Htaccess: Allow only gif, jpg and png images

Server Config
1

Hi,

Is there a .htaccess to allow only image/jpeg, image/gif and image/png to be loaded/executed/viewed? I’d like to not go by the extension (as that could be forged) by the actual type/handler or whatever it should be called.

I need to completely secure a directory so php files could in no way be parsed (even if they call it something.jpg and it’s php!).

Hope you understand what I mean,

Thanks,
Scott

2

A PHP file can be executed in your server only if it has a .php extension (maybe .php3 too).
So in case you are calling a php script as:
pippo.gif
when the browser will ak for pippo.gif he will receive a normal text file instead.
It won’t executed in your local server at all,
so don’t worry…
The type/handler is related to the extension…

:slight_smile:

p.s.
http://httpd.apache.org/docs/mod/mod_mime.html

3

oh okay, i’m just wondering if there is anyway to stop it (just incase someone does happen to get this .php file on the server)?

thanks

4

yup, there is, and i can tell you what it is for $5

5

One way to do it is this:

/path/to/images/dir/.htaccess


# If the URI is an image then we allow accesses
SetEnvIfNoCase Request_URI "\\.(gif|jpe?g|png|bmp)$" let_me_in

Order Deny,Allow
Deny from All
# Allow accesses only if an images was requested
Allow from env=let_me_in

:slight_smile: Andrea

6

Perfect thanks Andrea.

7

Hi again,

How would I go about preventing people from hotlinking except if it’s a direct request or the referrer is from (*.)ipbfree.com (please notice the wildcard).

Thanks.

8

Ooopss,
I didn’t see you posted another question.

This evening I’ll elaborate a solution for you,
sorry again :smiley:

9

Would this do the trick?


RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://*.ipbfree.com/.*$ [NC]
RewriteRule .*\\.(gif|jpe?g|png|bmp)$     -            [F]

Greets
Peter