Access a file which is located before / outside the server root directory?

Question

I'm making an intranet for a post-sale customer service entreprise. Employee need to be able to upload img files to the intranet's server and i need to store them in a directory with is BEFORE www (the website's root directory).

Doing this using php is pretty easy but how to include these imgs on the website once they're uploaded ? I tried this code

<img src="../img/img.png"/>

This is not working because i can't send a file if it is OUTSIDE the server's www directory ...

Is there any proper way to do that ?

Current treeview :

server root directory
           |www
               |(all server files)
           |img
               |(all img files)

(the server's index.php is located in www and the files are in img)

Why you want to put these files outside web root? You want to hide them? — Kamil, Nov 13 '12 at 09:19
Because another team will access these files using FTP and work with them, so these files can't be in the server directory — Weacked, Nov 13 '12 at 09:21
copying the requested file in a tmp directory might be a solution, that's why i am currently asking for advices — Weacked, Nov 13 '12 at 09:35
Then my advicde is: create virtual directory that will be accessible from apache (from php). You can copy files from there (by using php) and serve them from another location. Don't forget to give read permissions on source files. — Kamil, Nov 13 '12 at 09:45

score 18 · Accepted Answer · answered Nov 13 '12 at 09:26

You cannot directly access any file outside your web directory. As your question includes the tag PHP as well, I assume you may want to use it.

What you can do is the following:

Inside your www directory, create a "image.php" file, with a similar content to:

<?php
  header('Content-Type: image/png');
  readfile("../img/" . $_GET['img']);
?>

And call your images with

<img src="image.php?img=myimage.png" />

Please be aware that your PHP file shouldn't be that simple :) As you may want to address multiple image formats (and providing the correct header for them), checking for malicious file path/inclusions (you don't want to use $_GET without validating/sanitizing the input), extra caching etc. etc. etc.

But this should give you an idea on how you can target your issue.

you can use the wildcard `*` to pick multiple image types ie: `header('Content-Type: image/*');` — Frankenmint, Jul 25 '16 at 07:55

score 7 · Answer 2 · answered Nov 13 '12 at 09:29

7

It depends on what you are trying to accomplish and how. With "simple" html commands it is as you found out. You can't go to a directory outside of the www root. (for xampp applications on C for exmple it is most of the time c:\xampp\htdocs).

If you are ok with using serverside commands to accomplish what you want to achieve then you could use php to do a workaround, by reading the appropriate files in via PHP. For example if your file is named "myimg.gif" and lies in "c:\pics"

<img SRC="data:image/gif;base64,<?php echo base64_encode(file_get_contents("c:\pics\myimg.gif"));?>">

With that you are reading the contents of the file and writing it directly into the img tag. Be aware that you need to change image/gif to what you really need there.

answered Nov 13 '12 at 09:29

Thomas

2,768
3
28
63

I was aware of the data hack, but this really isn't cross browser, for instance IE8 limit the file to 32 ko ... – Weacked Nov 13 '12 at 09:30
1

That is interesting. I wasn't aware of that limit for IE8. If that is the case then the solution made by "GeneSys" would be the way to go there (with additional security parts so that it can't be used to hack your site). – Thomas Nov 13 '12 at 09:32
@ThomasE. Wikipedia (http://en.wikipedia.org/wiki/Data_URI_scheme#Disadvantages) lists a few disadvantages when using the data scheme. Nevertheless, if only a few, small images would have been included, I guess your way would probably be the one with the least "footprint". – Briareos386 Nov 13 '12 at 09:37
@GeneSys: Tnx. the part about the caching is very interesting there. – Thomas Nov 13 '12 at 09:49
PHP has a function for reading mimetype, you dont have to do it manually http://php.net/manual/en/function.mime-content-type.php – Kamil Nov 13 '12 at 10:51

Kamil · Answer 3 · 2012-11-13T09:49:10.850

5

You can't directly access file outside/above your root directory (www or public_html).

You can create virtual directory in Apache server configuration. Google "apache virtual directory" for more information.

Virtual directory configuration example:

<IfModule alias_module>
  Alias /uploaded_images/ "/home/someuser/somewhere"
  <Directory "/home/someuser/somewhere">
    Allow from all
  </Directory>
</IfModule>

uploaded_images directory will be available from web like normal directory in www directory. You can copy files from there to another location (kind of buffering).

You can also open/copy that file by ftp from php level without changing anything in apache, but this may be really slow (use it only if you can't control apache config, virtual directory is much better).

php.net: FTP

edited Nov 13 '12 at 09:49

answered Nov 13 '12 at 09:17

Kamil

11,919
23
72
160

I know that, actually i am asking for a php way (like caching the img or something) to access the file when a client request it – Weacked Nov 13 '12 at 09:19
I added some (sick?) idea in my answer – Kamil Nov 13 '12 at 09:39
I wouldn't use FTP for that (wow - that would be a huge overhead). Why not simply copying the files locally? – Briareos386 Nov 13 '12 at 09:55
I wrote this because he wants PHP solution... and i assume he don't want to use virtual directory. – Kamil Nov 13 '12 at 10:09
1

Well .. you can copy files locally with PHP. http://www.php.net/copy -- why should he use FTP? – Briareos386 Nov 13 '12 at 10:17
@GeneSys you mean copy from outside web root? – Kamil Nov 13 '12 at 10:19
1

Yep. E.g. (in case the CWD is `./www/`: `copy('../img/myimage.png','myimage.png');` -- now accessible via `` - no need for FTP. – Briareos386 Nov 13 '12 at 10:22
There may be a little problem to think about (regardless of the metod) - file locks while copying. – Kamil Nov 13 '12 at 10:29
If you have access to your web server config creating an alias is the easiest to manage and most reliable solution for your case. – Mark Carpenter Jr May 12 '17 at 13:26

score 1 · Answer 4 · edited Nov 11 '15 at 22:28

1

I Agree with @kamil's idea about creating a virtual directory. However if you want to go the php route, I wrote some code that open's images in a directory before WWW and copies them to the www/images folder.

<?php 
$imagepath = "../images/";
define('IMGPATH', realpath($imagepath).DIRECTORY_SEPARATOR);
$cachewwwimg = "images/";
$imagename = 'image.jpg';
copy(IMGPATH.$imagename, $cachewwwimg.$imagename)
?>

<img src="<?php echo $cacheimg.$imagename;?>"/>

edited Nov 11 '15 at 22:28

Community

1
1

answered Nov 13 '12 at 09:49

Jefri P.

76
3

1

What's the benefit of copying the files into a "virtual" (temporary?) directory and have the webserver load the file from there, instead of just "throughputting" the file via PHP? – Briareos386 Nov 13 '12 at 09:53
1

@GeneSys : Weacked is asking for php way because he doesn't want another team accessed server directory. – Jefri P. Nov 13 '12 at 09:59
Well .. you can achieve what I asked with PHP too? In fact, I even gave the answer already. I was just asking: Why would one want to copy files instead of just outputting them? – Briareos386 Nov 13 '12 at 10:03

score 0 · Answer 5 · answered Jan 27 '21 at 15:56

I solved this by simply creating a symbolic link pointing to the global physical folder on my hosting. I didn't have root access, so I created a simple PHP file, calling it symbolic_link.php, that i put in the root of my website and that creates the symbolic link for me. Here it is:

<?php
$target = '/home/<user>/images/';   // hosting physical directory
$link = 'images';                   // symbolic link inside root of web site
unlink($link);
symlink($target, $link);

After the creation of the symbolic link, I deleted the file.

This is the hosting directory structure:

/home/<user>                        // hosting root   
|
+--/images                          // hosting global dir
|  |
|  +--/logo.png                     // global image
|
+--/www.website.com                 // hosting website dir
   |
   +--/images                       // symbolic link

Now you can use the image as if it were in your website folder:

<img src="https://www.website.com/images/logo.png" alt="...">

Access a file which is located before / outside the server root directory?

5 Answers5

Linked

Related