By BlindWolf8 on

Hello all,
I was searching around for a solution for protecting images.

I'm using:

  • Imagefield
  • Imagecache

Here's the scenario:

  • You want people with accounts to be able to upload images
  • You want thumbnails with watermarks from these uploaded images to be generated
  • You DON'T want anonymous users being able to leech the original, unwatermarked images from your site

What's my solution?

  1. Move your files above your "public_html" or "www" directory (Duh!)
  2. Change the new File system path to the new location on the server (Site configuration -> File system)
  3. Enable Private Downloads in the Drupal admin interface (Site configuration -> File system)
  4. Give EVERYONE the permission "view imagecache..." (User management -> Access control)
  5. Give everyone EXCEPT "anonymous users" the permission "view imagefield uploads" (User management -> Access control)

As far as I know, (and I have tested this) this will block sneaky users from typing in an exact address to an original image. They're given a 403! (Access denied)

Seems too simple, I know, but no one really posted this solution, at least none that I could find. If anyone has any warnings for me going forward, people let me know.

Thanks all!

⋅ Categories: Drupal 5.x

Comments

jainrutgers’s picture

jainrutgers commented

or simply try this....change the permission of he folder in which all original images are there (change permission to 772)

Chetan

BlindWolf8’s picture

BlindWolf8 commented

The only issue I can see with this is that the original image wouldn't be seen by people who are allowed to see it when editing the node, which is minor. Would I need to modify the permission of each new file I put inside the folder, or would it not matter? I'm assuming no, since you took away execute (traversal) permissions.

jainrutgers’s picture

jainrutgers commented

if you set permission to folder then it is applicable to its content also (i:e files).

marcoka’s picture

marcoka commented

the problem with this is that anonymous users can not see imagecache presets if you do not give view "field_name" permission. if you do that every visitor can access the original files.

Mark Nielsen’s picture

Mark Nielsen commented

For some reason, changing permissions on the images directory to 752 didn't work for me. This is likely to be because of some configuration on my server is set up, and I'm not confident enough to change this.

Instead, I've used an .htaccess file to address this problem. Here's mine:

<FilesMatch "\.(jpg|JPG|jpeg|JPEG|gif|GIF|png|PNG)$">
 Order Allow,Deny
 Deny from all
</FilesMatch>

Just create an .htaccess file containing the above code, and put it in the same directory as the images you wish to protect, and all should work fine.