Where to store images?

[AlfaProject]

Hello I planning to write an image storing service with perl,mod_perl2,mysql and files. From what i found in the internet , best way for store images is standart unix files and not mysql database. For instance each user will have his own directory , so how I give him a privacy that only he would have a permission to view files in that directory (of course after that he is registered user)? Thanks !

[Marshall]

Databases can store what are known as BLOB's, Binary Large Objects. However if you want to store a lot of these BLOB's, I would be thinking about storing the user metadata in a database and having a "pointer(s)", which could be filepath(s)) to the BLOB object(s) which are stored as file(s) under the file system.

You probably do NOT want each of your users to have an account on your server machine, therefore the OS cannot provide any security for file access. Your application will have to do that.

One user might have 500MB of BLOB's, but only his meta-data is stored in the actual DB. There are of course significant complications with this. Think about the question in terms of what you are trying to do (how many users, how much total data, how much data per user, etc) and re-post a more detailed question that relates to your specific job at hand.

[sundialsvc4]

I advocate storing images and other BLOBs in the file-system, indexed by a nonsensical key such as a UUID. It is absolutely impossible for anyone to "guess" what a valid UUID would be.

Upon receipt of such a URL, your program looks-up the UUID and makes sure that the user is entitled to receive it, then serves up the contents of the file... which is not otherwise accessible to the user.   If the user is not authorized, fail the request, and don’t say why (except in the server logs).

In this way, you provide a secure and “opaque” reference to the data, while using the file-system (or the SAN or what have you) for what is, after all, its intended purpose in life:   as a database designed to store millions of arbitrarily-sized and potentially-large objects called files.

[Anonymous Monk]

Store access control metadata, probably in a database correlated with the file by however you uniquely identify it in your system.

[JavaFan]

For instance each user will have his own directory , so how I give him a privacy that only he would have a permission to view files in that directory (of course after that he is registered user)?

By not giving him direct access to the files. Use URLs like:

http://www.example.com/image/12345

and map the 12345 to a specific image for the user. Apache can do URL rewriting, and so can many frame works. Just don't turn them into redirects. You'd use a database to map the tuple (user, number) to a file path.

[Khariton]

If I understand right you question, you can upload pictures, rename it to format g564se9e.jpg, where name is generated and original. then write to mysql database which user is owner of this file. directory where thouse files will be stored must have permitions with RW only for one system user(as example myscriptuser). You must create functions for read or write pictures to storage with this user permitions.

[AlfaProject]

Yes , but the problem is that it takes to much performance from the server. If there is too much users run this script , server will die. Much simple way to do it (like other says), just make a random names for directories and files . Probability to find these files are very low. But you can make a script that will find these files by 'brute search' and then it makes the service bad privacy service.

[AlfaProject]

one guy give an advice to write images into cgi-bin folder , and then cat them from perl scripts to html pages. Sounds like that is what I need... What do you think ?

[JavaFan]

What do you think

Sounds pretty stupid to me. It would mean you have a program reading images from disk, writing that to a pipe to a different program, which then feeds them to the wire. On top of that, you're storing images in a directory that is supposed to have executables.

[AlfaProject]

I don't have to use cgi-bin directory for that . I can create a directory with only RW permission for apache. That's better than storing files on open directory for all people.