How do I serve user uploaded images? - php

Question

I am building a small web app that will allow a logged in user to upload product pictures. I'm trying to build-it-right, and after some naive implementations in the past, decided to add all uploaded content in my public folder.
\app (public folder)
-\index.php
\includes
\config
\uploads
This would make it so if a malicious user managed to upload a PHP file it wouldn't be reachable or served by server.
That being said, how would I go about serving these pictures on the webpage? What is the best way to do this? In the past I've used a getImage.php file that would take an ID parameter (and a hash of some generated value to avoid users just guessing IDs) which would look like "getImage.php?id=555&c=44j54k3h5". The server grabs the image information in the DB (the real path) and loads the content, rebuilds the header, and sends the image.
Are there any security concerns regarding this method? Is there a way to make it prettier? Would having a htaccess rewrite rule that looks for /images/imagename.jpg and sends them to my getImage.php file add security holes? Any advice on best practices would be greatly appreciated.

Answer 1

Check out this class. It will handle the upload, do security checks and make you coffee :)
http://www.verot.net/php_class_upload.htm

Answer 2

The security of your method of serving the uploaded image, really do depend on a lot of other factors.
How is the image/file treated and secured on upload? What are the
directory/file permissions for the upload?
What processes have accessto read from and write to those locations?
What type of file handlers do you have that may execute arbitrary files?
If you're going the PHP->get_image->display_image route, does it attempt to prevent malicious intent AFTER upload (on the getimage?)
I would use Apache mod_alias to reference the directory above webroot. This way, you would be able to still utilize links to images without opening the full above-root directory to exposure.

Answer 3

The "prettier" method would be to use a .htaccess redirect
RewriteEngine On
RewriteBase /
RewriteRule ^getImage/([0-9]+)/(.+)\.png$ getImage.php?id=$1&c=$2 [NC,L]
Then in getImage.php
if (isset($_GET['id']) && isset($_GET['c'])) {
// set headers
header("Content-Type: image/png");
// cache control
header("Cache-Control: private, max-age=10800, pre-check=10800");
header("Pragma: private");
header("Expires: " . date(DATE_RFC822, strtotime("2 day")));
if (isset($_SERVER['HTTP_IF_MODIFIED_SINCE'])) {
header('Last-Modified: ' . $_SERVER['HTTP_IF_MODIFIED_SINCE'], true, 304);
exit;
}
/* do things */
imagepng($image_resource);
imagedestroy($image_resource);
}
else {
echo "bad request";
}
So instead of
site.com/getImage.php?id=555&c=44j54k3h5
You would use
site.com/getImage/555/44j54k3h5.png
There aren't any added security risks or loop hole with this method. Just make sure your get variables are escaped before querying to avoid injection attacks.
If you want to protect yourself from malicious file uploads, you need to do that before serving.