I need to load images from a secured network drive into an HTML document. I understand that because the network drive is not part of the webroot, this is not an option and is considered a security feature to protect the files that live on the network drive and server.

I have done some research and found these solutions:

https://stackoverflow.com/a/46003218/16511184

https://www.tek-tips.com/viewthread.cfm?qid=935379

These solutions both mention the use of server-side code to access images, as the server should have permission to access files on the network drive. My question is, how do I deliver the images to the HTML document, and in ColdFusion?

My naiive guess was to just grab the image name from a query made on the server, but just slotting the name into the img tag's src attribute creates the original issue of client trying to access an image on the network drive they don't have permission to view.

CodePudding user response：

Using a virtual directory to reference images on a network drive technically works, but then any images in the "folder" will be publically available to the website. Instead, you need to use <cfcontent> to read the images from the network drive and present them to the browser.

In the HTML, you'll use a CFM as the source for an image tag:

<img src="/path/to/image.cfm?imageID=1234">

You'll reference the image file by an ID and NOT by a file name. Using a file name would still allow anyone to poke around and try to load files at random. You never give the path of the file on the server via the query string.

In image.cfm, you'll load the image file's path and use <cfcontent> to deliver the file. https://cfdocs.org/cfcontent

<cfcontent type="image/jpeg" file="//path/to/network/image.jpg"> 

You should also validate that the user has the correct role and permission to view the image in question.