Question

This is more of a conceptual problem.

I have a server, and I have a bunch of downloadable files for which I would like to add a download limit and at the same time log requests. The files have a common set of extensions like JPEG, GIF, and PNG. I know this could be a breeze by setting up a redirection script, but there are a couple of issues with that:

1. The plain links have been out there for a while, and the redirection script can be bypassed by simply entering the old URL.
2. The directory structure is truly messy, and that means the script will have to accept the directory in which the files exist, and that will open the door to traversal attacks and whatnot – I know the data can be sanitized.

So, the real question is, how can I accomplish that transparently? I thought of using mod_rewrite in combination with a PHP/Perl script to achieve that, but I am a bit concerned about the possible security repercussions.

Is there any other way?

Thanks!

Answer 1

I’d say mod_rewrite is the (simple) answer.

Rewrite requests for images inside your webroot to a script, and as you mention, sanitize the input making sure the file is indeed an image and inside your webroot.