PHP/Apache 中的图像显示权限
我有一个带有登录系统的 PHP 站点，并且正在尝试创建一个功能，只有特定的用户名才能查看特定的图像。我认为我想做的不仅仅是更改 .htaccess 文件，因为 a) 这无助于区分允许/不允许查看图像的用户，b) 如果有人输入图像的确切 URL ("directory/images/photos/230ru0q0238rn230nd_asdi0nqn8.jpg") 他们仍然可以查看图像（因为它是目录中的物理文件，而不是数据库中的文本等）。 ）。同样，通过 .htaccess 进行限制会限制整个目录或其中的所有文件，因此我无法弄清楚它是如何工作的。理想情况下，所有图像都会通过尝试通过其直接 URL 直接访问而被阻止，并且如果用户的会话/用户名有效，则图像只会出现在
我听说过 ACL 这个术语，但我不确定这是否与我想做的事情相关。
I have a PHP site with a login system, and am trying to make a feature where only specific usernames can view particular images. I think what I'm trying to do is more involved than merely changing the .htaccess file, because a) this won't help discern between users that are/aren't allowed to view the image, and b) if someone enters the exact URL of the image ("directory/images/photos/230ru0q0238rn230nd_asdi0nqn8.jpg") they can still view the image (since it's a physical file in the directory, and not text in a DB, etc.). Again, restricting via .htaccess would restrict the directory as a whole, or all files in it, so I can't figure out how it would work. Ideally, all images would be blocked by trying to access them directly through their direct URL, and the image would only appear between <img> tags if the user's session/username is valid, else they get an error message.
I've heard the term ACL but I'm not sure this is related to what I'm trying to do.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
授权和 ACL 方案可能会有所不同，但要实现您问题的基本目标：
.htaccess重写对脚本的所有请求（这可能会消除前面的步骤，假设它拒绝对文件的任何直接访问）。The Authorization and ACL scheme can vary, but to accomplish the basic goal of your question:
.htaccessto rewrite all requests to a script (this may eliminate the preceding step, assuming it denies any direct access to the files).readfile()(or a variety of other functions) to output the image.您可以做的是创建一个简单的上下文，它将图像作为流输出。输出的图像取决于 id（或某些标识符），例如：
viewImages.php 检查用户是否已登录/授权（最有可能通过 $_SESSION），如果是，则可能使用 < a href="http://php.net/manual/en/function.readfile.php" rel="nofollow noreferrer">
readfile。What you can do is create a simple context which outputs an image as a stream. The image which is output depends on the id (or some identifier) e.g.:
viewImages.php checks if the user is logged/authorised in (via $_SESSION most likely), and if so, it sends the image to the browser possibly using
readfile.