Forum

New Topic
Message Newest post at the top.

security tips

In a shared server environemt or as a result of an intrusion one cannot prevent that someone droppes a file into your album directory.

A little help is to prevent access to those files. You can do this if you can use .htaccess files and mod_rewrite is installed.

Add this to your .htaccess file:

RewriteEngine on
RewriteRule ^albums/.*\.(jpg|jpeg|gif)$ - [L, NC]
RewriteRule ^albums(.*) - [F, NC]
This will cause an access to fail for other then those listed extensions.

You can enhance this with reporting:

RewriteEngine on
RewriteRule ^albums/.*\.(jpg|jpeg|gif)$ - [L, NC]
RewriteRule ^albums(.*) /report.php [R, NC]
This will give some false alerts as Nimbda is still around and will trigger this.

You can prevent this at perfomance cost:

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^albums/.*\.(jpg|jpeg|gif)$ - [L, NC]
RewriteRule ^albums(.*) /report.php [R, NC]

Yo shit, I know how to get around this, but some will step into this.

Oki why not moving albums out of the document root? I did this long ago, but didn't realize how easy it is to use with Gallery.

Save this code into a file e.g. galimg.php:

<?

function acceptableImageList() {
return array('jpg', 'jpeg', 'gif', 'png');
}

function isImage($tag) {
$tag = strtolower($tag);
return in_array($tag, acceptableImageList());
}


// album directory

$gd = '/home/USER/albums';

// a banner

$banner = '/home/USER/www/banner.jpg';


$qs = substr($_SERVER['QUERY_STRING'], 0, 255);
$qs = strip_tags($qs, '');

$fs = urldecode($qs);
$qs = ereg_replace('[\:\*\?"<>\|;]', '_', $fs);


$ext = substr(strrchr($qs, "."), 1);


$fullPath = $gd . $qs;
if( ($qs != $fs) || (!isImage($ext)) || (!file_exists($fullPath)) ) {
$fullPath = $banner;
}

@readfile($fullPath);

?>


Now change in your gallery config.php file:

$gallery->app->albumDir = "/home/USER/albums";
$gallery->app->albumDirURL = "https://www.modelgraphy.com/galimg.php?";
$gallery->app->userDir = "/home/USER/albums/.users";
Replace USER and that domain accordingly and make sure albums is not in your document root.

I prefere another method:
config.php:

$gallery->app->albumDir = "/home/USER/albums";
$gallery->app->albumDirURL = "https://www.modelgraphy.com/albums";
$gallery->app->userDir = "/home/USER/albums/.users";

.htaccess:
RewriteEngine on

RewriteRule ^albums(.*) /galimg.php?$1
This disguises the script file and allows easier switching (some banners for hot linkers 😁 )

So now don't forget to move your albums directory into the proper location

Some words to the script. It makes some security checks and allows only those 4 image file types to be send If something else is requested, the banner is sent.

Have fun with this
Rowald

This works perfectly for www.modelgraphy.com
Author:
admin
2005-06-05
New Topic