Steve wrote:
> I have a pretty nice php web site, that's also reasonably secure.
> However, I wrote some php code to create some dynamic images based on
> database data, but I can't figure out how to secure this script?
>
> when I reference the php code via img src="myimage.php", none of my
> session variables are available for use in the script. So, without my
> session variables, how am I suppose to ensure that the script is only
> run by a valid user, rather than just anyone who can blindly type in
> random parameters to my image creation script?
>
> I'm really stumped on this one.
Not sure why you would be having problems with the session stuff, and anyway
it's not a perfect solution because it won't work if they don't have
cookies enabled.
I had a similar problem with one of the sites I manage, and it was
compounded by people linking to generated images putting additional load on
the server and generating additional traffic.
We recently released a completely revised version of the site with a new
design and I rewrote the engine that generates the images. Now instead of
generating the images by doing something like foo.php?param1=x¶m2=y
type of thing, we generate all the images while the page is being created
with what are essentially random image names (they're md5 hashes of the
data that goes into makign up the image).
The image is then saved to the filesystem and linked to in the page as eg
637b9aa7da08f0c649367a39f9d5023a.jpg Once every hour a script runs on the
server which deletes any of these temporary images that were generated more
than two hours ago. (If the image is requested again on a page and the file
exists, the timestamp is updated to the current time).
The advantage of doing it this way is that people cannot directly access the
image generation script, and there's no possibilty of hotlinking to the
image from another site as they'll get a broken image after 2 hours. The
only downside I can see is that if the browser returns a cached page after
a couple of hours they may end up with some broken images, but this appears
to be pretty rare from browsing the server logs.
This solution may or may not be useful for you depending on a variety of
factors. If you want some further info feel free to email me - just change
blackhole for chris in my email address.
--
Chris Hope - The Electric Toolbox -
http://www.electrictoolbox.com/