Mon Sep 11, 2006 5:38 am - Re: The clipboard is temporarily disabled. To restore normal function, simply
#2119
i've seen this script before, but to really protect your images i follow these tips on how to do this:
(not sure where I got this from. I have it saved in my notes)
1. Secure your Directory
Secure it with a .htaccess file in it.
(empty file)
2. View the Pic
The viewscript shows the Picture in a table.
the trick: the real pic is the background, the
content a transparent .gif. there is no way to
rightclick the background.
in Html:
Code:
Code:<table CELLSPACING=0 CELLPADDING=0 COLS=1 WIDTH="100" HEIGHT="100">
<tr><td BACKGROUND="ihrbild.gif">
<img SRC="transparent.gif" height=100 width=100>
</td></tr></table>
Our Knowledge in the PHP Files:
Sourcecode "view_image.php":
Code:
Code:<?php
session_start();
// deactivate cache
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Last-Modified: " . gmdate("D, d M Y H:i:s") ." GMT");
header("Pragma: no-cache");
header("Cache-Control: no-store, no-cache, max-age=0, must-revalidate");
// Challenge-ID
mt_srand((double)microtime()*1000000);
$random = mt_rand();
$random = md5(uniqid($random,TRUE));
$sess_challenge_id = $random;
if(!session_is_registered("sess_challenge_id")):
session_register("sess_challenge_id");
endif;
// Read image
$pic = "tolle-grafik.jpg";
$img = @GetImageSize("/absoluter/pfad/zu/verzeichniss/images/".$pic);
$width = $img[0];
$height = $img[1];
// show HTML table
printf("<table border="0" cellpadding="0" cellspacing="0" width="%s" height="%s">n",$width,$height);
print "<tr>n";
printf("<td width="%s" height="%s" background="read_image.php?img=%s&challenge=%s">",$width,$height,rawurlencode($pic),$sess_challenge_id);
printf("<img border="0" src="blind.gif" width="%s" height="%s">",$width,$height);
print "</td>n";
print "</tr>n";
print "</table>n";
?>
Description:
You have to start a session first.
After this, we deaktivate the Cache because of
security reasons and build a 32 chars long "challenge-id"
these challenge ids can be also used to notice reload.
now just read the image size with GetImageSize()
Now the real trick:
Instead of pointing to the image
directly, we start another Script,
"read_image.php" and attach as Get-Parameter
the Name of the Image-File and our
Challenge-ID.
3. Reading the Image
We need another Script, for reading
the Image out of the secured dir.
The Sourcecode:
Code:<?php
session_start();
// Challenge-ID OK -> Show Pic
if(session_is_registered("sess_challenge_id") and $sess_challenge_id == $challenge):
session_unregister("sess_challenge_id");
$path = "/asoluter/pfad/zu/verzeichniss/images/";
$img = rawurldecode($img);
$read = @GetImageSize($path.$img);
$type = $read[2];
// Set kind of File
switch($type)
{
case 1:
$mime = "image/gif";
break;
case 2:
$mime = "image/jpeg";
break;
case 3:
$mime = "image/png";
break;
case 4:
$mime = "application/x-shockwave-flash";
break;
}
// Send Header and read the image with readfile()
// sending the graphic to the browser
header("Content-Type: $mime");
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT");
header("Pragma: no-cache");
header("Cache-Control: no-store, no-cache, max-age=0, must-revalidate");
readfile($path.$img);
// Access denied -> Transparent GIF *doh*
else:
header("Content-type: image/gif");
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
header("Last-Modified: " . gmdate("D, d M Y H:i:s") ." GMT");
header("Pragma: no-cache");
header("Cache-Control: no-store, no-cache, max-age=0, must-revalidate");
readfile("blind.gif");
endif;
?>
At first we test the Session-Value and compare it
with the challenge. if its ok, we delete the session
variable to prevent copy and paste out of the
page-source.
now getimagesize() again, to give the browser
the right header.
readfile() the image to the browser.
if there's no session-variable or the challenger-IDs
don't match, there will be only a transparent .gif.
Summary of security methods:
Directory secured with .htaccess
No Access with browser
Graphic as Table-Background
Transparent Gif
Session Variables and Challenge IDs