(no subject)

[arethinn]

I am just tearing my hair out over trying to host the pictures for my custom mood themes on my own website rather than in LJ ScrapBook, which is where they currently are. (I'm considering letting my paid account lapse, so ScrapBook would go with that. Technically you don't get custom mood themes with a basic account, but if you have one already in place, it's supposed to stick, although you can't make further changes to it.) If I turn off hotlinking protection, everything is hunky-dory, but I want that on. And I can't seem to enter anything in the allowed referers list that actually works and lets the images appear. It won't take input like .insanejournal.com; it apparently has to be a full URL beginning with http://, and besides that, http://www.insanejournal.com doesn't make it work anyway. I can only assume that the actual http request is coming from some other server name, but I can't figure out what. (I happened to be testing on IJ because I want it to work there too, but my recollection is of having similar problems on LJ the last time I tried this with hotlink protection. I assume the same will be the case on Dreamwidth.) edit 2: No, in fact, the case is that the referer changes to match the account name of the person reading their flist. (I could add my own journal name to the list but it would only work if someone viewed the journal directly.) With wildcard entries simply getting erased if I try to add them to the whitelist, I can't see how it's feasible to add all possible referers. Argh.

I really don't want to do something like start a Photobucket account just for this. There should be a way to make this work but I am just at my wits' end.

edit 1: Really, I suppose I could learn to live without the mood themes; most of the time I forget to set a mood on posts anyway. But I need a place to stick pictures when I just want to display them in my journal, which is the other main thing I use ScrapBook for. I suppose if it came to it I could stick them in my deviantArt scraps or flickr or something, but it doesn't seem like the "right" solution somehow.

Comments

[digitalsidhe.livejournal.com]

Okay, we can make this work. Definitely. This is standard Apache mod_rewrite stuff.

I'll need to actually look up the reference on it when I have a chance. I don't use this kind of thing so often that I can just whip out a fix right here at work. Is your LJ account going to expire super-soon, or have I got a couple of days?

As for putting something lower down, you could put a .htaccess file in the directory you wanted to un-protect and have it say something like "RewriteRule .*\.(jpg|jpeg|gif|png|bmp)$ - just go ahead and hand them the image" to override the higher-up one. But you'd need an explicit rule, not just a blank file. I could look up the code for that, but I suspect you actually want it to only allow access from IJ (in addition to eristic.net).

[arethinn]

Is your LJ account going to expire super-soon, or have I got a couple of days?

It's actually the IJ account which is the limiting factor as the soonest expiration (since I won't be able to edit the image uri's in its custom moodtheme thereafter), but that's not until March 17th. This LJ account isn't due until May sometime and elethian's (from which I would also need to snarf back my images) is way out in November or something.

As for putting something lower down, you could put a .htaccess file in the directory you wanted to un-protect and have it say something like "RewriteRule .*\.(jpg|jpeg|gif|png|bmp)$ - just go ahead and hand them the image" to override the higher-up one. But you'd need an explicit rule, not just a blank file. I could look up the code for that, but I suspect you actually want it to only allow access from IJ (in addition to eristic.net).

Strictly speaking, yes (IJ, LJ, and DW), although it would be fine to have those directories generally open for now and change it to a more strict command later.

[arethinn]

With the aid of a couple mod_rewrite sites I think we worked it out. Basically just added lines for .insanejournal.com, etc. (RewriteCond %{HTTP_REFERER} !.insanejournal.com/.*$ [NC] .. and so on) into the .htaccess file that's in the pics directory in question. This may not be quite the "right answer" in terms of perfect security (for one thing, you could hotlink to those images to make your own moodtheme or use as journal pics) but I think it's ok for my purpose and I could possibly mess about with it later.

[digitalsidhe.livejournal.com]

Gah, sorry about not getting back to you on this sooner.

Did you copy the .htaccess file to the image directory, then add the new line(s) to what was already there? Or did you just make a new .htaccess file with just those new lines, and nothing else?

The former should work. The latter should not. But if you've tested it and found it to work, then that's good.

As far as keeping anyone else from making their own mood theme using it... I can't see a way to do that. Allowing hotlinking does allow hotlinking, so...

But I suspect the risk is low (and if someone tried it, you could always swap out the images for something that makes them look like horrible hotlinkers).

[arethinn]

Did you copy the .htaccess file to the image directory, then add the new line(s) to what was already there?

That, yeah. Those images are never referenced on eristic.net so it's not like that permission needed to be there, but it doesn't hurt anything.

But I suspect the risk is low (and if someone tried it, you could always swap out the images for something that makes them look like horrible hotlinkers).

It'd break my own moodtheme too, though, so at that point all I could do is switch back to a public one. But yeah, I think the risk is low.

[digitalsidhe.livejournal.com]

But you'd know you were making the switch, and so you could update your moodtheme to use the new URLs.

Sorry, I just realized I left out a step! Example:

Suppose you have some icon at eristic.net/ljstuff/icon.png, and someone starts hotlinking to it. You could move that thing to .../new-icon.jpg, and replace it with a nasty image, and update your moodtheme to reference the new one.

A lot of work, true.

[arethinn]

But you'd know you were making the switch, and so you could update your moodtheme to use the new URLs.

No, I couldn't, as I think I've said a couple times was the whole point of this exercise: to change them from ScrapBook urls to my website URLs before I couldn't anymore. Custom mood themes are a paid feature; if you have one in place when your account expires, it sticks (supposedly -- obviously I have never tested this before, but we'll find out on Wednesday), but you can't edit it. So I wouldn't be able to change the URLs for the pictures and if I changed the pictures themselves and broke it, my only option would be to revert to a public moodtheme (or live with broken, but that's silly).

[digitalsidhe.livejournal.com]

Oops! Right, sorry about forgetting that. *headsmack*