still doesn't work until I remove the
session_start() .

What am I doing wrong, please?
--
Steve Loft

**Dennis Biletsky** · Jul 17 '05, 04:42 AM

Re: Hiding image filenames

"Steve Loft" <steve@nybbles. co.uk> ???????/???????? ? ???????? ?????????:
news:1mdfk1-4fq.ln1@nybbles .co.uk...[color=blue]
> I wrote:
>[color=green]
> > That's great. Thanks to both you and Pedro for the suggestion, it's
> > perfect.
> >[/color]
>
> Except I'm having trouble getting it working. I decided to use the
> following method: The name of the current image to be displayed is
> stored in a session variable, then the script which displays the image
> just uses the session variable to fetch the file.
>
> My first script has this at the start:
>
> <?php
> session_start() ;
> $_SESSION['imagename']= "../../hidden_files/default.jpg";
>
> Then, later, in the path where I decide which image the user is going to
> see, I do this:
>
> $_SESSION['imagename']= "../../hidden_files/images/1tree.jpg";
>
> and inside the HTML which follows I have:
>
> <img src="images.php " />
>
> The images.php file looks like this:
>
> <?php
> session_start()
> $im =imagecreatefro mjpeg($_SESSION["imagename"]);
> imagejpeg($im);
> ?>
>
> But the image doesn't get displayed. The session_start() seems to screw
> things up. If I put the actual filename in the images.php script instead
> of using the session variable, it still doesn't work until I remove the
> session_start() .
>
> What am I doing wrong, please?
> --
> Steve Loft[/color]

Try next code
<?php
session_start() header("Content-type:
image/jpeg");readfile ($_SESSION["imagename"]);?>

**Steve Loft** · Jul 17 '05, 04:42 AM

Re: Hiding image filenames

I wrote:
[color=blue]
> <?php
> session_start()
> $im =imagecreatefro mjpeg($_SESSION["imagename"]);
> imagejpeg($im);
> ?>[/color]

Whoops. Missing semicolon! Works fine now :)
--
Steve Loft

**Steve Loft** · Jul 17 '05, 04:42 AM

Re: Hiding image filenames

Dennis Biletsky wrote:

[color=blue]
> Try next code
> <?php
> session_start() header("Content-type:
> image/jpeg");readfile ($_SESSION["imagename"]);?>[/color]

Yes, that works too - with the missing semicolon added!

And now it all works wonderfully, except that when I disable cookies and
use the URL to pass the session ID, the images stop being displayed
again. Any ideas, anyone?

--
Steve Loft

**Steve Loft** · Jul 17 '05, 04:42 AM

Re: Hiding image filenames

I wrote:
[color=blue]
> And now it all works wonderfully, except that when I disable cookies and
> use the URL to pass the session ID, the images stop being displayed
> again. Any ideas, anyone?[/color]

After staring at it for hours, I finally realised that PHP doesn't
automatically add the session ID parameter to img tags. Having put it in
manually using SID, it all works fine with and without cookies.
--
Steve Loft

**R. Rajesh Jeba Anbiah** · Jul 17 '05, 04:43 AM

Re: Hiding image filenames

Steve Loft <steve@nybbles. co.uk> wrote in message news:<loegk1-l2r.ln1@nybbles .co.uk>...[color=blue]
> I wrote:
>[color=green]
> > And now it all works wonderfully, except that when I disable cookies and
> > use the URL to pass the session ID, the images stop being displayed
> > again. Any ideas, anyone?[/color]
>
> After staring at it for hours, I finally realised that PHP doesn't
> automatically add the session ID parameter to img tags. Having put it in
> manually using SID, it all works fine with and without cookies.[/color]

No need to hard code. Just use "url_rewriter.t ags" with ini_set()
<http://in.php.net/ini_set>

--
http://www.sendmetoindia.com - Send Me to India!
Email: rrjanbiah-at-Y!com

Hiding image filenames

Hiding image filenames

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment