Advanced search  

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Pages: [1]   Go Down

Author Topic: Full Size Pics Outside web root  (Read 10754 times)

0 Members and 1 Guest are viewing this topic.

kper

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 20
Full Size Pics Outside web root
« on: May 12, 2005, 07:36:28 pm »

This may require too much restructuring, and may be beyond what Coppermine is intended to achieve, but it would be good to be able to store the full-size images in a folder outside the web root (for those who have this facility with their host), and therefore not directly accessible to the world.

This would mean that Coppermine could be used more securely for applications where you only want some people to be able to access full-size images (in conjunction, for example, with the mod to download them rather than displaying them in a javascript popup).

At the moment, Coppermine cannot be truly secure in this respect. The url for the full-size image can be guessed by looking at the properties of the thumbnail images, and then all you can do is use .htaccess and check for the referer (having disabled full-size popup windows etc.). The referer can, of course, be spoofed by determined image thieves.

I suspect that this design-feature is applicable to more Coppermine users than one might imagine - small image libraries, semi-pro photographers and the like, - which is why I make the suggestion.
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: Full Size Pics Outside web root
« Reply #1 on: May 13, 2005, 09:46:16 am »

good point, and yes, I agree that it would be nice if coppermine had the ability to store stuff outside of the web root and dynamically show this stuff (if permissions apply), but as you already suggested: this is hard to accomplish, so I'm not sure it will go into the core code. Mods/hacks that can do what you suggest would be very welcome.
Logged

kper

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 20
Re: Full Size Pics Outside web root
« Reply #2 on: May 16, 2005, 01:45:52 pm »

How about if it were possible simply to store the full-size images in a different  folder from the thumbs and intermediate size ones (though still under the web root), via a config option, just like it is currently possible to change file prefixes and, indeed, the name  of the albums directory?

Then chmod (or Windows permissions) could be used to make that directory not world-accessible.

Then someone who needed this feature could disable the javascript popups and apply the download mod
http://forum.coppermine-gallery.net/index.php?topic=6464.0

Would that work?

Logged

mickey174

  • Coppermine newbie
  • Offline Offline
  • Posts: 2
Re: Full Size Pics Outside web root
« Reply #3 on: June 02, 2005, 07:40:51 pm »

My request is similar to be able to store all images in a configurable directory either within my public web space orin my private space outside of my web space. This way I can choose where my images are placed. Functionality would include:

1) Configuration options for all album & image locations
2) Utilities to move the images to a different albuma or locations
Logged

kegobeer

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 4637
  • Beer - it does a body good!
    • The Kazebeer Family Website
Re: Full Size Pics Outside web root
« Reply #4 on: June 03, 2005, 05:28:01 pm »

I am experimenting with locating images outside of the document root, and it looks promising.  I work on it when time allows, so there is no timeframe when it will be complete or ready for testing.  Large filesizes can cause problems, but I'm looking into ways around potential problems.

There is a way to prevent hotlinking without images being stored outside the document root: htaccess file with deny all in it, and then use a php script to fetch and display the image.  A sample script would be like this: <img src="showimg.php?file=location\file"> - the showimg.php file would have the actual document location, then add the file variable to it and fetch the image.  The address shown would be "showimg.php?file=location\file", and the user wouldn't know where the picture is located.  For users without the ability to store files outside the document root, this would be a way to secure the images from hotlinking.  I may incorporate this into my code at some point to give another way to secure images.  IIS users may be left out in the cold unless there's a similar way to do it.

Moving images around isn't in my plans, as I believe images should be left alone once they are placed, and then let the database worry about what images are where.  It wouldn't be too hard to write a script to change database information if an admin decides to FTP the images to different locations, especially since FTP is much more efficient than letting PHP do the file moves.

Please don't respond asking for sample code or asking where I am in the coding process.  When I have something ready I'll post it.
Logged
Do not send me a private message unless I ask for one.  Make your post public so everyone can benefit.

There are no stupid questions
But there are a LOT of inquisitive idiots

kper

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 20
Re: Full Size Pics Outside web root
« Reply #5 on: September 12, 2005, 02:04:44 pm »


I notice that the new Gallery2 allows you to set up a data folder outside your web root as part of the install routine, which is very nice. It also suggests that others think it is a v useful option to have.

But G2 is SLOOOOOOW...

Thanks for looking into this kegobeer. I don't suppose it might go into the stable release of 1.4 ?

Logged

Tarique Sani

  • VIP
  • Coppermine addict
  • ***
  • Offline Offline
  • Gender: Male
  • Posts: 2712
    • http://tariquesani.net
Re: Full Size Pics Outside web root
« Reply #6 on: September 12, 2005, 02:48:32 pm »

This should not be too hard to code BUT this will also make CPG slower

#The basic code flow would involve - storing the fullsize files outside webroot
# Creating a file which goes into the img src in the displayimage.php instead of the URL for actual image.
What this new file will do is check if the user has permissions, then check what kind of file is requested send appropriate headers and use readfile() to output the image

But I do wonder how other media types will be handled... that is where the it gets P2C2E (process too complicated to explain)

So you are right this is not going into core code - but I would love to see such a mod :)
Logged
SANIsoft PHP applications for E Biz

kper

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 20
Re: Full Size Pics Outside web root
« Reply #7 on: September 12, 2005, 04:11:26 pm »

Quote
How about if it were possible simply to store the full-size images in a different  folder from the thumbs and intermediate size ones (though still under the web root)

That wouldn't impact performance, would it?

Webserver access controls could be specified on that folder (file permissions, plus htaccess, assuming Apache is being used); then pop-ups for full-size images could be disabled and the download mod applied instead ( http://forum.coppermine-gallery.net/index.php?topic=6464.0 )

Would that be a problem for other media types?

Logged

kegobeer

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 4637
  • Beer - it does a body good!
    • The Kazebeer Family Website
Re: Full Size Pics Outside web root
« Reply #8 on: September 12, 2005, 04:20:54 pm »

I have some cool things I've done - but my lack of time has prevented me from posting anything yet.  It's nice... and there aren't any slowdows that I've seen.  Plus, it allows you to put files anywhere you want, not just in the /albums directory.  It handles all media files just fine.
Logged
Do not send me a private message unless I ask for one.  Make your post public so everyone can benefit.

There are no stupid questions
But there are a LOT of inquisitive idiots

kper

  • Coppermine novice
  • *
  • Offline Offline
  • Posts: 20
Re: Full Size Pics Outside web root
« Reply #9 on: September 12, 2005, 09:14:49 pm »

Fantastic! I'll wait...

Thanks for putting the time into it, kegobeer.

Looking forward to it.

Will it be compatible with 1.4 when it comes? Or are you just doing for 1.3 ?

Logged

kegobeer

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 4637
  • Beer - it does a body good!
    • The Kazebeer Family Website
Re: Full Size Pics Outside web root
« Reply #10 on: September 13, 2005, 02:07:14 am »

1.4+.  It will not be available for 1.3.x.
Logged
Do not send me a private message unless I ask for one.  Make your post public so everyone can benefit.

There are no stupid questions
But there are a LOT of inquisitive idiots

Titooy

  • VIP
  • Coppermine addict
  • ***
  • Offline Offline
  • Posts: 736
    • under construction...
Re: Full Size Pics Outside web root
« Reply #11 on: September 13, 2005, 04:46:50 pm »

RatKing is also working on something similar. Maybe you should gather your knowledge...
http://forum.coppermine-gallery.net/index.php?topic=13732.20
Logged

radianation

  • Coppermine regular visitor
  • **
  • Offline Offline
  • Gender: Male
  • Posts: 79
    • Radianation
Re: Full Size Pics Outside web root
« Reply #12 on: September 11, 2006, 10:40:06 am »

Sorry for the late reply, but did this ever go anywhere?
Logged

Joachim Müller

  • Dev Team member
  • Coppermine addict
  • ****
  • Offline Offline
  • Gender: Male
  • Posts: 47843
  • aka "GauGau"
    • gaugau.de
Re: Full Size Pics Outside web root
« Reply #13 on: September 11, 2006, 12:55:01 pm »

Hasn't been done for cpg1.4.x.
Might go into future versions, but currently hasn't been implemented into any version at all.
Logged

RatKing

  • Contributor
  • Coppermine regular visitor
  • ***
  • Offline Offline
  • Gender: Male
  • Posts: 85
    • Personal website
Re: Full Size Pics Outside web root
« Reply #14 on: October 01, 2006, 10:38:48 am »

 :o I'm back...

Yes I have been working on something like this but the brief there included counting the amount of data used and giving the administrator the ability to prevent user groups (i believe it was) from viewing certain types of images. In other words a group would be able to see thumbnails but not intermediate or full size (they would get a no access image instead), where another group would get thembnails and intermediate but not the full size... etc.
Included in this was counting the exact amount of data used by each user to download the image files (not the rest of the page) and producing nice stats with that of course with the aim at sending bills out for each Mb or so  ;)

Anyway, this was a mod done for 1.3.X which was never completely finished. I'll have a looksy at what it was that I had done and see if I can push this into 1.4.9 (should not be very hard I hope)

I will limit the scoope of the thing or finish it on 1.3.X and port it to 1.4.9 later not sure. I should have some time on my hands in the near future so I hope to have this all done in a week or 2.

Logged

Paver

  • Dev Team member
  • Coppermine addict
  • ****
  • Country: us
  • Offline Offline
  • Gender: Male
  • Posts: 1609
  • Paul V.
Re: Full Size Pics Outside web root
« Reply #15 on: October 01, 2006, 06:06:28 pm »

@RatKing: Depending upon how much code you have written already, you might consider looking at writing the 1.4 version as a plugin so it's easy to apply, especially during upgrades.  Here's a plugin that might give you a starting point or some suggestions: Full-Size & Intermediate Photos Access Control.

I do realize that mods/hacks are much easier to write, but there a good number of ways to use the plugin system to do the same thing.
Logged

RatKing

  • Contributor
  • Coppermine regular visitor
  • ***
  • Offline Offline
  • Gender: Male
  • Posts: 85
    • Personal website
Re: Full Size Pics Outside web root
« Reply #16 on: October 02, 2006, 02:24:23 pm »

@RatKing: Depending upon how much code you have written already, you might consider looking at writing the 1.4 version as a plugin so it's easy to apply, especially during upgrades.  Here's a plugin that might give you a starting point or some suggestions: Full-Size & Intermediate Photos Access Control.

I do realize that mods/hacks are much easier to write, but there a good number of ways to use the plugin system to do the same thing.

You are right the code is all there I need to make a slight alteration but using the basics that I can see in the example plugins I think I should be able to make it into a plugin. All that is needed is changing source of every single photo that is shown on the site :-) (if someone has an real life example of such a plugin it would safe a lot of time)
All that the code does it is calls a php script that reads a file on the local file system, this file is then served to the browser as a image. So as long as the http server process is able to read the directory it will be able to serve the file from any location on your file system.
Logged
Pages: [1]   Go Up
 

Page created in 0.025 seconds with 20 queries.