Jump to content

images upload safely !?

Go to solution Solved by Jacques1,

Recommended Posts

  • Replies 56
  • Created
  • Last Reply

Top Posters In This Topic

Top Posters In This Topic

Popular Posts

None of this makes a lot of sense.   You're delivering the image as an attachment, which specially tells the browser to only download the file and not display it, but at the same time you do want th

One thing I would point out. The practice of saving images in a db table is not the most efficient way to save them. Since images are files unto themselves there is no reason for storing them in a db.

There's no doubt that ajoo misunderstands how file serving works, so, yes, that needs to be fixed. But I'm not too worried about that, because you already explained it, he has a working implementation

Hi !




Rather than just accept that it now works, you would do well for yourself to find out exactly why it didn't work.


there is no problem in the code in #45 except for a small oversight. In this bit of code 

				if(isset($id) && $id !== 0){
					echo "<img src='ups6_view_2.php?id=$id' />";	

					echo "<img id='image' src='#' alt='load image' />";		// This displays the image.

the file that I am jumping to should have been 


and which is instead 


That was causing the issue.  There was an issue with the path names etc. which I guess I resolved in the earlier versions of this code.


So this is the tiny change needed to get this code going. 


Thanks !

Link to post
Share on other sites

Hi !


I have one final question on this. The code works fine but I am unable to move the script for the XSendfile, namely 


to a folder outside the root, say scripts, because then the image goes blank. I change the path to the scripts folder before invoking ups6_view_3.php. 


The access log shows:


"GET /vagrant/scripts/ups6_view_3.php?id=102 HTTP/1.1" 404 528 "http://upload_security.com/


So why is this not possible? 


Thanks all !

Link to post
Share on other sites

Hi Guru Jacques !


The script in question, ups6_view_3.php, is only being called to display an image, which is a part of a larger form, when the user searches for a record. The id of the user ( whose record is being searched for )  is extracted from the DB and get['id'] is used to pass it to the script to display the image which itself lies outside of the root.


My contention is that there is really no direct user interaction with that script and so if it is possible I would like to keep it outside of the root because I feel that it is the script that is directly loading the image, not the user. 


I also feel that if this script is directly user accessible inside the root then maybe it could be manipulated (by passing the ID using get directly ) to directly access the images somehow, which is something I would like to avoid if possible. 


Thanks loads !

Edited by ajoo
Link to post
Share on other sites

Your form uses the view script as an image source, and image sources have to be public by definition. That's why you're getting a 404 error as soon as you remove the script.


Again: The whole point of the view script is to be public and give access to the images. That's the only reason why it exists. Trying to hide it makes absolutely no sense.

Link to post
Share on other sites
This thread is more than a year old.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.