What can stop a user from manually typing in a function name in URL?

[eluser]Amitabh Roy[/eluser]
Not just the post id, you can pass another parameter which is essentially hash

Code:

http://localhost/imageforum/imageController/preview/23/wskl2347sd34545t324

In the page/controller you are generating the links you can set a cookie for the hash.
In the controller for preview you can check for the cookie value.
You can generate new hash every time the page containing the links to the post is rendered.


Now if you have several posts its up to you to devise a mechanism to use single hash for all the links for the current page generation or use different hashes for different links.

The way we do it for activation via email. ;-P


Cookie is just one of the scheme of validation to prevent direct access, other more refined methods can be definitely implemented.