CODEWITHSUNDEEP
phphtml.htaccess
elu
elu

Reputation: 7

deny access php page but still make it possible to be included

I am currently running a PHP website, and I was wondering if there is any way to deny access to an image, if the directory was entered in the browser bar, but still be able to use said image in my Page with the <img src=""> tag. I store said image in a directory called "images" which is on the same level with my main page "home.php". I am familiar with the .htaccess file and the deny from all command in it, however, as I said, it will not display the 'forbidden' files in the other pages. I hope that somebody can help me. Thanks!

Upvotes: 0

Views: 68

Answers (3)

Markus
Markus

Reputation: 438

You can accomplish this many ways, but internet jargon this is called "hotlinking". You can use this tool http://www.htaccesstools.com/hotlink-protection/ to create your own .htaccess file.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourdomain.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]

Upvotes: 0

Mike Robinson
Mike Robinson

Reputation: 8945

Basically, I believe that the answer would be "no," because in both cases the user's browser is the party making the request.   Apache might not know or be able to distinguish between two "reasons" why the browser is making such a request.

On the other hand, programmatic code within your host-side application possibly could. Either directly or using mod_rewrite tricks, you could direct the incoming request to a server-side script, which can examine the entirety of the HTTP request and determine what sort of response it should produce:   image-content, or 404.   In this scenario, Apache accepts the request ... does not Deny it ... but instead of serving the image directly itself, it hands-off to a script which makes that decision. (The script can still gulp the data from a file, probably from a directory that Apache will not directly serve at all, so it can be "reasonably fast.")

By the way:   you can use directives, at the <Directory> or <Location> level, to force "hand this request off to such-and-such script" behavior, so that, when the user's browser "requests such-and-such image," Apache runs that handler-script instead, passing a URL that includes the name of the requested file. The user won't be able to know what actually happened.)

Upvotes: 0

Fakebounce
Fakebounce

Reputation: 707

Maybe you can try this:

<Files "./your_directory/yourfile.png">
Order Allow,Deny
Deny from all
</Files>

Upvotes: 1

Related Questions