Hotlinking and .htaccess

tmhall · May 14th, 2005, 12:23 PM

I opened a ticket about .htaccess not working to prevent people from hotlinking to images in our gallery, and I thought it was resolved. As it turns out I don't think the problem was with the .htaccess file not working, but with the fact that it only works when the viewer's browser sends http referer headers - and some browsers don't always send those headers.*

So anyway... is there a way to provide tighter restrictions on the images in the gallery, maybe through the forum permissions system? Or could there be?

* It seems that Firefox, for example, has a lot of referer bugs. It doesn't always send those headers when it should, and in addition they make it very easy for users to manually disable them through a config setting.

mholtum · May 14th, 2005, 01:20 PM

what do you have in your htaccess file?

I use this:

Code:

Content visible to verified customers only.

if you notice this line:

Code:

Content visible to verified customers only.

it displays a image instead of the image they are trying to get.. If you use your imagination, it can be quite fun.

Lizard King · May 14th, 2005, 01:45 PM

It is a perfect picture mholtum

mholtum · May 14th, 2005, 01:57 PM

I love it too!

tmhall · May 14th, 2005, 02:09 PM

I've only been using the default .htaccess file that's created when you select to restrict access via the Gallery settings in the ACP. But I don't think it matters what's in your .htaccess file if the viewer's browser doesn't send the http referer headers.

ConqSoft · May 14th, 2005, 03:29 PM

If the browser doesn't send the http referer, then they aren't going to be able to see the image. On my "alternate" image, I have a note telling them that:

http://www.fireblades.org/images/leech.gif

tmhall · May 14th, 2005, 03:53 PM

Quote:

Originally Posted by ConqSoft

If the browser doesn't send the http referer, then they aren't going to be able to see the image.

Yeah, that's a good point. I realized after my last post that the way the .htacess file is written it rejects blank as well as foreign referers. I can't figure out why some of my users keep insisting that they can still hotlink to the gallery but for now I'll have to assume they're just on crack.

mholtum · May 14th, 2005, 04:00 PM

Why dont you try to hot link here. See what happens.

tmhall · May 14th, 2005, 04:39 PM

Quote:

Originally Posted by mholtum

Why dont you try to hot link here. See what happens.

I would, but I'm too paranoid.

I prefer to keep my forum location out of discussions about the underlying software to avoid giving too much info to potentially malicious readers.

tmhall · May 15th, 2005, 10:06 AM

Okay I've figured out that the .htaccess solution is preventing hotlinking, however when someone hotlinks to a gallery image it shows up as a broken image link, and if the person then right clicks on the image and chooses "view image" then they can see it.

So the .htaccess method is a good solution for preventing hotlinking, but not useful to prevent people from sharing images altogether. But then again, there is nothing to stop anyone from just copying the images and uploading them somewhere else either, so it's probably not a big deal.

Sorry to waste your time.

Globalbuzz · June 8th, 2005, 01:26 AM

Hi mholtum

am I to understand, that the referrers you put in the http referer line are allowed to have access to the images then. What I am asking is are these urls mentioned allowed to hotlink, then?

if this is the case, it looks quite nifty

Thanks

G

Quote:

Originally Posted by mholtum

what do you have in your htaccess file?

I use this:

Code:

Content visible to verified customers only.

if you notice this line:

Code:

Content visible to verified customers only.

it displays a image instead of the image they are trying to get.. If you use your imagination, it can be quite fun.

mholtum · June 8th, 2005, 01:34 AM

Yes, anything listed are allowed to hotlink. If a site isnt listed it gets my default image.

If the URL isnt listed they get this:

Code:

Content visible to verified customers only.

Globalbuzz · June 8th, 2005, 01:58 AM

excellent ... so one simply places the htaccess into the image folder where you would like it to apply?

this is a God send .. thanks

G

mholtum · June 8th, 2005, 02:05 AM

I placed it i my gallery dir. Works like a charm

Globalbuzz · June 8th, 2005, 02:15 AM

I will use this on a few of the other websites where I would like to block hotlinking but also allow my other sites to pull images for use on that site

Site A has all the images and Site B - C and D pull images from that folder

so in my understanding all I need do is provide the url of the site or do I need to be specific to the folder or does this only apply for subdomains which you seem to be using, please?

Thanks

G

ConqSoft · June 8th, 2005, 08:48 AM

I use my .htaccess in the root of my site so that no images anywhere can be hotlinked from other sites.

Globalbuzz · June 8th, 2005, 09:30 AM

Quote:

Originally Posted by ConqSoft

I use my .htaccess in the root of my site so that no images anywhere can be hotlinked from other sites.

OK ... that is execellent to hear .. so I am supposing that we just load the .htaccess file to the root, same as where the index file would be?

Thanks

G

Grae · June 28th, 2005, 04:28 AM

I was trying to do the same thing and found this thread very helpful. Thanks

Da GoTTi · August 28th, 2005, 02:56 PM

i DONT understand this option.

i set the htaccess to yes and nothing happend. there is no .htaccess file being created in my files folder...

and i took a image, and placed it in a .html file, uploaded it to a different domain and its still being viewed.

please explain what i gotta do. thanks.

Da GoTTi · August 28th, 2005, 05:21 PM

nevermind i got it.