Question

Right now I am using base64 to control who has access to images on my website. I store these images outside of the webroot directory so no one has direct access to them. I then determine who has access to these images by what records they have access to in a postgresql database. Basically if they can query record “a” then they can see picture “a”.

if (file_exists($pic)) {
    $imgbinary = fread(fopen($pic, "r"), filesize($pic));
    $picbase64 = "data:image/gif;base64," . base64_encode($imgbinary);
    echo('<img src="' . $picbase64 . '" />');

How can I use readfile instead of base64 while still maintaining my security? For example when using the readfile method to deliver the images to the clients browser this requires me to use the $_GET method to send a variable to a php script that has the readfile and header type that then displays the images on the clients browser. The problem is anyone can look at the html source and see the <img src=phpscript.php?imagename=foo.jpg /> and then call the script in their browser with any argument they like http://www.hostname/phpscript.php?imagename=bar.jpg . With the base64 method I am currently using this is not possible since I do not need to have a separate script to process my images that takes a $_GET argument, instead the images are embedded directly in the html page.

Thanks for any help!

-Edit-
Sorry guys I failed to mention that there is also anonymous access allowed and certain information is public. Meaning if you are not authenticated and you can read record “a” you can also see image “a”.

Answer 1

The substantive difference between what you’re doing now and what you need to do is to send the files over multiple requests. This requires authenticating or otherwise remembering the user between requests.

What you have right now is:

if (file_exists($pic)) {
    // do stuff
}

And what you need is:

if (file_exists($pic) && user_has_image_permission($pic)) {
    // do stuff
}

So the details you need to settle on are the logic behind the user_has_image_permission() function.

If you need this to be secure, I’d be inclined to approach this with sessions, but you could also use cookies.

If you don’t mind trading some security for a bit of simplicity, you could use some sort of “url pass phrase”, like those commonly used to share documents and files in web services like “anyone with the link” in Google Docs, AWS, private RSS feeds, etc.

Finally, you could use a solution completely outside of PHP, based on http authentication. In Apache, this takes the form of Access Control.