Access Prevent Image Directory

[soma80]

Hello every one,

I prevent my image directory by using .htaccess file by :

 Options -Indexes

but when I tried to display image from this directory it's not display

echo '<img src="img/?????.jpg" />';

My question is .. how prevent directory an files inside it and at the same time I could display image .

Thanks

[Mittineague]

The "Options -Indexes" directive stops Apache from showing the default view of the folder's contents when it does not contain an "index" page. eg. where an HTTP request for www.yoursite.com/img/" would show something like

..
imgA.jpg
logo.jpg
menu.png

This does not stop someone from accessing the folder's contents once they know the details. eg. I could hotlink to your image using

<img src="http://www.yoursite.com/img/imgA.jpg" />

and your image would show in my page.

If you don't want anyone to be able to do that, you can put your image folder outside of your site's root folder (i.e. next to your "public html" folder) and access from your pages by "backing up" to it. eg. in your main index page located at www.yoursite.com/index.html you would use

<img src="../img/imgA.jpg" />

[Dan Grossman]

If you don't want anyone to be able to do that, you can put your image folder outside of your site's root folder (i.e. next to your "public html" folder) and access from your pages by "backing up" to it. eg. in your main index page located at www.yoursite.com/index.html you would use

<img src="../img/imgA.jpg" />

Ehrm, that doesn't work. The browser can't make an HTTP request for a URI below the document root.

[Mittineague]

:d'oh: Of course you're right about that. I must have been thinking about include -- or not thinking at all

So it's more complicated but not impossible.
You could do something like
<img src="./inc/imgA.php" />
where imgA.php fopens
../../img/imgA.jpg
and serves it with the right MIME type headers.

If you wanted to get fancy you could use Apache mod_rewrite to change requests like img/imgA.jpg into inc/img.php?image=imgA.jpg

Another benefit of having a PHP file get the image is you can test for SESSION cookie, etc if you want to to keep people from just hotlinking to the PHP file.