English 中文(简体)
只允许从具体的html网页上获取图像
原标题:allow image access only from specific html page

I ve got different users for my website, owning different images which are all stored in the same folder. The images are stored in an incremental fashion, 1.jpg, 2.jpg etc. User can view these pictures on a specific php page. Now I want to restrict the access to these images only through this php page so that they can t simply enumerate all the filenames to see the images of other users.

我想用一个<代码>htaccess的文档进行这项工作,该文档除了存储在<代码>/shop/img/userimg/上的图像外,还将研究这样的内容:

RewriteEngine On
RewriteCond %{REQUEST_URI} !^/shop/shop.php [NC]
RewriteRule .*.(jpe?g|gif|bmp|png)$ - [F]

我的网址是分站(见:/shop/),而查看这些图像的网址是shop.php

现在这完全是可能的? 我做了什么错误?

最佳回答

请注意,查询人负责人不能信赖。 一些近似和防火墙完全拆除了头盔,因此,你必须说明其没有在场(第2行是这样)。

RewriteCond %{HTTP_REFERER} !/shop/shop.php$ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .(jpe?g|gif|bmp|png)$ - [F,L]
问题回答

请在您的查阅档案中添加以下内容。

RewriteEngine On
RewriteBase /

#if the referer (page request came from) does not contain shop.php
RewriteCond %{HTTP_REFERER} !/shop/shop.php [NC]
#and it is a request for images, then send a 403 forbidden
RewriteRule .(jpe?g|gif|bmp|png)$ - [F,L]




相关问题
Signed executables under Linux

For security reasons, it is desirable to check the integrity of code before execution, avoiding tampered software by an attacker. So, my question is How to sign executable code and run only trusted ...

MALICIOUS_CODE EI_EXPOSE_REP Medium

I run findbugs against all of my code and only tackle the top stuff. I finally got the top stuff resolved and now am looking at the details. I have a simple entity, say a user: public class User ...

XSS on jsbin.com

Anyone know if jsbin.com implements any protection for XSS or other javascript attacks? I see jsbin links used fairly regularly on sites like this one and I can t find any indication from the site ...

Make md5 strong

Im making a website that will intergrate with game that only support md5 hashing metod (atm). Which ofc is not especially safe anymore. But how could i make it stronger? Should I just generate long ...

Why running a service as Local System is bad on windows?

I am trying to find out the difference between difference service account types. I tumbled upon this question. The answer was because it has powerful access to local resources, and Network Service ...

Brute-force/DoS prevention in PHP [closed]

I am trying to write a script to prevent brute-force login attempts in a website I m building. The logic goes something like this: User sends login information. Check if username and password is ...

热门标签