(no subject)

[arethinn]

I am just tearing my hair out over trying to host the pictures for my custom mood themes on my own website rather than in LJ ScrapBook, which is where they currently are. (I'm considering letting my paid account lapse, so ScrapBook would go with that. Technically you don't get custom mood themes with a basic account, but if you have one already in place, it's supposed to stick, although you can't make further changes to it.) If I turn off hotlinking protection, everything is hunky-dory, but I want that on. And I can't seem to enter anything in the allowed referers list that actually works and lets the images appear. It won't take input like .insanejournal.com; it apparently has to be a full URL beginning with http://, and besides that, http://www.insanejournal.com doesn't make it work anyway. I can only assume that the actual http request is coming from some other server name, but I can't figure out what. (I happened to be testing on IJ because I want it to work there too, but my recollection is of having similar problems on LJ the last time I tried this with hotlink protection. I assume the same will be the case on Dreamwidth.) edit 2: No, in fact, the case is that the referer changes to match the account name of the person reading their flist. (I could add my own journal name to the list but it would only work if someone viewed the journal directly.) With wildcard entries simply getting erased if I try to add them to the whitelist, I can't see how it's feasible to add all possible referers. Argh.

I really don't want to do something like start a Photobucket account just for this. There should be a way to make this work but I am just at my wits' end.

edit 1: Really, I suppose I could learn to live without the mood themes; most of the time I forget to set a mood on posts anyway. But I need a place to stick pictures when I just want to display them in my journal, which is the other main thing I use ScrapBook for. I suppose if it came to it I could stick them in my deviantArt scraps or flickr or something, but it doesn't seem like the "right" solution somehow.

Comments

[arethinn]

Yeah... if I actually save one of the mood pics as one of the forbidden ones, this is the error:


/pics/combohpmoods/angry.jpg
Http Code: 403 Date: Mar 09 15:33:09 Http Version: HTTP/1.1 Size in Bytes: 632
Referer: http://elethian.insanejournal.com/167159.html
Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)


I think when someone views their friends page, the referer is theirname.insanejournal.com, and not mine... so

oh! Yeah, lol. Test post happily obliged me with some sample errors for that:

*


/pics/combohpmoods/angry.jpg
Http Code: 403 Date: Mar 09 15:40:56 Http Version: HTTP/1.1 Size in Bytes: 632
Referer: http://redqueenmeg.livejournal.com/friends
Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8 (.NET CLR 3.5.30729)


There's no way I can enter all the possible referers for this kind of thing.

Ugh.

Looks like my choices are "turn off hotlink protection" (which... that annoyed me, the places I found my bandwidth being stolen the last time I looked; I wasn't anywhere near over quota, but still) or "find a service just for this purpose". Yuck.

[digitalsidhe.livejournal.com]

There's no way I can enter all the possible referers for this kind of thing.

Depends. Your hotlink blocker may have a wildcard feature. If so, *.insanejournal.com/* ought to work (assuming the configuration syntax uses asterisks, of course; let me know if you need a regex or something).

[arethinn]

Depends. Your hotlink blocker may have a wildcard feature. If so, *.insanejournal.com/* ought to work

As I said in the OP, it seems to accept only full http:// ... items in the list. I've tried things with asterisks and also .insanejournal.com (with nothing leading) and they just vanish. I could try a regexp if you could supply one but I'm not very confident. (Experience with my usual attempts at wildcards being defeated was how I arrived at "and it's not feasible to enter all possible referers [manually].")

I don't know what the software actually is called (it just says "HotLink Protection" in Cpanel); I don't have that much control over the server. (They are running Apache but the format/syntax of the errors in the "Most recent 300 visitors" page I'm pasting from may be different.)

[digitalsidhe.livejournal.com]

I've tried things with asterisks and also .insanejournal.com (with nothing leading) and they just vanish. .... (Experience with my usual attempts at wildcards being defeated was how I arrived at "and it's not feasible to enter all possible referers [manually].")

Oh. Well, crappity. :(

Ummmm... send a tech support request to your web hosting provider? I'll happily supply a regex, if you want, but I have trouble imagining that it would work. It sounds like they're sanitizing the data as you provide it, and would just strip out or reject it somehow.

(And kudos to them on the sanitizing; it may be annoying to us at the moment, but at least they're handling data properly instead of just taking any old thing and attempting to interpret it in some weird manner later.)

[arethinn]

Ummmm... send a tech support request to your web hosting provider?

That was the only other thing I could think of either. I dunno if solving this kind of problem is included in the support they provide, but it might be worth a shot.

[digitalsidhe.livejournal.com]

My thought on that score was that they might either be able to say, "Oh, yes, we know about this problem. The solution is X", or "Oh, yes, we know about this problem, and we know that there is no solution." Either way, the situation gets resolved.

[arethinn]

I imagine from their perspective it is not a "problem" exactly: I turned on hotlink protection, and it works. lol. And of course in the latter case it leaves me with the original issue of where do I put images I want to use on LJ/IJ/DW, if not in ScrapBook.

anyway, thanks for your help!

[arethinn]

Official answer: "It's not robust enough to do wildcards for referrers. The best you can do is exempt a directory from the protection while protecting another directory."

It looks like what this tool is actually doing is writing me an .htaccess file in my root web directory without my having to know how to do that. If I understand right, all I should need to do is put another .htaccess file in the subdirectory I want "open" which doesn't do this blocking? (Learning the proper syntax is another problem, but doable.)

[digitalsidhe.livejournal.com]

Possible. Theoretically possible. Can you read that .htaccess file? Can you write changes to it?

If you can do both of those things, can you send me a copy?

You can harmlessly test to see if you can write changes to it by adding a comment line, such as:

# This is a comment

Apache reads any line beginning with # as a comment.

If that works out, we might be able to make this work. Might.

[arethinn]

Sure, works fine. This is what's in there now:

RewriteEngine on

Options All -Indexes

RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://eristic.net/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://eristic.net$ [NC]
RewriteCond %{HTTP_REFERER} !^http://games.eristic.net/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://games.eristic.net$ [NC]
RewriteCond %{HTTP_REFERER} !^http://otherkind.eristic.net/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://otherkind.eristic.net$ [NC]
RewriteCond %{HTTP_REFERER} !^http://pagan.eristic.net/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://pagan.eristic.net$ [NC]
RewriteCond %{HTTP_REFERER} !^http://photo.eristic.net/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://photo.eristic.net$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.eristic.net/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.eristic.net$ [NC]
RewriteRule .*\.(jpg|jpeg|gif|png|bmp)$ - [F,NC]


I thought that just putting blank ones lower down would override it and say "that stuff you inherited from public_html, well forget all of it, it don't apply in public_html/pics/moodtheme" and that therefore image linking would work in that directory, but that appeared not to be the case. Seems I'm not understanding how .htaccess works and it needs to be specific commands.

[digitalsidhe.livejournal.com]

Okay, we can make this work. Definitely. This is standard Apache mod_rewrite stuff.

I'll need to actually look up the reference on it when I have a chance. I don't use this kind of thing so often that I can just whip out a fix right here at work. Is your LJ account going to expire super-soon, or have I got a couple of days?

As for putting something lower down, you could put a .htaccess file in the directory you wanted to un-protect and have it say something like "RewriteRule .*\.(jpg|jpeg|gif|png|bmp)$ - just go ahead and hand them the image" to override the higher-up one. But you'd need an explicit rule, not just a blank file. I could look up the code for that, but I suspect you actually want it to only allow access from IJ (in addition to eristic.net).

[arethinn]

Is your LJ account going to expire super-soon, or have I got a couple of days?

It's actually the IJ account which is the limiting factor as the soonest expiration (since I won't be able to edit the image uri's in its custom moodtheme thereafter), but that's not until March 17th. This LJ account isn't due until May sometime and elethian's (from which I would also need to snarf back my images) is way out in November or something.

As for putting something lower down, you could put a .htaccess file in the directory you wanted to un-protect and have it say something like "RewriteRule .*\.(jpg|jpeg|gif|png|bmp)$ - just go ahead and hand them the image" to override the higher-up one. But you'd need an explicit rule, not just a blank file. I could look up the code for that, but I suspect you actually want it to only allow access from IJ (in addition to eristic.net).

Strictly speaking, yes (IJ, LJ, and DW), although it would be fine to have those directories generally open for now and change it to a more strict command later.

[arethinn]

With the aid of a couple mod_rewrite sites I think we worked it out. Basically just added lines for .insanejournal.com, etc. (RewriteCond %{HTTP_REFERER} !.insanejournal.com/.*$ [NC] .. and so on) into the .htaccess file that's in the pics directory in question. This may not be quite the "right answer" in terms of perfect security (for one thing, you could hotlink to those images to make your own moodtheme or use as journal pics) but I think it's ok for my purpose and I could possibly mess about with it later.

[digitalsidhe.livejournal.com]

Gah, sorry about not getting back to you on this sooner.

Did you copy the .htaccess file to the image directory, then add the new line(s) to what was already there? Or did you just make a new .htaccess file with just those new lines, and nothing else?

The former should work. The latter should not. But if you've tested it and found it to work, then that's good.

As far as keeping anyone else from making their own mood theme using it... I can't see a way to do that. Allowing hotlinking does allow hotlinking, so...

But I suspect the risk is low (and if someone tried it, you could always swap out the images for something that makes them look like horrible hotlinkers).

[arethinn]

Did you copy the .htaccess file to the image directory, then add the new line(s) to what was already there?

That, yeah. Those images are never referenced on eristic.net so it's not like that permission needed to be there, but it doesn't hurt anything.

But I suspect the risk is low (and if someone tried it, you could always swap out the images for something that makes them look like horrible hotlinkers).

It'd break my own moodtheme too, though, so at that point all I could do is switch back to a public one. But yeah, I think the risk is low.

[digitalsidhe.livejournal.com]

But you'd know you were making the switch, and so you could update your moodtheme to use the new URLs.

Sorry, I just realized I left out a step! Example:

Suppose you have some icon at eristic.net/ljstuff/icon.png, and someone starts hotlinking to it. You could move that thing to .../new-icon.jpg, and replace it with a nasty image, and update your moodtheme to reference the new one.

A lot of work, true.

[arethinn]

But you'd know you were making the switch, and so you could update your moodtheme to use the new URLs.

No, I couldn't, as I think I've said a couple times was the whole point of this exercise: to change them from ScrapBook urls to my website URLs before I couldn't anymore. Custom mood themes are a paid feature; if you have one in place when your account expires, it sticks (supposedly -- obviously I have never tested this before, but we'll find out on Wednesday), but you can't edit it. So I wouldn't be able to change the URLs for the pictures and if I changed the pictures themselves and broke it, my only option would be to revert to a public moodtheme (or live with broken, but that's silly).

[digitalsidhe.livejournal.com]

Oops! Right, sorry about forgetting that. *headsmack*