Announcement

#1 2014-06-25 22:19:21

benhup
Member
Netherlands
2014-06-25
31

URL protection for derivative images, not only for original image

Hello guys,

I have been searching a lot about images being directly accessible via an URL, even when you have logged out. The solution for original images is to place in local/config/config.inc.php:

$conf['original_url_protection'] = 'images';

This will result in Piwigo proxying the image via action.php. Great stuff! So you have to be logged in to have access to the images.
The URL will obfuscate the image's true location, like:
/photogallery/piwigo/action.php?id=111111&part=e

With all non-original images (e.g. th, xxs, xs, small, medium, large, xl, xxl) the URL will just point to the image itself, like:
/photogallery/piwigo/_data/i/galleries/album1/image1-th.JPG
So even when you're not logged in: you have access to the images via direct url.

Why would that be?
I was looking in
http://piwigo.org/dev/changeset/20516
and
http://piwigo.org/dev/browser/trunk/act … ?rev=20516
trying to find out how to adapt the code to have the resized images also run thru action.php and ultimately obfuscate the image's true location.

When adding "Deny from all" in a .htaccess directory, this will secure all images from being accessed by individuals that are not logged in. Because I want only logged in people to access my files.

So what code to adapt to have ALL files run thru action.php and have all files in all albums have their /photogallery/piwigo/action.php?id=111111&part=e URL?

Piwigo version: 2.6.3

Hope someone versed in the code can help me out.

Thanks a bunch!

Best regards,
Ben

Last edited by benhup (2014-06-27 12:31:28)

Offline

 

#2 2014-06-26 00:41:38

benhup
Member
Netherlands
2014-06-25
31

Re: URL protection for derivative images, not only for original image

I have written some code to retrieve a sq, th, 2s, xs, sm, me, la, xl and xx image sizes via action.php.

The adaption in action.php that is needed:
Put this code in the switch on line 119, below case 'r':

case 'sq':
  case 'th':
  case '2s':
  case 'xs':
  case 'sm':
  case 'me':
  case 'la':
  case 'xl':
  case 'xx':
    $part = $_GET['part'];
    $deriv = new DerivativeImage(IMG_XXLARGE, new SrcImage($element_info));
    $file = get_element_path($element_info);
    $file = './_data/i/'.$file;
    $picture_exts = implode('|',$conf['picture_ext']);
    $file = preg_replace('/\.('.$picture_exts.')$/i','-'.$part.'.${1}',$file);
    break;

And don't forget to update line 64 of action.php:

or !in_array($_GET['part'], array('e','r','sq','th','2s','xs','sm','me','la','xl','xx') ) )

Next step is making Piwigo use the action.php link, not only for original images, but also for the resized images!

So, any ideas on what code/file to adapt to make an album use action.php for resized images?
Anyone?

Thanks!

Best regards,
Ben

Last edited by benhup (2014-06-28 02:04:26)

Offline

 

#3 2014-06-27 01:38:15

benhup
Member
Netherlands
2014-06-25
31

Re: URL protection for derivative images, not only for original image

And the story continues:
To make use of the new action.php ability...

In /piwigo/include/derivative.inc.php replace in function build in the last else statement:

$rel_url = $rel_path;

with

$rel_url = get_action_url($src->id, substr($params->type,0,2), false);

Now also resized images are requested via action.php.

Only one problem:
The first time you visit an album image, the original url is shown (e.g. _data/i/galleries/album1/image1-sm.jpg). The second time you visit the image, the image is shown correctly via action.php.

Anyone know why the first time an image is visited (and the resized images need to be generated) original path is still used? (e.g. _data/i/galleries/album1/image1-sm.jpg).

Thanks for your help!

Last edited by benhup (2014-06-27 01:54:50)

Offline

 

#4 2014-06-27 14:55:40

mistic100
Former Piwigo Team
Lyon (FR)
2008-09-27
3271

Re: URL protection for derivative images, not only for original image

Can I move this topic to "Requests" and delete your other one which is almost identical ?

And also your are not the first person to investigate this it worth a search on the forum

Offline

 

#5 2014-06-27 14:58:34

benhup
Member
Netherlands
2014-06-25
31

Re: URL protection for derivative images, not only for original image

How to enable Piwigo to use action.php, even when the derivative (resized) image is not created?
Well i.php is cakked, the derivative created and the url updated with an AJAX call. i.php retruns JSON to replace the original i.php url in the album.

Very neat, but how to enable Piwigo using action.php after the derivative is created? So not using the direct url to the file?

In /piwigo/i.php change:
1. Function send_derivative($expires), change it to:

send_derivative($expires, $id = null)

2. in function send_derivative($expires, $id = null): change the JSON line into:

echo json_encode( array( 'url'=>embellish_url(get_action_url($id, substr($page['derivative_type'],0,2), false)) ), JSON_HEX_AMP );

3. Line above "include_once(PHPWG_ROOT_PATH . 'admin/include/image.class.php');" add:

$id = '';

4. the Last "send_derivative($expires);" in the file, change it to:

send_derivative($expires,$id);/

Next problem to tackle:
When selecting an image and then select a different size, shows direct URL again. I think that can be resolved in derivative.inc.php. To be continued...

Best regards,
Ben

Offline

 

#6 2014-06-27 15:06:32

benhup
Member
Netherlands
2014-06-25
31

Re: URL protection for derivative images, not only for original image

mistic100 wrote:

Can I move this topic to "Requests" and delete your other one which is almost identical ?
And also your are not the first person to investigate this it worth a search on the forum

Hi Mistic100, thanks for your reply! Yes you can...

I know I'm not the first person to mention this. But I am (as far as I can read on the forum) the first person to actually come up with some code to make this happen!

I need some one to help me out to meet the 'clean-code'/conventions of Piwigo. It works so far, but I doubt you guys will rate my code with a "100% happy score" :D

So last thing to do: when you select a different size in an album, the direct URL is shown again... The solution probably lies in derivative.inc.php.....

Help is/pointers in right direction are appreciated!

Best regards,
Ben

Last edited by benhup (2014-06-27 15:07:20)

Offline

 

#7 2014-06-27 16:30:22

flop25
Piwigo Team
2006-07-06
6964

Re: URL protection for derivative images, not only for original image

hi
the dev who did the derivative system is rvelices, if you want to contact him


To get a better help : Politeness like Hello-A link-Your past actions precisely described
Check my extensions : more than 30 available
who I am and what I do : http://fr.gravatar.com/flop25
My gallery : an illustration of how to integrate Piwigo in your website

Offline

 

#8 2014-06-27 16:36:44

benhup
Member
Netherlands
2014-06-25
31

Re: URL protection for derivative images, not only for original image

Hi flop25,

Great! By personal message then? We'll do..
Thanks!

Ben

Offline

 

#9 2014-06-28 00:56:59

benhup
Member
Netherlands
2014-06-25
31

Re: URL protection for derivative images, not only for original image

I also notice that i.php will create and display a derivative, when a user is not logged in.
No authentication of a user is done. action.php does authentication properly.

I understand this for guest users, but authentication is needed for all private/non-public images.

Offline

 

#10 2014-06-28 05:55:25

rvelices
Piwigo Team
2005-12-29
1960

Re: URL protection for derivative images, not only for original image

I think it's better if you do all the checks in I.php and always use it instead of action.php


However this will require more changes in I.php because now it doesn't include common.inc.php so you won't know the user who is requesting it.

Also keep in mind that
Your site will be a lot slower
You will still have issues with sent emails or rss feeds that link to private images.

Offline

 

#11 2014-06-28 11:01:57

mistic100
Former Piwigo Team
Lyon (FR)
2008-09-27
3271

Re: URL protection for derivative images, not only for original image

One thing important to me is to not do the heavy check when the image is embedded in a page where we already did the check

this could be done with a token (get_ephemeral_key ?) which will skip the check if valid
perhaps the same can be used for notifications (for RSS it's more complicated...)

Offline

 

#12 2014-06-28 13:22:10

benhup
Member
Netherlands
2014-06-25
31

Re: URL protection for derivative images, not only for original image

I did create some patches. See:
http://piwigo.org/bugs/view.php?id=3096

But I only tested it for/piwigo/_data/i/galleries/ data
With my patches, the first time generation is done via i.php, then when the image already exists, you are not allowed to retrieve the image via i.php anymore.

Each successive retrieval of the image is done via action.php.
(very neat a tidy url compared to including a relative path of an image/file in the url).

Additional bonus: when an album or file contains spaces or any other non-allowed chracters... With my patch it doesn't matter, because the action.php url will only contain an numeric id and what size you want to retrieve....
So the flamewars (just kidding) about "you should make all your galleries directories and files use only a-z, A-Z, .-_" versus "I don't want to rename all my files!" are solved as well with these patches...

I didn't use any methodological testing, but at first sight, it works for images...

I didn't incorporate the "is user allowed to generate this picture" check in i.php.
I tried to figure out how that should work, but with including common.inc.php I already got all kind of function collisions (function already exists).

So, is my code a nice starting point/incentive for the Piwigo Experts among us?

Again thank you for considering.

Last edited by benhup (2014-06-28 16:23:24)

Offline

 

#13 2014-06-28 16:37:27

benhup
Member
Netherlands
2014-06-25
31

Re: URL protection for derivative images, not only for original image

Hi rvelices,

However this will require more changes in I.php because now it doesn't include common.inc.php so you won't know the user who is requesting it.

How to check if the request (to retrieve an image) is authorized?

Also keep in mind that Your site will be a lot slower

I doubt that the site will get as slow as Gallery2 :) But without joking: a little performance cost is allowed to facilitate this. as you can see all my code does the 'original_url_protection' check. So when you don't enable it, you don't feel any performance hit. But even with original_url_protection enabled, getting the highest performance is important.

You will still have issues with sent emails or rss feeds that link to private images.

This of less concern to me. With a private album, people have to login, that is the purpose of the added security. I have to interest in RSS or sending mails. People should login, if they want to access images.

So... How about the authorization part? How to get that into i.php?

Last edited by benhup (2014-06-28 16:39:39)

Offline

 

#14 2014-06-28 23:02:57

benhup
Member
Netherlands
2014-06-25
31

Re: URL protection for derivative images, not only for original image

@mistic100:

this could be done with a token (get_ephemeral_key ?) which will skip the check if valid

I found an example here: http://phpcrossref.com/xref/piwigo/regi … p.html#l85
At lines 44 and 89, respectively

if (!verify_ephemeral_key(@$_POST['key']))

and

$registration_post_key = get_ephemeral_key(6);

So the question is in what places to put the get_ephemeral_key() function... to verify_ephemeral_key() it in in i.php....
functions.inc.php should also be included in i.php to make this work, I guess...

Last edited by benhup (2014-06-28 23:04:07)

Offline

 

#15 2014-06-30 12:55:01

benhup
Member
Netherlands
2014-06-25
31

Re: URL protection for derivative images, not only for original image

Looky, looky what I found here:
In 2011 there was already some discussion by plg, rvelices and flop25...
Let me add it to this thread for reference:
http://piwigo.org/forum/viewtopic.php?id=18570&p=2

Offline

 

Board footer

Powered by FluxBB

github twitter facebook google+ newsletter Donate Piwigo.org © 2002-2019 · Contact