For security reasons, one may wish to locate their files directory outside of the web root so the files aren't browsable by strangers. Unfortunately, imagecache doesn't seem to work with this configuration. :(

Any idea how hard this would be to fix? And/or if I'm just doing something silly?

CommentFileSizeAuthor
#5 imagecache-allow-outside-src.patch380 bytesragaskar

Comments

dopry’s picture

hrm... It isn't really intended for this use case... I didn't develop it with that in mind... however you could add a basepath to the preset options for the files... which could be absolute... or you could pass a relative path including ../.. etc in the url following the preset namespace.

m3avrck’s picture

Additionally, based on this I'm assuming it won't work with private downloads then, when files are /system/files ?

peterpiper’s picture

Hi,

I have a multisite setup and am forced to use the full server path to the files folder: /var/www/html/www/example.com/files
Unfortunately this seems to not work with CCK, image_field and imagecache.

How would one go about using imagecache with this type of setup:

Files path: /var/www/html/www/example/com/files
Web accessible path to files: http://www.example.com/files

Multisite drupal: /var/www/html/cms
Web root: /var/www/html/www/example.com

Thanks for any help!

dopry’s picture

@m3avrck, your assumption is correct. I'll think about how to do it and try to make it work once I've finished stripping the image processing out of imagecache.

@Peter it should work work for you if you are using public files.... I'm not sure about how you have the filesystem laid out though... The recommendation for files with multisites is /sites/default/filed and sites/example.com/files. Could you reopen your issue as a support request?

ragaskar’s picture

StatusFileSize
new380 bytes

I assumed this behavior (only scaling images inside the files directory) was intended for security reasons. Is this not the case? I seem to have no trouble using imagecache on files outside the file directory by adding

$src=$src?$src:$path;

after

$src = file_create_path($path); on line 170.

if there are no security issues of which you're aware (i can't think of any offhand, but I prefer being safe, of course), i'll go ahead and leave it in! ;)

also made a patch, but I'm not positive I've done so correctly.

dopry’s picture

Version: 4.7.x-1.x-dev » 6.x-2.x-dev
Status: Active » Fixed

This is supported in HEAD....

Anonymous’s picture

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.