269606 - Doesn't show local images if HTML generated by PHP

Status: RESOLVED WORKSFORME

(Firefox :: Shell Integration, defect)

Description

[Måns Jonasson]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

OK, I'm going to _try_ and describe this as well as I can. 

First, I have simplified the steps here so it will be easy to replicate. 

The problem is that Firefox since 1.0 (1.0 PR and earlier did not show this
behaviour) will not show local images in HTML pages if they are generated
PHP/Win32. I have not had a chance yet to try other platforms or other scripting
languages. 

Let's say I have an image at C:\test.jpg. If i enter the code <img
src="file://C:\test.jpg"> in a standard HTML page and open it locally using
Firefox, the image shows up fine. However, if I paste the exact same code to a
new document and rename it ".php" instead of ".html", making my web server
(Apache/2.0.48 (Win32)) parse the file through PHP (PHP Version 4.3.4), the
image will not show up, Firefox will show a blank image instead. 

Right-clicking the image and choosing "View image" from the context menu on the
PHP-generated page will show the image just fine.

Since this bug only shows up in FF 1.0 I am reporting it here. It is possible of
course that the behaviour is in part caused by my versions of Apache and/or PHP,
but FF 1.0PR and Internet Explorer 6 on my computer does not show this behaviour.

I would imagine that this makes it very difficult to develop sites using PHP on
any workstation when using local images.

Reproducible: Always
Steps to Reproduce:
1. Create HTML file with an image-tag pointing to a local image
2. Paste same HTML code into a PHP file
3. Compare. 

Actual Results:  
HTML document shows the image, PHP document does not.

Expected Results:  
Both documents should have the image.

Here are my response headers from the PHP page:

Response Headers - http://localhost/test/test.php

Date: Sat, 13 Nov 2004 10:25:12 GMT
Server: Apache/2.0.48 (Win32) PHP/4.3.4
X-Powered-By: PHP/4.3.4
Transfer-Encoding: chunked
Content-Type: text/html; charset=ISO-8859-1

Comment 1

[Phil Ringnalda (:philor)]

It's not a matter of PHP, but of HTTP: you're seeing the results of bug 69070
fixing a security hole. When you load .html as a file:// URL, it's allowed to
access file:// URLs for images, but when you load .php through Apache on
http://localhost/ (I assume that's what you're doing), then it's through HTTP
and has to follow the same restrictions on not poking around your hard drive as
any other remote HTML. Simple workaround: use relative URLs,
src="images/foo/bar.jpg", rather than absolute file:// or http:// URLs.