Example of displaying photos that are not in a webserver subdirectory?

[Jim A]

I'm having trouble wrapping my brain around this...so wondered if there is an example that I haven't looked at.  The situation is that photos are being used for both the desktop and the webserver.  It would make sense to have the photos held in a subfolder of the webserver -- but is not possible in this case.

I'm trying to understand the process of fetching the photos to display them in the browser.  Do I save them temporarily to a folder that the webserver can see?  Do I just keep track of what is copied so that they can be deleted when the session ends?  Is it better to sync two photo directories?  Does it make sense to load the photo into a blob and then display? 

Thanks in advance for any help with this.

Jim

[springguy]

Jim,
I have the same kind of application.  The only extra "complication" I have is that the user always has the desktop app, and optionally has the web server app.  So, I have to have the photos always available for the desktop.

What I do is run a sync program on a timer that copies the most current photos from the desktop app folder over to the webserver \web\photo folder.  The web server has what it needs in the \web subfolder and the desktop has what it needs.  May not be the best solution, but it was simple and it works reliably.

Mike Springer

[Jim A]

Thanks Mike.  Same complication here -- where the desktop is primary and web optional.  I like your idea -- but am wondering what happens in the case of a deleted photo.  Do you have a way of monitoring this as well?

Best.

[kevin plummer]

what I do is create a temp file based on the sessionID. When they open a browse or what ever with links to the files I copy them across to the temp folder. when the session expires I delete the temp folder and files. could be a prob if too many or large files make it too slow.

[bshields]

Hi Guys,

I have a similar situation also.

I used the idea of a "proxy" for my web images. I redirect the images from whereever they are stored to the clients browser.

Its like my idea in this thread (http://www.nettalkcentral.com/index.php?option=com_smf&Itemid=36&topic=3793.0)

In NT I specify my images by placing the folder /imgproxy in front of them. Then the _SendFile method sends them for me and I dont have to duplicate images or anything else.

Regards
Bill

[kevin plummer]

Clever!

[Bruce]

The File Download example may be of interest because it shows how to do this specific task (serving files from outside the web folder.)

Essentially, you call one procedure (a netwebpage) with a parameter indicating which photo to fetch. (You can of course use a constructed-url to get the same information.)

Just please put sufficient checks on the parameter name to make sure it's suitable for download. For example, if you are serving image files limit the name to files with the extension of .jpg, or .png or whatever. Best to strip off any path information (even if you're not planning for there to be any path information) and locate the file yourself etc.

What you don't want is the user being able to fetch files on your server they are not entitled to.

If you have the Nettalk book, see the section entitled "Serving Files", it also discusses this topic in more detail.

cheers
Bruce

[Devan]

Guys,

One way we have worked around this is to use symbolic links to enable files in other paths to be accessed via the web browser.  No duplication, mirroring etc. required, and the deletion issue is, well, a non issue.  Symbolic links are supported in Vista, Win7, Server 2003, 2008, 2010 etc.

Essentially, if you have a folder full of goodies at D:\Data\Pictures\Public and you want the pictures in the 'public' folder to be made available in your NT web server that is running on C:\Apps\MyWebServer, (given that your 'web' folder will then be C:\Apps\MyWebServer\web) then you can run the following command at the DOS prompt:

mklink /d  D:\Data\Pictures\Public  C:\Apps\MyWebServer\web\pictures

and immediately, you will have a folder called /pictures in your web browser that is available to your users. (e.g. http://xxx.xxx.xxx.xxx/pictures).  This is just a symbolic link, and I believe in most flavours of windows this link is perpetual, even after rebooting, until you manually delete it.

Hope this helps.

Devan

[kevin plummer]

on the above, what safeguards do you have to stop users guessing other pictures or doc names? That's why I designed my app the way I did but it was way back when I first started using NT4 and I didn't have much or a clue.

[Devan]

Kevin,

The way we work around this issue is to use GUIDs as our primary key for the user records.  Then we create a folder with the same GUID key for each user etc. where their pictures are stored.  This way we can tack the GUID onto the web path for retrieving the pictures, and it is nearly impossible for another user to 'guess' the GUID of other users on the system.

So, user John's photos may be stored in: C:\MyApp\web\pictures\0a4252a0-7e70-11d0-a5d6-28db04c10000\

And user Mary's photos could be stored in: C:\MyApp\web\pictures\cf1dda2c-9743-11d0-a3ee-00a0c9223196\

I use the IceTips templates to generate the GUIDs and prime them when adding records.  So much more reliable than autonumbered keys on different SQL platforms.

Hope this helps...

Cheers,
Devan

[kevin plummer]

my problem is the docs need to be shared amongst users so they are all stored in the one place and then based on a browse filter they have access to certain files.

I guess I could hash the file name and then use Bill's method?

cheers,

Kevin

[Bruce]

or you just add a "layer" of access control.
eg something like;
in _sendFile
is file in "photos" folder?
if so check lookup table to see if current user has rights to that photo. If yes, serve file, if no, serve nothing.

Bruce

[Jim A]

First, thanks much to all who replied.  I appreciate it. 

I'm trying to follow Bill's approach, but I'm just not getting something right.

Let's say that the web app is in C:\webapp and the photos I want to display are located in C:\photos.  I want to show the photos in a table. 

If I use Bill's example of prepending 'securedownload/' to the photo name and trap that in the Webhandler, how do I return the photo to the browse?  Setting p_filename as 'C:\photos\PhotoName' doesn't seem to work.

Since I am going outside of the web folder, do I need to call a NetWebPage that is set to FILE and fetch C:\photos\PhotoName?  If so, how do I pass the reference to the PhotoName?

Do I set up a NetWebSource to fetch the photo? 

Sorry, but I'm stumped.

Thanks for your patience.

[bshields]

Hi Jim,

once you determine that a photo (or file) needs to be sent.

do something like this:

PARENT._SendFile(NewFileNameAndPath,p_header)
RETURN


Regards
Bill

[Jim A]

Thanks Bill.  Looks easy.  I will try it in the am.