Topic: Need to stop graphics downloads

[tombro]

Hey good folks,

I'm having a problem with people downloading graphics from my site.
I've gone the route of encoding the pages with HTML protector and removing "Indexes" from the config file.
If the file name is known, it can be displayed and downloaded.

Is there anyway to fix this?

Thanks, Tom

[glsmith]

Yeah, I must admit there's one thing missing in the Apache 2 documentation, a FAQ worth a crap! They used to have one

http://httpd.apache.org/docs/1.3/misc/FAQ.html

What you want is right here

http://httpd.apache.org/docs/1.3/misc/FAQ.html#image-theft

[tombro]

Hey glsmith,

The FAQ, you quoted, does a fine job of stopping other sites from linking to my graphics......but that's not the proplem.

I need to stop people from downloading the graphics.

If you know the path of a picture is "http://myplace/images/picture.gif",
then you can just use that URL to get the picture.

It's a problem I haven't been able to solve.[img]Mad[/img]

[glsmith]

And here is the problem,
To view it in a browser while it is on your page a browser must download it.

Bottom line, the only way to keep someone from downloading the image is to not put the image there in the first place.

That said, what you saw was to keep other sites from linking to your images, true, but the concept can be used elsewhere.

If you removed the line

SetEnvIf REFERER "^$" linked_from_here

no one could download the image, but in the same respect, no one could view it legit either till they reloaded the page (which would kick in the referer)

[glsmith]

Bald face lie .. my bad!

Do remove that line and see what you get!
You should get a 403 when you go direct to the image, but the page calling the image set's off the referer and the images show on pages.

[tombro]

Yes, it works, thanks.

I don't completely understand the science behind it, but I'll certainly accept the result.

In hindsight, some of these configuration options are fairly simple to the software developers and glsmiths of the world. The non tech end user should be considered more.

Go ahead and blast! I always get a lot of heat when I say things like that.

[glsmith]

No blast ... and they are not always simple ... and after ten years I still haven't used half of them.