Laravel Access Images outside public folder

Question

I need to store images in a backend for logged in users. The stored images need to be protected and not visible from the outside (public). I choosed a "storage" folder for this.

I came up with this in my Controller:

public function update(Request $request, $id)
{

  //Show the image
  echo '<img src="'.$_POST['img_val'].'" />';

  //Get the base-64 string from data
  $filteredData=substr($_POST['img_val'], strpos($_POST['img_val'], ",")+1);

  //Decode the string
  $unencodedData=base64_decode($filteredData);

  //Save the image
  $storagepath = storage_path('app/images/users/' . Auth::user()->id);
  $imgoutput = file_put_contents($storagepath.'/flyer.png', $unencodedData);

  return view('backend.flyers.index')->withImgoutput($imgoutput)
                                     //->withStoragepath($storagepath);

}

after hitting the save button, which triggers the update() I am able to see the image in my view, and it is also stored in my folder (current users=10) "storage/app/images/users/10/flyer.png"

my question is how can I access the image path? I want to show the stored image with img src="">. I have no idea what to put inside "src= ..."

Are you sure you went through any basic PHP/Laravel readings? — Mina Abadir
Actually, you are using functions that does not exist in Laravel. Your code is showing lack of information. I would really recommend going through some PHP and Laravel readings before going through a new application. — Mina Abadir
For instance, you do not echo strings from Controller, then return a view. It does not work this way. — Mina Abadir

Saumya Rastogi Saumya Rastogi · Accepted Answer · 2016-09-28T16:56:12

While dealing with user file uploads in web applications, the major aspect is about user's content's security. One should use secure way to upload private files of a user in web applications.

As in your case, you want to access user's image outside public folder. This can be done in a most secure way as given below.

First of all create a directory right in the root directory of Laravel (where the public folder is located), let the directory's name be uploads. Use this directory to upload private user files.

In the case of images create an another directory inside uploads as uploads/images/ inside uploads directory so that you can have a different storage locations for different type of files.

Remember to upload the image in images directory with a different name and without their extensions so that it looks like a extension-less file. Keep the file name and its extension in the database which can be used later to retain image's location.

Now you need to create a separate route to show user's image.

Route::get('users/{id}/profile_photo', 'PhotosController@showProfilePhoto')->name('users.showProfilePhoto');

PhotosController.php

class PhotosController extends Controller {

    private $image_cache_expires = "Sat, 01 Jan 2050 00:00:00 GMT";
    public function showProfilePhoto($id) {
      $user = User::find($id);
      $path = base_path() . '/uploads/images/';

      if($user && $user->photo) // Column where user's photo name is stored in DB
      {
        $photo_path = $path . $user->photo; // eg: "file_name"
        $photo_mime_type = $user->photo_mime_type; // eg: "image/jpeg"
        $response = response()->make(File::get($photo_path));
        $response->header("Content-Type", $photo_mime_type);
        $response->header("Expires", $this->image_cache_expires);
        return $response;
      }
      abort("404");
    }

}

The method above inside PhotosController - showProfilePhoto($user_id) will run as soon as you access the route named - users.showProfilePhoto.

Your HTML code will look like this.

<img src="<?php echo route('users.showProfilePhoto', array('id' => $user->id)); ?>" alt="Alter Text Here">

The above code will work like a charm and the image will be shown to the user without declaring/publishing the proper image path to public. According to me this is the secure way to deal with file uploads in web applications.

Laravel Access Images outside public folder

4 Answers