IIS6 - secure original image/album folder, solution for WHS (Server 2003)

OK, Zenphoto is not officially supported on IIS, however (apart from the mod/Url rewrite) it works pretty much perfectly as far as I can tell, provided that PHP works and is set up correctly, else you might have formatting issues (I had them).

Setup:
- IIS6 on Windows Home Server (Based on Server 2003)
- PHP 5.3.6, FastCGI, with PHP.ini modified according to WeGotServer PHP on WHS Wiki
(Also installed: Wincache, ScanURL (default config), IIRF (not configured well yet))

A general problem with IIS is, that you can't configure folders as versatile as Apache - in theory, in practice, there are a few little tricks and iportant points.

IIS runs under IUSR_something, however PHP and any associated processes run under IIS_WPG -> IIS Worker Process and I am not sure what the "G" stands for.

This means I can block direct access to my Images by setting the security setting to deny access to IUSR_ but to allow accss to IIS_WPG.

Because the albums folder only contains the original images, it only needs to be accessed for the generation of thumbnails or image uploads (by the IIS_WPG process).

I.e. the originals are secured from direct acces (for example from guessing the link via the passed PHP varibales) and the gallery works as well as ever.

I hope this helps people looking to run Zenphoto on IIS.

Comments

  • I suspect "G" stands for "group".

    Do note that under some circumstances the original image is directly accessed other by PHP code than for generating resized versions. Most notably this is done by some javascript functions such as the slideshow. Sorry, but off hand I do not have a list of those.

    Blocking direct access is roughly equivalent of placing the album folder outside of the WEB path, so the same problems will apply. Most things work, though.
  • Thank you for the reply sbillard.

    -> Out of curiosity I just tried installing the slideshow plugin, and it works for me.

    Maybe because it also draws (at least for me) from the watermarked/copyrighted images which are cached on the server in the cache folder and not the original source images in the albums folder.
  • acrylian Administrator, Developer
    You need to understand how Zenphoto works. If the sized images the slideshow uses for example are already created they will be used. But if not the access to the full images is required to create them. There should also be a diagram about this on the troubleshooting.

    At least without included flowplayer plugin multimedia items will also NOT work with an external albums folder as these need to access the full image directly.
  • "access to the full images to create them" - I guess when I need to wait for the image to be created, the cached image doesn't exit - in that case the slideshow still works for me on IIS.

    Here is what I did to test it:
    I deleted the cache (per availble function) and went into a subgallery - thumbnails were missing (as expected) and were recreated.

    Next went into an image -> again the watermarked image was created.

    Next I went into te slideshow - I had to reload the page to see the images, but then again I see the watermarked images.
    (Which is odd in a way as the watermark isn't ticked for the slideshow...)
  • acrylian Administrator, Developer
    Exact, then you have to wait. The bigger the image and the slower the server (or busy otherwise) the more time it takes.

    You said the slideshow uses the watermark although the option is not selected? That would be a mistake then...
  • Waiting for the thumbnail isn't too bad - in my case.

    JQuery Cycle gives me the watermarked image although the option isn't ticked, it works althoughthe albums folder is locked for IUSR

    The Flowplayer shows the images without a watermark - and as you pointed out correctly - only works when IUSR can access the albums folder.
    At the same time, the flowplayer doesn't want to display a watermark... even when I tick the option in the plugin settings...

    And lastly: JQueryColorbox - I can only get the watermarked image, no matte whether I tick the option or not
    It also races through the images ignoring my time setting.
    As a side result - because it draws on cached images, it again does not need IUSR acess to the albums folder.

    I hope this is informative to some extent.
    (IIS6 on WHS)

    Edit:
    Tink I know what the "speed issue" on the colourbox is - there are two funcion for how fast the slideshow is... one was 1s while the other was 3s...
  • acrylian Administrator, Developer
    JQuery Cycle: That is probably an mistake then. Please open a ticket. Not sure if we get to this for 1.4.1 anymore.

    Flowplayer: Of course as it uses the full image directly. Not possible otherwise.

    Colorbox: I think Cycle and Colorbox slideshows just calculate differently. So you have to define it specifially for both.
Sign In or Register to comment.