Storing Images in FS-in Tomcat path-working now? strategy?

Jaymer

One of the recent improvements in AIM was that if you stored your images in the file system, then Aware/Tomcat would not have to make a copy of them so they were in the web server's path - I think this was to alleviate the issue of \AwareIM.... being filled with all the images served by your application.

There were some mentions on the forum that this didn't appear to work INITIALLY.

1) Can anyone confirm that this works and achieved the desired result?

2) Since one strategy might be to store images like this:
c:\AwareIM\Tomcat\webapps\AwareIM\Images\Inventory\ABC-main.jpg
c:\AwareIM\Tomcat\webapps\AwareIM\Images\Inventory\ABC-rear.jpg
c:\AwareIM\Tomcat\webapps\AwareIM\Images\Inventory\ABC-side.jpg
(where ABC is the company inventory SKU)
then whats to keep anyone (logged in user, casusual hacker, tinkerer) from just trying URL's and getting access to images, even if they are not logged in?

It would seem you need to randomize the filename so it can't be guessed, and hope you never lose the connection in the database - because you won't be able to programmatically re-attach them.

any ideas?

ACDC

One of the recent improvements in AIM was that if you stored your images in the file system, then Aware/Tomcat would not have to make a copy of them so they were in the web server's path - I think this was to alleviate the issue of \AwareIM.... being filled with all the images served by your application.

I think the reason why this feature was developed was storing images in the file system is more efficient than in the database, especially high volumes of pictures. I don't think it was a solution to remove them from the web path

The fact that you can second guess the filename and access the image is a major problem for me especially when it comes to things like signature images. Also, I like the concept of using SVG images in a form to present charts and reports generated outside AwareIM. The problem here is if they are confidential, they are exposed to a certain extent

I understand from another post in the forum, that a solution to this was presented by Robin at the Espino conference. I tried to get more information on this but to no avail
Pictures FileSystem - Best Practice Discussion?>

t would seem you need to randomize the filename so it can't be guessed, and hope you never lose the connection in the database

With regards to the file name, I don’t think the original filename is used when AIM creates the copy , the filename is randomised already to a certain extent. (I could be wrong, I haven't spent much time on this , my main concern on this is being able to store the pics in the file system as opposed to the database )

As a workaround, I thought of running a process to periodically clean up the images, they are only used for the initial presentation and never reused

Jaymer

well, 1 thing Robin did in his presentation was to add a timestamp (so to speak) to the filename - but his reason for this was so that an updated image would have a slightly diff filename (cause of timestamp) and thus fail a cache test which would ensure the image was updated to the client.

Turns out that the night before I watched Robin's presentation earlier this week, I did something on my own which was almost exactly what he showed at the conf. even though I had no knowledge of what he did. He did a demo of taking the CRM images (stored in db) and in TSQL, extracting them to the FS. I did a google search for "mssql export image to file" and found this page. Worked perfectly for this:

I had a customer MSSQL table that used Images (in varbinary) in the db.
Under the "old aware", imagine that the image has to be copied from SQL and stored into a temp space (usually AwareIM/bin) to be served.
The "new aware" massively improves performance by simply pointing to the image thats in the FS.
So in about a minute, I extracted 4,000 images, and created the peer child record to connect images to an Aware parent rec. Images are blazingly fast to the client.

So, in a sense, i answered my own Q... storing Images in Tomcat's path works like a champ.

Jaymer

Now, about Obfuscating the filename... I think that would be pretty easy.

Inventory item # A123
Image filename might be "A1234_1.jpg"

So, a crafty person might guess to see if "A1234_2.jpg" exists.

All thats needed would be to add a timestamp to the end - using seconds or milliseconds:
"A1234_1_2019092913451023.jpg" and
"A1234_2_2019092913479807.jpg" and

You can always reconnect them to the parent, because "A1234" is the actual item, and _1, _2 is a sequence. The rest just helps hide it from prying eyes.

ACDC

Good idea, thanks for shining a light on this. I'll put this in my Jaymer folder 😃