I was thinking one way of doing this would be too store the images above the webroot directory so that visitor's can't navigate to them and having a php script that can read the image dir output the images by sending the correct headers and echoing out the data.
For example you have showpic.php which accepts $_GET parameters:
user id
image path
timestamp
hash
The user id, image path, and a secret hash seed stored on the server are used to generate the hash. The script file checks that the data passed in matches the hash, and also checks that the timestamp is within a specified time interval (say 5 minutes) and if everything is valid it echoes the image data.
Some downsides:
-this seems like it will create a high load (fopen and fread for each image) on the server.
-since we're relying on a timestamp, links to images will timeout even for valid users if they leave their computer. I suppose if a timeout occurs we can re-check session credentials and access priviliges for the image(s), but this will just cause even more load.
Anyone have any better ideas, links to scripts that do this?
Thanks,
