Include file from web inaccessible folder

[DjMikeS]

Hi guys,

 

I'm currently building a helpdesk system with tickets and stuff.

I want to add attachments to tickets. These attachments are stored in a web inaccessible folder called "attachments".  In this folder, there is a folder for each ticket which holds the attachments.

 

The folder is protected by a .htaccess file.

 

I want to include an image from this folder in the webpage so that user can view the attachments. I don't want users to browse the images directly....

 

Now, when someone browses to the attachment, a "Forbidden" error is returned. I would like to keep this...

 

How can I do this ?

[MadTechie]

basically use the force download

the script should be in an accessible folder but it should be set to read from the inaccessible folder

[ninnypants]

You could create a php file that imports the image then copies it then displays it with the correct header.

 

you could ten just link to it like so

<img src="img_handle.php?image=02349343" />

[DjMikeS]

I've tried your solution, MadTechie, it doesn't work as expected, but I want to show the image in the browser instead of forcing a user to download it.

 

Is that possible ?

I was thing about something along the lines of what ninnypants said.

So I thought about using readfile() and then turn that outputstream back in to an image but I couldn't find a function for it.

 

Can someone point me in the right direction ?

[trq]

Just remove the force-download header from the example MadTechie pointed you too.

[DjMikeS]

I tried removing the force-download header. Now IE gives me the option to download the png and FF wants to download the file.png.htm

When I try downloading and opening the file in FF I get the bytestream instead of the actual image, so I'm thinking that's a header problem.

 

I've changed it into this:

<?php
$url = arrayUrl($_GET['url']);
$file = $html->includeAttachment($url['2'], $url['3']);
header("Content-Type: image/png");
@readfile($file);
?>

But that gives me the following error:

The image “http://172.16.32.24/pecs/tickets/attachments/000001/screenie.png” cannot be displayed, because it contains errors.

I can confirm that the image on the server is correct.

 

What am I doing wrong ?

[MadTechie]

Remove the @ when testing for bugs!

also comment out the header("Content-Type: image/png"); to see if theirs an error at the start of the page

[DjMikeS]

Of course,  how could I forget the @...

 

I've removed the @ and the header. The output is:

�PNG  ��� IHDR�����l���+�8���sRGB�������gAMA

And a lot more of the same...

 

What am I missing ?

[MadTechie]

Okay well i don't see an error, if their was your notice it right at the top, thats PNG data so thats fine,

put the header back and reload that page it should load fine

[DjMikeS]

I've tried that but as soon as I uncomment the image/png header, FF starts complaining about the image containing errors and IE just outputs raw data...

Is there anything else I can try to figure this out ?

[MadTechie]

Try this

<?php
$url = arrayUrl($_GET['url']);
$file = $html->includeAttachment($url['2'], $url['3']);
if(filesize($file) >0)
{
header("Content-Type: image/png");
readfile($file);
}else{
echo "error too smalled check read permissions to file and folder";
}
?>

 

[DjMikeS]

I've tried that and it gives the same error. The filesize isn't zero because when I remove the header, it does output the raw data of the PNG. For some reason, I can't get the image to display properly.

[MadTechie]

well the data is being damaged somewhere then

[DjMikeS]

I'm using a custom build framework and I found out that the script itself is working. So I'm thinking that the framework is corrupting the data somewhere...I will have to dive in to this. For the time being, I could store the attachments (mostly images, screenshots) as BLOB in the database...

 

Is there a reason not to save the image as BLOB ?

[MadTechie]

Theirs reasons for storing it in a blob and reasons not to store it in a blob, personally (and most agree) I wouldn't store it in a blob, but theirs exceptions to every rule..

 

Can you test the images (just move a test one to a public area and view it)