How to Rewrite TimThumb to be used on emails

285 Views Asked by At

On my server I use TimThumb as plugin for resize my images, it works great except when I try to use it inside the content of my emails.

Google Gmail output this https://example.com/thumb.php?sr+c= as src attribute (notice the plus sign).

I read here that it's because of the query.

So how can I use .htaccess to rewrite my url and remove /thumb.php?src= with a /src/?

This is how it looks a link to the image:

https://example.com/thumb.php?src=example.jpg

This is what I need

https://example.com/src/example.jpg

This is my current .htaccess

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^welcome/([^/]+)/?$ index.php?a=welcome&filter=$1 [NC,QSA,L]
RewriteRule ^explore/([^/]+)/?$         index.php?a=explore&filter=$1   [NC,QSA,L]
RewriteRule ^page/([^/]+)/?$            index.php?a=page&filter=$1      [NC,QSA,L]
RewriteRule ^(([^/]+)+)(/([^/]{0,32})(/.+)?)?$ index.php?a=$1&q=$3 [L,QSA]

index.php and thumb.php are both in the root folder

UPDATE

I tried to add this line to my .htaccess and visit https://example.com/src/example.jpg but again it's not working, in this case it redirects to the "welcome" page.

RewriteRule ^src/([^/]*)$ /thumb.php?src=$1 [L]

2nd UPDATE

I tried this too:

RewriteRule ^src/([^/]+)/?$ thumb.php?src=$1 [NC,QSA,L]

Again it's not working https://example.com/src/example.jpg redirects to my "welcome" page.

This is how it looks now my .htaccess

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^welcome/([^/]+)/?$ index.php?a=welcome&filter=$1 [NC,QSA,L]
RewriteRule ^explore/([^/]+)/?$         index.php?a=explore&filter=$1   [NC,QSA,L]
RewriteRule ^page/([^/]+)/?$            index.php?a=page&filter=$1      [NC,QSA,L]
RewriteRule ^src/([^/]+)/?$ thumb.php?src=$1 [NC,QSA,L]
RewriteRule ^(([^/]+)+)(/([^/]{0,32})(/.+)?)?$ index.php?a=$1&q=$3 [L,QSA]

3rd UPDATE

Inside thumb.php this is how I build up the src query

$_GET['src'] = 'https://s3-eu-west-1.amazonaws.com/bucket1'.'/'.$_GET['src']; 

I can't figured it out what's wrong here.

4th UPDATE

Based on Vladimir Cvetic answer I tried this:

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^src/(.*)$ /thumb.php?src=$1 [L,QSA]
RewriteRule ^welcome/([^/]+)/?$ index.php?a=welcome&filter=$1 [NC,QSA,L]
RewriteRule ^explore/([^/]+)/?$         index.php?a=explore&filter=$1   [NC,QSA,L]
RewriteRule ^page/([^/]+)/?$            index.php?a=page&filter=$1      [NC,QSA,L]
RewriteRule ^src/([^/]+)/?$ thumb.php?src=$1 [NC,QSA,L]
RewriteRule ^(([^/]+)+)(/([^/]{0,32})(/.+)?)?$ index.php?a=$1&q=$3 [L,QSA]

And again it's not working, this is the error:

`The 't' parameter is not set.`

But it's strange since I set the 't' parameter condition empty as below:

if(!empty($_GET['t'])) {
    if($_GET['t'] == 'a') {
        $type = 'uploads/avatars';
        $width_list = array(25, 35, 50, 70, 100, 112, 150, 200, 300);
        $height_list = array(25, 35, 50, 70, 100, 112, 150, 200, 300);
    } elseif($_GET['t'] == 'b') {
        $type = 'uploads/backgrounds';
        ...
    } else {
        exit('Invalid parameter value');
    }
} else {
    $_GET['t'] == 'a';
        $type = 'uploads/avatars';
        $width_list = array(25, 35, 50, 70, 100, 112, 150, 200, 300);
        $height_list = array(25, 35, 50, 70, 100, 112, 150, 200, 300);
}

Indeed if I visit https://example.com/thumb.php?src=example.jpg I can see the avatar image correctly

1

There are 1 best solutions below

5
Vladimir Cvetic On BEST ANSWER

This should do the trick: RewriteRule ^src/(.*)$ /thumb.php?src=$1 [L,QSA]

TimThumb is unmaintained for years now as far as I know and has a security issue that will allow attackers to execute code on your server. Quick google search will reveal most of the TimThumb vulnerabilities.

I would suggest moving to a maintained package.