Guests Accessing Original Images

[pablozed]

I have a small problem with original images opening in a new window and hope someone can help.

On my site guests do not have permission to view original images, however they can view thumbnails and the larger image (permissions are set in admincp). I have also enabled the 'open in new window' option, although despite disabling their access to original images, a guest is still able to view the original with these settings.

If I disable the 'open in a new window, option their access to original images is denied however I do not like the way it looks as the images are very large and it stretches the layout (for registered users).

I am not sure if this is a bug or my configurations. Although I was assuming that if I disabled guest access to original images that they wouldn't be able to access them regardless if opened in a new window or not.

Any ideas?

[Luciano]

well i think there is no way of really preventing it..
I am working on a fix for my site.. because i want to disable hotlinking..
but i have lots of other things to do.. and it wont be finished before a month or so..

anyway as it is.. anyone can see the original picture.. you just write down the url of the medium picture and call the original pic directly.. by adding "original" in the url..

what i am planning: use a viewpic.php?pic_id=x for ever picture and every thumbnail.. so nobody can find the url. the files directory should be renamed to some md5 hash like: 0a430e22db18c61717defee4df21bf6f
but this mod will require lots of modifications and new files..
other drawback: an upgrade of the gallery when a new version comes out will only be possible if you edit each file manually..

but stay tuned.. i will post in the mods forum as soon as it is ready (time frame 2 months)

Luc

[pablozed]

I just checked and you are in fact right. Anyone can access the original image if they know the full url. The gallery and images are a big factor to my site and I don't want just anyone accessing the images.

I think a mod for this is necessary. I look forward to see what you come up with Luciano.

[Luciano]

well i just posted an alpha version of that hack

attention: it is only alpha which meens i have only tested on my localhost.

it will cost some ressources.. havent figured out yet how much..

it handles permissions for originals a bit better and users will not see your files!

take a look:
http://www.photopost.com/forum/showthread.php?t=130589

Luc

[msimplay]

I'm sure earlier releases used to have this already :S
Fedoraforum has it on their vbgallery installation what happened with new updates ?
I don't understand why they allow the image url to be shown I personally think there should be a more efficient way to show the original image

[bulbasnore]

Basically, I had to remove the 'original image' code by commenting it out in the template to stop it from appearing to all users, even those not logged in.