Protect images directory

Hi,

Ive just tried changing the permissions of the /images/ folder from 777 to 644 as recommended, and when i do all the images on my zencart site show as red X's

how would i stop anyone hacking the images directory?

Thanks

underworldmagic,
The simplest way to 'protect' any images folder is to place an index.html file in the folder. When a person accesses the folder, they simly get a blank page. Bear in mind, if someone really wants your images they can always get them...

You can put some kind of dumb message in there too (smile)... or copyright info -

If you are really serious about protecting your images - read this
http://www.thesitewizard.com/archive/protectimages.shtml

Also, use Google - and search on protect images and you will come up with an amazing "number of ways."

The simplest is the first suggested...

jund

thanks so much i really appreicate it.

how about file premissions? i have them still at 777 when i put them down to 644 i get red Xs on my website? will security matter even if i kept it at 777?

thanks again

underworldmagic,

Set your permissions for the images folder to 770.
What kind of server are you using?
jund

jund:

underworldmagic,

Set your permissions for the images folder to 770.
What kind of server are you using?
jund

I really do not understand why the other setting doesn't work - oh well...
jund

im using a linux shared hosting.

i dont know either why 777 doesnt work on images directory, all the images just start showing a red Xs.

ive just tried 770 on the images directory and still the same problem, ie got red Xs on the website?

any other ideas?

Is your site online? Can you provide me a url?
jund

thanks its

http://www.HouseOfPainNutrition.com

I see your images... NO red Xs.
Which images are showing up as red Xs?
Which browser are you using?

jund

They all show up as red X's ONLY when i change the image directory to 644, it is now on 777 thats why there are no Xs showing.

this is where the problem is, 777 is not safe to keep, yet images show on the website as they are supposed to but when i try to use secure permissions (644) i get red Xs.

underworldmagic:

They all show up as red X's ONLY when i change the image directory to 644, it is now on 777 thats why there are no Xs showing.

this is where the problem is, 777 is not safe to keep, yet images show on the website as they are supposed to but when i try to use secure permissions (644) i get red Xs.

Let's regroup... I do not really understand something. Please try to answer a few questions...
What are you trying to protect the images from? What I mean is, are you trying to prevent someone from downloading your images? Or are you trying to prevent someone from copying your images? If a person can view your image, they can copy it, print screen it, but they cannot modify it if they do not have file access (like you do). That is why I suggested you use 770 and the index.html file.
Please help me to better understand what it is you are trying to do.
Respectfully,
jund

thanks for your reply,

i have been following this guide by zencart for recommendations on how to secure your website from hacks

https://www.zen-cart.com/tutorials/index.php?article=73

if you go down to the "9. Protect your "images" and other folders" it tells you instructions to change the images folder from 777 to 644, thats the only reason why i wanted to change the permissions; because zencart recommends it.

i hope you understand what, and why i want to achieve this.

Thanks again for your continued help

655 will work and still prevents others from writing to it.

underworldmagic:

thanks for your reply,

i have been following this guide by zencart for recommendations on how to secure your website from hacks

https://www.zen-cart.com/tutorials/index.php?article=73

if you go down to the "9. Protect your "images" and other folders" it tells you instructions to change the images folder from 777 to 644, thats the only reason why i wanted to change the permissions; because zencart recommends it.

i hope you understand what, and why i want to achieve this.

Thanks again for your continued help

The article is correct - if you read further...

Continue to read and you will see this:
File/Folder permissions settings

On Linux/Unix hosts, generally, permission-setting recommendations for basic security are:

• folders/directories: 755
• files: 644Did you not state you were using Linux/Unix?

I am including an upload of a permissions set-up on my site... note what the permissions do - and everyone has tried to help you understand that too...

Jund 644 will not work on all server setups,
Some servers require 777 for the images to work,

websiterob has an htaccess code that will help to secure this folder from people dropping code into it it limits the files that can be in the folder to image types
gif jpg png and bmp

Make sure your http server (assuming apache) is the owner, or in the owner-group of the files and folders.

I once made a mistake: I uploaded ZC zip file by ssh under root user, unzip it and found out that apache can not access them _.

Merlinpa1969:

Jund 644 will not work on all server setups,
Some servers require 777 for the images to work,

websiterob has an htaccess code that will help to secure this folder from people dropping code into it it limits the files that can be in the folder to image types
gif jpg png and bmp

Thanks for the backup Merlin - I appreciate it...
The problem is that in some of the literature forom her, it leads one to believe it will.
Hope you are well... and again, thanks for watching my back.
jund

THANK YOU!!!

thanks so much i have done this:

folders/directories: 755
files: 644

and it has worked

thanks so much for your help

BTW im using Linux server

Hello! I hope someone can help me! I did the exact same thing... following that security article. Now my images are not showing up at all, nor can I access the images folder to set the permissions back! I get an error message saying:

"Fetch could not open the folder 'images' because the FTP server says that the requested item was not a folder or could not be accessed. If you entered a folder name or URL, check that it is correct. Server responded: 'images: No such file or directory'."

I did set the permissions to 644, so I should still be able to read and write to that folder, right?!

Please tell me I have not completely messed myself up!

https://www.chacha-vintage.com is my website.

Thank you for your help!!

chacha-vintage:

Hello! I hope someone can help me! I did the exact same thing... following that security article. Now my images are not showing up at all, nor can I access the images folder to set the permissions back! I get an error message saying:

"Fetch could not open the folder 'images' because the FTP server says that the requested item was not a folder or could not be accessed. If you entered a folder name or URL, check that it is correct. Server responded: 'images: No such file or directory'."

I did set the permissions to 644, so I should still be able to read and write to that folder, right?!

Please tell me I have not completely messed myself up!

www.chacha-vintage.com is my website.

Thank you for your help!!

It looks like you may have put your store images in the wrong place...

This is where you have stored your home page image:
http://www.chacha-vintage.com/shop/includes/templates/template_cha/images/cha_welcome_image.jpg
If you click on this you will see your image...

Note: It is using the ROOT OF YOUR STORE template.

However, here is where it is looking for your product images:

<img src="images/categories/IMG_93481-dual.jpg"
http://www.chacha-vintage.com/images/categories/IMG_93841-dual.jpg

This is pointing to your root images/categories folder - and I do not think that is correct. If you click on this you will get a 404 error - file not found...

Where is your images folder located?

jund