Jump to content

images upload safely !?


ajoo

Recommended Posts

  • Replies 56
  • Created
  • Last Reply

Hi !

 

 

 

Rather than just accept that it now works, you would do well for yourself to find out exactly why it didn't work.

 

there is no problem in the code in #45 except for a small oversight. In this bit of code 

<?php 
				if(isset($id) && $id !== 0){
						
					echo "<img src='ups6_view_2.php?id=$id' />";	
					
				}else{

					echo "<img id='image' src='#' alt='load image' />";		// This displays the image.
				}		
			

the file that I am jumping to should have been 

ups6_view_3.php?id=$id'

and which is instead 

ups6_view_2.php?id=$id'

That was causing the issue.  There was an issue with the path names etc. which I guess I resolved in the earlier versions of this code.

 

So this is the tiny change needed to get this code going. 

 

Thanks !

Link to comment
Share on other sites

Hi !

 

I have one final question on this. The code works fine but I am unable to move the script for the XSendfile, namely 

ups6_view_3.php

to a folder outside the root, say scripts, because then the image goes blank. I change the path to the scripts folder before invoking ups6_view_3.php. 

 

The access log shows:

 

"GET /vagrant/scripts/ups6_view_3.php?id=102 HTTP/1.1" 404 528 "http://upload_security.com/

 

So why is this not possible? 

 

Thanks all !

Link to comment
Share on other sites

Hi Guru Jacques !

 

The script in question, ups6_view_3.php, is only being called to display an image, which is a part of a larger form, when the user searches for a record. The id of the user ( whose record is being searched for )  is extracted from the DB and get['id'] is used to pass it to the script to display the image which itself lies outside of the root.

 

My contention is that there is really no direct user interaction with that script and so if it is possible I would like to keep it outside of the root because I feel that it is the script that is directly loading the image, not the user. 

 

I also feel that if this script is directly user accessible inside the root then maybe it could be manipulated (by passing the ID using get directly ) to directly access the images somehow, which is something I would like to avoid if possible. 

 

Thanks loads !

Link to comment
Share on other sites

Your form uses the view script as an image source, and image sources have to be public by definition. That's why you're getting a 404 error as soon as you remove the script.

 

Again: The whole point of the view script is to be public and give access to the images. That's the only reason why it exists. Trying to hide it makes absolutely no sense.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.


×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.