Ok, here's a quick tutorial on the PhocaGallery and .htaccess files.
GOAL: To lockdown the direct URL access to the PhocaGallery image directory and its subdirectories.
Access from within the Component Phocagallery and its download functions will still work.
REASON: To prevent access to sensitive or copyright protected materials.
Jan, feel free to copy and paste to your heart content! (For the FAQ you where thinking to write... 
)
Prerequisites:
Apache 2
Joomla! 1.5.7 (not important, this tutorial is valid for any document in Apache www/ path)
Linux (There are well known issues with Windows/Apache and .htaccess. Please search Google for answers)
Path: The path for image is below WWW/ (Apache document root) (Component standard)
All testing performed on LOCALHOST. The
hosting environments differs quite a bit and it is your responsibility to find out what settings your provider has for your specific site. Remember all this is Apache2 and Apache2 ONLY. So all questions to your hosting should be in regards to that.
My reason for compiling this info is to save some poor soul out there some headache and time. This looks simple at first, but it's not. Apache2 is a very powerful, scalable server, and the documentation matches that...
Ok, ready?
We will first need to create three files.
The '.htaccess' files that goes into the directory we need to protect (and sub-dirs is included of course).
The '.htgroups' and '.htpasswd' that we will place in a protected directory. (N.B. some tutorials place this in same directory as '.htaccess', that is wrong and not a sound security solution.
CREATE THE .htaccess file
1. Use any texteditor that does not insert hidden charachters and for good sake don't use line wrapping.
Create a new file called '.htaccess' This is a normal text file!
2. Insert the following code into the new file:
Code: Select all
# This is a comment line - Use for your own comments
AuthType Basic
AuthName "Joomla Administrator Only"
AuthUserFile /var/www/mysitenamehere/administrator/authorization/.htpasswd
AuthGroupFile /var/www/mysitenamehere/administrator/authorization/.htgroups
<Limit GET>
require group admins
require valid-user
</Limit>
N.B. I use multiple domains, so if you only have one, or use LOCALHOST then remove the 'mysitenamehere/' so it instead reads:' /var/www/administrator/authorization/.htpasswd'
3. Save the file in '/images/phocagallery' or wherever your image gallery starting point is.
4. Create a new file called '.htgroups' (Normal text file as mentioned above)
5. Insert the following text into the new file:
You can insert any group name you want here like 'admins', 'maintenance' or whatever you like. The reason for using groups is because it is more complete and more logical than to cram all potential user into the .htaccess and .htpasswd file.
6. Save the file in a new directory called 'authorization' in either '/administrator/.. or above the WWW-root (ex. /var/authorization/')
And as usual, we use the 'authorization' as a name in this tutorial. You can set it to anything you like. Remember to change the .htaccess file though. Since it points to this directory.
7. Create a new file called '.htpasswd' (...again, a normal text file)
8. Insert the following text into the file:
Code: Select all
# This is the encrypted password for web_admin
# Created by http://www.webmaster-toolkit.com/
# Can also be created with Apache command: htpasswd -c /usr/local/apache/passwd/passwords web_admin (-c is only used first time! 'create')
# ACTIVE PASSWORD
web_admin:we3u6m0yKvKdg
I recommend using the
http://www.webmaster-toolkit.com/ link to create the password, if you're unexperienced how to handle this.
9. Save this file into the same directory as you did under #6. above.
That concludes the file creation for '.htaccess' functionality' Now we go on to edit Apache2.
10. Now, since we're on LOCALHOST, you have to edit the Apache configuration file. A lot of tutorials calls this for 'httpd.conf'. That name is depreciated (not in use) and instead with Apache2 it is a file called 'apache2.conf' in '/etc/apache2' that is your target.
11. Open this file in a editor (normal text file...nag...nag..)
12. Insert the following text:
Code: Select all
# AllowOverride All inserted to accept all .htaccess files. (Apache default but included here for clarity!)
# The 'AuthConfig' directive is as stated from Apache in order to allow use of .htaccess To be used if you want to exclude the AllowOverride All)
<Directory /var/www/mysitenamehere/administrator>
#AllowOverride AuthConfig
AllowOverride All
</Directory>
<Directory /var/www/mysitenamehere/images/phocagallery>
#AllowOverride AuthConfig
AllowOverride All
</Directory>
#
# AccessFileName: The name of the file to look for in each directory
# for additional configuration directives. See also the AllowOverride
# directive. Not needed since '.htaccess' is default.
# You can use ex '.config' Remeber to change Joomla! in that case! (SEO/SEF)
#
# AccessFileName .htaccess
#
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<Files ~ "^\.ht">
Order allow,deny
Deny from all
</Files>
13. Save the file. Oh, and I hope you made a backup first?
14. Restart the Apache2 server. Either by Linux '/etc/init.d/apache2 restart' or via your GUI (usually running as a Service in the OS)
15. Empty the Web browsers Cache! And then reload/load the page.
Now, when entering the the Phocagallery directory in your browsers URL or the Administrator interface, you will have to enter the userid: 'web_admin' (or your own id here) and tha password you've set. before gaining any access. (The password is unique and does not have to be the same as any other password, if you don't want to of course).
Failing to provide these credentials lead to a '401 - Authorization Required' message. This comes from the Apache2 and can be styled to your liking. (Sometimes you can style such error pages in your SEO application)
Another tip is that you can make a simple index.(php/html) file and put in the directory (image directories usually don't have them. Normal Joomla! directories do.) Why? Because if it's not there the default for all webservers is to show the browser the file directory. (Your images). Inserting an 'index' file hides the files and the user only see that page.
N.B. As you saw above under step #12. I took the liberty of including also the '/administrator' directory. This is something you should ALWAYS do with Joomla!. Why? Simply because the administrator login is not sufficent. (Remeber the security hole in 1.5.6?...there are likely to be more...)
Just remember to place a copy of the '.htaccess' file in the '/adminstrator' directory too.
An extra bonus is of course that you now also has protected ALL '.ht*****' files from being accessible from the normal surfer. Including the one in Joomla! root.
And that's it!
If you install
other components or directories you want to protect from direct URL acess, then just copy the 'htacess' file into the directory of choice. Oh, and new users? Just add them to the two files '.htgroups' and '.htpasswd' in the same manner as above.
Moving the site to a hosting environment? Just create new passwords with the new path as instructed on the URL above under #8. And change the '.htaccess' paths for the group and password file to reflect the new environment.
All this of course leads to some more administrative tasks and can depending on the number of users in the files (read +100), lead to a slower site. But would you rather that the photos you are selling or the downloadable music your band is trying to sell get stolen? Didn't think so.
Just to really scare you: I've spent five hours just surfing and testing others installations of Phocagallery, wbGallery and some other well-known Joomla! gallery components. From approximately
75% of them I could download the large/original image/photo after some intelligent use of the normal web development tools that you can get as addons to Firefox! Ouch!
Have fun with your improved security!
Regards
Akerman
... Phoca doesn't display the exact url way to original image (except you will display donwload link, ...) but there is no protection in permission area yet 
Trying to dig a bit in the CSS...right now...hmm..