Restrict direct image viewing

[eluser]Daniel Eriksson[/eluser]
If you want to access-control your images I suggest:

* Store the images in a protected directory (outside webroot for example).
* Store information about each image in a database (original file name, MIME-type, size, access restrictions, ...).
* In your image controller, check if the current user is allowed to view the image.
* Use header() and readfile() to send the image to the user.

Take a look at my reply in another thread: http://ellislab.com/forums/viewthread/75997/#380686