Displaying an image from the tmp directory

I have the following. A website that create temporarily images in the /tmp folder on the Linux server. The reason why I store it within this folder is since these images need to be cleared once in a while and it's so much easier just to clear the tmp directory using tmpwatch. Now my issue is to display the image within my browser?

Code

<img src="/tmp/3d34636.png" alt="image" />  

I'm runnin开发者_StackOverflow中文版g Centos with PHP

---

@Didier already outlines the issue and the security risks. Even if you built a PHP script that accepts the file name as a parameter, and then passes through the file from the /tmp directory, you would be mixing public content with temp files that can contain sensitive data. You would have to keep a list of which files were generated by your script and are okay to display, and which ones are not, otherwise it would be a security hole.

I'd say forget /tmp for this despite the advantages, and store your images in a sub-directory of their own. Delete them frequently (e.g. using a cron job, or based on file age or the "last accessed" time).

---

The trouble here, is that this img tag will be processed by the browser (the client). This client does not have access to the filesystem of the HTTP server.

Therefore, you have either to define the /tmp directory to be a valid location of your HTTP server, using the files in /tmp/ directory (but note that it would serve any other file contained in this directory, potentialy a security risk).

Or you store these generated images in a subdirectory that is already served by your HTTP server.

It may also be possible to define this /tmp location on the server to be served by a script that would analyse the URL containing the image filename. This script would then open the file in /tmp/ and serve it.

---

You can get tmpwatch to clean up another directory by creating a cron job that runs the command:

/usr/sbin/tmpwatch -umc 240 /path/to/directory

The 240 is the number of hours that the files haven't been used for before deletion (in this case 10 days). See man tmpwatch for full details.