Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Image hosting htaccess Help!

[Matth3wJL]

My goal is to block hotlinking of fullsize images and display a image when they attempt it... but allow clickable thumbnails to be shown. For some reason the following isn't working... Any help would be greatly appreciated!

My htaccess looks like this:

RewriteEngine On
RewriteBase /images

#Allow if it's not from another website
RewriteCond %{HTTP_REFERER} ^$ [OR]
RewriteCond %{HTTP_REFERER} ^http://site.com/.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} ^http://www.site.com/.*$ [NC,OR]

#Allow if it's the hotlink.gif
RewriteCond %{REQUEST_FILENAME} hotlink.gif [NC,OR]

#Pass through thumbnails or hightlights as-is
RewriteCond %{REQUEST_URI} \.thumb.jpg$ [NC,OR]

#Return an anti-hotlink gif in place of any visual media
RewriteRule .*\.(jpe?g|gif|bmp|png)$ css/images/hotlink.gif [R,L,NC]

Thanks!

[foobic]

Your logic's out - you're listing all the conditions (using OR) that should allow images to show, and then redirecting these requests.

Instead you need to list all the conditions that should cause the redirect, reversing your existing rules, and use the implied AND which is default.

Try this:

RewriteEngine On

#Block it if the referrer is NOT blank
RewriteCond %{HTTP_REFERER} !^$

#AND if it's not from my own website
RewriteCond %{HTTP_REFERER} !^http://(www\.)?site.com/.*$

#AND if it's not a thumbnail
RewriteCond %{REQUEST_URI} !\.thumb.jpg$

#Return an anti-hotlink gif in place of any visual media
RewriteRule ^images/.*\.(jpe?g|gif|bmp|png)$ css/images/hotlink.gif [L,NC]

[zuborg]

Simply place big images into separate directory and put there antihotlinking .htaccess.
And leave thumbs without hotlink protection.
This will also decrease server load.

[Matth3wJL]

Originally Posted by foobic

Your logic's out - you're listing all the conditions (using OR) that should allow images to show, and then redirecting these requests.

Instead you need to list all the conditions that should cause the redirect, reversing your existing rules, and use the implied AND which is default.

Try this:

RewriteEngine On

#Block it if the referrer is NOT blank
RewriteCond %{HTTP_REFERER} !^$

#AND if it's not from my own website
RewriteCond %{HTTP_REFERER} !^http://(www\.)?site.com/.*$

#AND if it's not a thumbnail
RewriteCond %{REQUEST_URI} !\.thumb.jpg$

#Return an anti-hotlink gif in place of any visual media
RewriteRule ^images/.*\.(jpe?g|gif|bmp|png)$ css/images/hotlink.gif [L,NC]

Doesn't seem to be working.. Thumb's are not showing.

Here is the example of the code the site gives you for the thumbnails:

<a href="http://www.site.com/viewer.php?file=u4w7iek3d5fzrxea9uhq.gif"><img src="http://www.site.com/images/u4w7iek3d5fzrxea9uhq_thumb.gif" border="0" alt="u4w7iek3d5fzrxea9uhq.gif" /></a>>

[foobic]

The condition allowing thumbnails (based on your original RewriteCond) assumes that the thumbnail filename ends in .thumb.jpg. To allow thumbnails like the one you have there replace the line with this:

#AND if it's not a thumbnail
RewriteCond %{REQUEST_URI} !_thumb\.(jpe?g|gif|bmp|png)$