13

Is it possible?

Let's say my directory structure looks like this:

/data
    /data/images
/public

The document root is in the "public" directory. This won't work, of course:

<img src="/../data/images/1.png" alt="" />

But maybe it's possible to enable serving images from directory above document root somehow? I would like to know.

Ben
  • 54,723
  • 49
  • 178
  • 224
Richard Knop
  • 81,041
  • 149
  • 392
  • 552
  • 3
    Well, there are several ways, like `symlink`. But it would be impossible to give the right answer before you tell us, what's the purpose of storing images outside of document root – Your Common Sense Jun 28 '10 at 10:22
  • 1
    You could use .htaccess to rewrite any incoming requests to an image to pass through an image serving script, but then again, why would you want to do such a thing? It's not like this would protect your images from anything. Once it shows in the browser, it's on the client. – Gordon Jun 28 '10 at 10:23

2 Answers2

16

The most common way is an Alias:

Alias /data/ /wherever/your/data/are/
unbeli
  • 29,501
  • 5
  • 55
  • 57
  • 1
    +1 this needs to be put into `httpd.conf` itself, though, it won't work in a `.htaccess` file. – Pekka Jun 28 '10 at 10:29
  • 1
    +1, i used this method to to try and keep as many document out of the public_html for security. – RobertPitt Jun 28 '10 at 10:39
  • 1
    @Robert umm, how would that add any security? – Gordon Jun 28 '10 at 10:46
  • I ment securty as i store my execution file such as php outside the html root scope and include from a directory root, I would not be worried about public files such as js, just saying that its better to generally store files outside the public root. - php files are safe from injection attempts and out of public's way. – RobertPitt Jun 28 '10 at 10:54
  • +1 This is exactly the right answer. In httpd.conf it says, verbatim `"Maps web paths into filesystem paths and is used to access content that does not live under the DocumentRoot."` – Ben Apr 04 '11 at 04:58
  • @RobertPitt - I think what Gordon was trying to say is that this method allows any user to navigate to `http://yourserver/data` and they'll see everything in the folder anyway (like his comment in the OP suggests). – Ben Apr 04 '11 at 05:24
  • This solution is valid, unless you are generating dynamic content, in PHP for example, or any system that references files via the actual filesystem, not Apache... Paths like `(dirname(__FILE__)` will not work with an Apache alias, so if you are serving anything but static content, I would investigate other solutions, such as symlinks, server-side includes, etc. – Alex Gray Jul 19 '11 at 19:19
8

Another way (say if you can't set an alias...) would be to use a script as the image source eg:

<img src="image.php?img=myImage.jpg" />

image.php would be similar to:

<?php
  header('Content-Type: image/jpg');
  readfile("../img/" . $_GET['img']);
?>

Of course you'd need to extend the script to filter $_GET['img'], as well as detect and set the right content type. Your script could even resize the image according to other parameters passed in the query string.

tweetlogist
  • 93
  • 1
  • 5