hotlinking prevention detection

[pzuurveen]

Hi all

I'm writing a code to search image on google and parse the urls to a flash aplication. More and more I don't get the image but a picture that tells me not to hotlink. I want to detect this so I can look for another image. I've written a funtion that checks the heather so filter bad urls but it don't detect hotlink prevention. I don't want to load the image end check it size, it will slow down my code to much.
Anyone an idear?

my funtion:

function goodUrl($urlString)
        { 
        if (strpos($urlString,'http://')===0)
                { 
                $pf = curl_init($urlString);
                curl_setopt($pf, CURLOPT_HEADER,True);
                curl_setopt($pf, CURLOPT_FOLLOWLOCATION,False);
                curl_setopt($pf, CURLOPT_RETURNTRANSFER,True);
                curl_setopt($pf, CURLOPT_NOBODY, True);
                curl_setopt($pf, CURLOPT_TIMEOUT,30);
                $ret = curl_exec($pf);
                $heathers =  curl_getinfo($pf);      
                if ((empty($ret)) || ($heathers["http_code"] <> 200)  ||                             //  bad connection
                                          (strpos($heathers["content_type"],"image/") === false))  // not an image
                    {
                    curl_close($pf); // close cURL handler
                    return False;
                    } 
                else
                    {
                    curl_close($pf); // close cURL handler   
                    return True;
                    } 
                } 
        else 
                {
                return False;
                }
       }

[digital-ether]

What you can do is try and get the filesize header from your CURL request you're making. If thats not available, then you will have to download the image data and get a filesize.

Once you have a filesize, you can compare it with the filesize of the image retrieved by the client to see if it matches.

In IE you can get the filesize of the image via javascript. fileSize is a property of the Image object.

Example: if you have an image with id="myimage".

var image_size = document.getElementById('myimage').fileSize;

You can then send this back to your server in a HTTP Request.

I couldn't seem to find a corresponding property for the Image object in Firefox. So you may have to revert to having JavaScript retrieve the image headers for you on the client side (eg: xmlHTTPRequest), then send the Image Size to you via a seperate HTTP Request back to your PHP Server.

See: http://www.elf.org/essay/inline-image.html if you want to render the image inline as to keep the browser from making an extra http request for the image.

If you end up having to retrieve the whole image via CURL, then you might as well cache the image and serve up the local copy..

[pzuurveen]

Thanks for the replay

I've discided to download the pictures. Turns out that downloading the image doesn't get blocked at all. :) :o
I put in

echo "image = <img src={$this->imageUrl} />";

to get a visual feedback during development. This does get blocked.