Security Issue with private exhibitions!

[HMetal]

Pekka,

If I make a new exhibition, and make it a password protected exhibition, everything works fine from a PHP standpoint.

HOWEVER, discrete images are not protected from prying eyes. If someone happens to guess the filename of an image in the "photos" directory, they can view the image itself regardless of entering an exhibition's password by bypassing EE and viewing the image in their browser.

eg. instead of using the actual EE page at, for example:

http://mysite/photo.php?photo=8&exhibition=1&pass=my123&size=default&lang=eng
if the user uses the URL for the image itself - the image for photo with SQL ID #8, above, they can view your "private" photos with ease.

eg.
http://www.mysite.dom/photos/myphoto1.jpg
There is currently no way to secure the photos directory and its child directories without affecting normal EE operation.

Thus, I propose the following to fix EE and make ALL photos truly secure:

1. EE should be modified so that never, in any way, is a photo directly linked to in its storage directory. (see #2)
2. Use a sender script in all img tags. eg. <img src="http://www.yoursite.com/image.php?photo_id=8">
3. the sender script (image.php in the above example) should check that the user who requested image X (where X, for my examples here, is 8 ) has access to it (e.g. is the image in a private exhibition? If so, has the user entered the password to view it?). this could lead to even more security and privacy options for exhibitions and EE in general as,
4. We can then make our "photos" directory completely inaccessible by using an .htaccess file containing "deny from all". The only thing that would be accessing our photos is the sender script, image.php and only after it has made sure the user has supplied the proper access password (or whatever future access controls EE has implemented). No user can "browse" our images PERIOD. No blank index.html files, no "Options none" in .htaccess to prevent directory listings (where a user can still access a file if they know the filename, etc.).

"deny from all" in .htaccess completely locks out users from viewing the contents of the directory through the webserver but PHP can still access and send the file from that directory, after checking internal EE access rights. You simply send the proper HTTP headers and dump the image file contents to the browser. It's a simple thing to do in PHP.

This would completely secure photos/exhibition access (e.g. some people may have nudes they don't want family to see, but are okay with others viewing them..)

As a website developer with much PHP experience, I have done this kind of thing for clients, so if you would like help, feel free to shoot me a private message or reply here.

I've sure it would benefit everyone to have this capability in EE. http://www.photography-on-the.net/forum/images/smilies/icon_smile.gif

[MMCM]

I thinks there's a simpler way to do this:
If you select "Localize normal images" in the Misc. Settings Page, EE copies all requested images to a temp directory (with a random name), which holds only a user specified maximum number of files. So you cannot see the names of the original files.
If you protect your directories with .htaccess or by authentication, no one will be able to see other images than he can select within EE.
Drawback: performance impact, as every images must be copied locally on the server, before viewed by the client.

I never really tested it, but I hope this helps you,
Martin

[HMetal]

I thinks there's a simpler way to do this:
If you select "Localize normal images" in the Misc. Settings Page, EE copies all requested images to a temp directory (with a random name), which holds only a user specified maximum number of files. So you cannot see the names of the original files.
If you protect your directories with .htaccess or by authentication, no one will be able to see other images than he can select within EE.
Drawback: performance impact, as every images must be copied locally on the server, before viewed by the client.

I never really tested it, but I hope this helps you,
Martin

Martin,

I realize that this is a way but in this case simpler is not better. I don't want that performance hit, as it is because of EE's excellent response time that I moved to EE from Gallery version 2 (G2), and also because I like EE's layout better. Having the extra performance hit would be a step backwards for me.

I do a lot of glamour and nude photography and I would like to give certain people access to view those (e.g. clients, etc) in a secure environment.

It would really benefit EE to implement more/better security of the images. I was using Gallery but, to be honest, it is useless to me as the more photos you add to it, the slower it becomes. The one advantage of Gallery over EE is that G2 (Gallery 2) implements a security model such as I described in the topic post as I was the one that asked for that feature some time ago.

Pekka - can you let us know if you are going to implement this? If not, I'll hack my copy of EE and implement it. It would be a pain though as I'd have to diff and apply changes you make to future versions of EE. http://www.photography-on-the.net/forum/images/smilies/icon_sad.gif

If it makes a difference (and being a developer, I know it's nice to get paid for this stuff), I would gladly pay/donate to EE for a better security model.

[MMCM]

Another guess: Create separate directories (path setup) for each exhibition (or maybe a group of similar exhibitions) and secure those with a browser login (.htaccess). Even if somebody manages to find out the EE password or the URL of the pictures, he had to login first to see those.
A normal customer has to know the userid and password, and will be required to login at the first access to the gallery. Without login, there would be no pictures displayed.

[HMetal]

Another guess: Create separate directories (path setup) for each exhibition (or maybe a group of similar exhibitions) and secure those with a browser login (.htaccess). Even if somebody manages to find out the EE password or the URL of the pictures, he had to login first to see those.
A normal customer has to know the userid and password, and will be required to login at the first access to the gallery. Without login, there would be no pictures displayed.

Sorry, that just defeats the purpose of EE. If I wanted to do that, I wouldn't need EE to manage anything. I'd just throw an HTML page up with an .htaccess on it.

Nope, it won't do.