false, 'password' => null, 'site_url' => '', 'photos_per_page' => 100, 'debug' => false, ]; error_reporting(E_ALL); ini_set('display_errors', $config['debug'] ? '1' : '0'); ini_set('log_errors', '1'); ini_set('memory_limit', '256M'); header('X-Content-Type-Options: nosniff'); header('X-Frame-Options: SAMEORIGIN'); header('Referrer-Policy: strict-origin-when-cross-origin'); $photosDir = __DIR__ . '/photos'; $photosUrl = 'photos'; $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'avif']; session_set_cookie_params([ 'lifetime' => 0, 'path' => '/', 'secure' => !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off', 'httponly' => true, 'samesite' => 'Lax', ]); session_start(); function requireAuth(array $config): void { if ($config['password'] === null) { return; } if (!empty($_SESSION['gallery_authed'])) { return; } $error = null; $minInterval = 2; // seconds between attempts $lastAttempt = $_SESSION['gallery_last_attempt'] ?? 0; if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['gallery_password'])) { if ((microtime(true) - $lastAttempt) < $minInterval) { $error = 'Too many attempts. Please wait a moment and try again.'; } elseif (password_verify($_POST['gallery_password'], $config['password'])) { session_regenerate_id(true); $_SESSION['gallery_authed'] = true; unset($_SESSION['gallery_last_attempt']); $qs = $_SERVER['QUERY_STRING'] ?? ''; header('Location: ' . strtok($_SERVER['REQUEST_URI'], '?') . ($qs ? '?' . $qs : '')); exit; } else { $_SESSION['gallery_last_attempt'] = microtime(true); $error = 'Incorrect password.'; } } ?> Password required

🔒 Protected Gallery

Enter the password to continue.

/dev/null'); return $available = !empty(trim((string) $result)); } function getImageMetadataViaExiftool(string $path): ?array { $escaped = escapeshellarg($path); $json = @shell_exec("timeout 5 exiftool -json -n -GPSLatitude -GPSLongitude -Make -Model -DateTimeOriginal -ISO -FocalLength -FNumber -ExposureTime {$escaped} 2>/dev/null"); if (!$json) { return null; } $data = json_decode($json, true); $row = $data[0] ?? null; if (!is_array($row)) { return null; } $metadata = [ 'camera' => null, 'date' => null, 'date_iso' => null, 'iso' => $row['ISO'] ?? null, 'focal_length' => null, 'aperture' => null, 'shutter' => null, 'latitude' => $row['GPSLatitude'] ?? null, 'longitude' => $row['GPSLongitude'] ?? null, 'gps_url' => null, ]; $make = trim((string) ($row['Make'] ?? '')); $model = trim((string) ($row['Model'] ?? '')); if ($make && $model) { $metadata['camera'] = $make . ' ' . $model; } elseif ($model || $make) { $metadata['camera'] = $model ?: $make; } if (!empty($row['DateTimeOriginal'])) { $timestamp = strtotime(str_replace(':', '-', substr((string) $row['DateTimeOriginal'], 0, 10)) . substr((string) $row['DateTimeOriginal'], 10)); if ($timestamp !== false) { $metadata['date'] = date('F j, Y H:i', $timestamp); $metadata['date_iso'] = date('c', $timestamp); } } if (!empty($row['FocalLength'])) { $metadata['focal_length'] = rtrim(rtrim(number_format((float) $row['FocalLength'], 1), '0'), '.') . ' mm'; } if (!empty($row['FNumber'])) { $metadata['aperture'] = 'f/' . rtrim(rtrim(number_format((float) $row['FNumber'], 1), '0'), '.'); } if (!empty($row['ExposureTime'])) { $shutter = (float) $row['ExposureTime']; $metadata['shutter'] = ($shutter > 0 && $shutter < 1) ? '1/' . round(1 / $shutter) . 's' : rtrim(rtrim(number_format($shutter, 2), '0'), '.') . 's'; } if (is_numeric($metadata['latitude']) && is_numeric($metadata['longitude'])) { $metadata['latitude'] = round((float) $metadata['latitude'], 7); $metadata['longitude'] = round((float) $metadata['longitude'], 7); $metadata['gps_url'] = 'https://www.google.com/maps/search/?api=1&query=' . rawurlencode($metadata['latitude'] . ',' . $metadata['longitude']); } else { $metadata['latitude'] = null; $metadata['longitude'] = null; } return $metadata; } function getImageMetadata(string $path): array { $metadata = [ 'camera' => null, 'date' => null, 'date_iso' => null, 'iso' => null, 'focal_length' => null, 'aperture' => null, 'shutter' => null, 'width' => null, 'height' => null, 'latitude' => null, 'longitude' => null, 'gps_url' => null, 'filesize' => null, ]; if (is_file($path)) { $metadata['filesize'] = filesize($path) ?: null; } $imageInfo = @getimagesize($path); if ($imageInfo) { $metadata['width'] = $imageInfo[0] ?? null; $metadata['height'] = $imageInfo[1] ?? null; } if (exiftoolAvailable()) { $viaExiftool = getImageMetadataViaExiftool($path); if ($viaExiftool !== null) { return array_merge($metadata, $viaExiftool); } } if (!function_exists('exif_read_data')) { return $metadata; } $exif = @exif_read_data($path, null, true); if (!$exif) { return $metadata; } $make = trim((string) ($exif['IFD0']['Make'] ?? '')); $model = trim((string) ($exif['IFD0']['Model'] ?? '')); if ($make && $model) { $metadata['camera'] = $make . ' ' . $model; } elseif ($model) { $metadata['camera'] = $model; } elseif ($make) { $metadata['camera'] = $make; } $date = $exif['EXIF']['DateTimeOriginal'] ?? $exif['EXIF']['CreateDate'] ?? $exif['IFD0']['DateTime'] ?? null; if ($date) { $timestamp = strtotime((string) $date); if ($timestamp !== false) { $metadata['date'] = date('F j, Y H:i', $timestamp); $metadata['date_iso'] = date('c', $timestamp); } } $metadata['iso'] = $exif['EXIF']['ISOSpeedRatings'] ?? $exif['EXIF']['PhotographicSensitivity'] ?? null; $focalLength = exifNumber($exif['EXIF']['FocalLength'] ?? null); if ($focalLength !== null) { $metadata['focal_length'] = rtrim(rtrim(number_format($focalLength, 1), '0'), '.') . ' mm'; } $aperture = exifNumber($exif['EXIF']['FNumber'] ?? $exif['EXIF']['ApertureValue'] ?? null); if ($aperture !== null) { $metadata['aperture'] = 'f/' . rtrim(rtrim(number_format($aperture, 1), '0'), '.'); } $shutter = exifNumber($exif['EXIF']['ExposureTime'] ?? null); if ($shutter !== null) { $metadata['shutter'] = ($shutter > 0 && $shutter < 1) ? '1/' . round(1 / $shutter) . 's' : rtrim(rtrim(number_format($shutter, 2), '0'), '.') . 's'; } $gps = $exif['GPS'] ?? []; $latitude = formatGpsCoordinate($gps['GPSLatitude'] ?? null, (string) ($gps['GPSLatitudeRef'] ?? '')); $longitude = formatGpsCoordinate($gps['GPSLongitude'] ?? null, (string) ($gps['GPSLongitudeRef'] ?? '')); if ($latitude !== null && $longitude !== null) { $metadata['latitude'] = $latitude; $metadata['longitude'] = $longitude; $metadata['gps_url'] = 'https://www.google.com/maps/search/?api=1&query=' . rawurlencode($latitude . ',' . $longitude); } return $metadata; } function humanizeFilename(string $filename): string { $name = pathinfo($filename, PATHINFO_FILENAME); $name = str_replace(['-', '_'], ' ', $name); $name = preg_replace('/\s+/', ' ', trim($name)); return $name === '' ? 'Photo' : ucfirst($name); } function formatBytes(?int $bytes): ?string { if ($bytes === null) { return null; } $units = ['B', 'KB', 'MB', 'GB']; $i = 0; $value = $bytes; while ($value >= 1024 && $i < count($units) - 1) { $value /= 1024; $i++; } return rtrim(rtrim(number_format($value, 1), '0'), '.') . ' ' . $units[$i]; } // Cleans up cached thumbnails whose source photo no longer exists. // Cache layout is now .thumbs/{maxDim}_{quality}/{album}/{filename} — // same filename as the original, so this just checks each file exists // in its corresponding album folder. function cleanupOrphanedThumbnails(string $photosDir, array $allowedExtensions): void { $thumbsRoot = $photosDir . DIRECTORY_SEPARATOR . '.thumbs'; if (!is_dir($thumbsRoot)) { return; } $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($thumbsRoot, FilesystemIterator::SKIP_DOTS)); foreach ($iterator as $fileInfo) { if (!$fileInfo->isFile()) { continue; } // Path under .thumbs/ is: {maxDim}_{quality}/{album...}/{filename} $relative = substr($fileInfo->getPathname(), strlen($thumbsRoot) + 1); $parts = explode(DIRECTORY_SEPARATOR, $relative); if (count($parts) < 2) { continue; } // malformed/legacy entry array_shift($parts); // drop the {maxDim}_{quality} segment $filename = array_pop($parts); $albumRelDir = implode(DIRECTORY_SEPARATOR, $parts); $albumDir = $albumRelDir === '' ? $photosDir : $photosDir . DIRECTORY_SEPARATOR . $albumRelDir; if (!is_file($albumDir . DIRECTORY_SEPARATOR . $filename)) { @unlink($fileInfo->getPathname()); } } } // Generates (and disk-caches) a resized/compressed JPEG copy of a photo. // Cache path mirrors the original: .thumbs/{maxDim}_{quality}/{album}/{filename} // Fixed size presets — keeps the on-demand generation endpoint from // accepting arbitrary dimensions (which would let anyone force GD work // at any size/quality just by crafting a URL). function thumbnailSizeParams(string $size): ?array { return match ($size) { 'grid' => [300, 65], 'cover' => [400, 70], 'lightbox' => [1600, 80], default => null, }; } // Returns a URL for this photo's thumbnail WITHOUT generating it if it // isn't cached yet. If cached, returns the static file URL directly // (fast — just a filesystem check). If not cached, returns a URL to // the on-demand generation endpoint instead. Combined with the attribute, this means the browser only requests (and // therefore only triggers generation for) images that actually scroll // into view — instead of every photo in the album being generated // synchronously on every page load, which is what made large albums // slow to open. function thumbnailSrc(string $photosUrl, string $photosDir, string $album, string $image, string $size): string { [$maxDim, $quality] = thumbnailSizeParams($size); $albumFsPath = str_replace('/', DIRECTORY_SEPARATOR, $album); $srcPath = $photosDir . DIRECTORY_SEPARATOR . $albumFsPath . DIRECTORY_SEPARATOR . $image; $cacheDir = $photosDir . DIRECTORY_SEPARATOR . '.thumbs' . DIRECTORY_SEPARATOR . $maxDim . '_' . $quality . DIRECTORY_SEPARATOR . $albumFsPath; $cacheFile = $cacheDir . DIRECTORY_SEPARATOR . $image; if (is_file($cacheFile) && filesize($cacheFile) > 0 && filemtime($cacheFile) >= @filemtime($srcPath)) { return albumFileUrl($photosUrl, '.thumbs/' . $maxDim . '_' . $quality . '/' . $album, $image); } return '?album=' . albumQueryValue($album) . '&thumb=' . rawurlencode($image) . '&size=' . $size; } // Generates (and disk-caches) a resized/compressed JPEG copy of a photo. // This always generates immediately — used by the on-demand thumb // endpoint (when the browser actually requests an uncached image) and // by the ajax_metadata endpoint (for the lightbox-size image, generated // the moment a photo is opened). // Cache path mirrors the original: .thumbs/{maxDim}_{quality}/{album}/{filename} // — same filename as the source (not a hash), which keeps URL structure // consistent with the working photos/ path and avoids server/proxy // path-encoding quirks some hosts hit on hashed filenames. function thumbnailUrl(string $photosUrl, string $photosDir, string $album, string $image, int $maxDim, int $quality): string { $albumFsPath = str_replace('/', DIRECTORY_SEPARATOR, $album); $srcPath = $photosDir . DIRECTORY_SEPARATOR . $albumFsPath . DIRECTORY_SEPARATOR . $image; $cacheDir = $photosDir . DIRECTORY_SEPARATOR . '.thumbs' . DIRECTORY_SEPARATOR . $maxDim . '_' . $quality . DIRECTORY_SEPARATOR . $albumFsPath; $originalUrl = albumFileUrl($photosUrl, $album, $image); $cacheFile = $cacheDir . DIRECTORY_SEPARATOR . $image; $cacheUrl = albumFileUrl($photosUrl, '.thumbs/' . $maxDim . '_' . $quality . '/' . $album, $image); if (is_file($cacheFile) && filemtime($cacheFile) >= filemtime($srcPath)) { if (filesize($cacheFile) > 0) { return $cacheUrl; } @unlink($cacheFile); // corrupt/truncated write from a previous request — regenerate below } if (!function_exists('imagecreatetruecolor')) { return $originalUrl; } if (!is_dir($cacheDir)) { @mkdir($cacheDir, 0755, true); } $info = @getimagesize($srcPath); if (!$info) { return $originalUrl; } [$srcWidth, $srcHeight, $type] = $info; $source = match ($type) { IMAGETYPE_JPEG => @imagecreatefromjpeg($srcPath), IMAGETYPE_PNG => @imagecreatefrompng($srcPath), IMAGETYPE_GIF => @imagecreatefromgif($srcPath), IMAGETYPE_WEBP => function_exists('imagecreatefromwebp') ? @imagecreatefromwebp($srcPath) : null, default => null, }; if (!$source) { return $originalUrl; } if (function_exists('exif_read_data') && $type === IMAGETYPE_JPEG) { $exif = @exif_read_data($srcPath); $orientation = $exif['Orientation'] ?? 1; $source = match ($orientation) { 3 => imagerotate($source, 180, 0), 6 => imagerotate($source, -90, 0), 8 => imagerotate($source, 90, 0), default => $source, }; if (in_array($orientation, [6, 8], true)) { [$srcWidth, $srcHeight] = [$srcHeight, $srcWidth]; } } $ratio = min($maxDim / $srcWidth, $maxDim / $srcHeight, 1); $dstWidth = max(1, (int) round($srcWidth * $ratio)); $dstHeight = max(1, (int) round($srcHeight * $ratio)); $dest = imagecreatetruecolor($dstWidth, $dstHeight); imagefill($dest, 0, 0, imagecolorallocate($dest, 17, 24, 39)); // gray-900 bg for transparent PNGs imagecopyresampled($dest, $source, 0, 0, 0, 0, $dstWidth, $dstHeight, $srcWidth, $srcHeight); $wrote = imagejpeg($dest, $cacheFile, $quality); imagedestroy($source); imagedestroy($dest); // Validate the write actually succeeded and produced a real file — // a failed/interrupted write (memory limit, disk full, concurrent // request) should fall back to serving the original, not a broken // or empty cached file. if (!$wrote || !is_file($cacheFile) || filesize($cacheFile) === 0) { @unlink($cacheFile); return $originalUrl; } return $cacheUrl; } function albumQueryValue(string $albumPath): string { return implode('%2F', array_map('rawurlencode', explode('/', $albumPath))); } function albumFileUrl(string $photosUrl, string $albumPath, string $file = ''): string { $url = $photosUrl . '/' . implode('/', array_map('rawurlencode', explode('/', $albumPath))); return $file !== '' ? $url . '/' . rawurlencode($file) : $url; } function absoluteUrl(string $siteUrl, string $relative): ?string { $base = rtrim($siteUrl, '/'); if ($base === '') { return null; } return $base . '/' . ltrim($relative, '/'); } $album = $_GET['album'] ?? null; if ($album !== null) { $album = normalizeAlbumPath((string) $album); if ($album === null) { http_response_code(404); die('Album not found.'); } $albumPath = $photosDir . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, $album); if (!is_dir($albumPath)) { http_response_code(404); die('Album not found.'); } $images = imageFiles($albumPath, $allowedExtensions); $subAlbumList = albums($photosDir, str_replace('/', DIRECTORY_SEPARATOR, $album)); $breadcrumbs = []; $accumulated = []; foreach (explode('/', $album) as $segment) { $accumulated[] = $segment; $breadcrumbs[] = ['label' => $segment, 'path' => implode('/', $accumulated)]; } if (isset($_GET['download'])) { $requestedFile = basename((string) $_GET['download']); if (!in_array($requestedFile, $images, true)) { http_response_code(404); die('File not found.'); } $filePath = $albumPath . DIRECTORY_SEPARATOR . $requestedFile; header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="' . $requestedFile . '"'); header('Content-Length: ' . filesize($filePath)); header('X-Robots-Tag: noindex'); header('Cache-Control: no-store, no-cache, must-revalidate'); readfile($filePath); exit; } // On-demand thumbnail generation: ?album=X&thumb=filename&size=grid|cover|lightbox // Only hit when a browser actually requests an image whose thumbnail // isn't cached yet (see thumbnailSrc()) — combined with , this means only visible/scrolled-to photos ever // trigger GD work, instead of the whole album generating up front. // Generates the thumbnail then redirects to the resulting static // file, so the browser caches the real file normally afterward. if (isset($_GET['thumb'], $_GET['size'])) { $requestedFile = basename((string) $_GET['thumb']); $sizeParams = thumbnailSizeParams((string) $_GET['size']); header('Cache-Control: no-store, no-cache, must-revalidate'); if (!$sizeParams || !in_array($requestedFile, $images, true)) { http_response_code(404); exit; } [$maxDim, $quality] = $sizeParams; $generatedUrl = thumbnailUrl($photosUrl, $photosDir, $album, $requestedFile, $maxDim, $quality); header('Location: /' . ltrim($generatedUrl, '/')); http_response_code(302); exit; } // AJAX metadata endpoint: called only for the photo actually opened // in the lightbox. Also generates (and returns) the larger lightbox // thumbnail lazily here, instead of pre-generating it for every photo // in the album up front — this is what makes big albums load fast. if (isset($_GET['ajax_metadata'])) { $requestedFile = basename((string) $_GET['ajax_metadata']); header('Content-Type: application/json'); header('Cache-Control: no-store, no-cache, must-revalidate'); if (!in_array($requestedFile, $images, true)) { http_response_code(404); echo json_encode(['error' => 'Not found']); exit; } $metadata = getImageMetadata($albumPath . DIRECTORY_SEPARATOR . $requestedFile); $metadata['filesize'] = formatBytes($metadata['filesize'] ?? null); $metadata['lightbox_url'] = thumbnailUrl($photosUrl, $photosDir, $album, $requestedFile, 1600, 80); echo json_encode($metadata); exit; } $perPage = max(1, (int) $config['photos_per_page']); $totalImages = count($images); $totalPages = max(1, (int) ceil($totalImages / $perPage)); $page = max(1, min($totalPages, (int) ($_GET['page'] ?? 1))); $pagedImages = array_values(array_slice($images, ($page - 1) * $perPage, $perPage)); } else { $albumList = albums($photosDir); if (mt_rand(1, 50) === 1) { cleanupOrphanedThumbnails($photosDir, $allowedExtensions); } } $imageCount = $album ? count($images) : 0; $pageTitle = $album ? e($album) . ' - Gallery' : 'Gallery'; $pageDescription = $album ? 'Browse ' . $imageCount . ' photo' . ($imageCount === 1 ? '' : 's') . ' in the ' . $album . ' album.' : 'A photo gallery.'; $canonicalUrl = absoluteUrl($config['site_url'], $album ? '?album=' . albumQueryValue($album) : ''); $ogImageUrl = null; if ($album && !empty($images[0])) { $ogImageUrl = absoluteUrl($config['site_url'], albumFileUrl($photosUrl, $album, $images[0])); } ?> <?= $pageTitle ?>

Gallery

album

📷

No albums yet

Create a folder inside photos/ and put some images in it.

<?= e(humanizeFilename($cover) . ' - ' . $albumName . ' album cover') ?>
📁

photo
← Back to

photo · sub-album

<?= e(humanizeFilename($subCover) . ' - ' . $subName . ' album cover') ?>
📁

photo
📷

No images

$image): ?> below gets data-src (not src) so nothing is // actually requested yet — see revealGridThumbs() in the // script below, which decides whether to reveal these // immediately or defer until the lightbox closes (deep // link case). The larger lightbox version is generated // on demand via ajax_metadata when a photo is opened. $gridThumbUrl = thumbnailSrc($photosUrl, $photosDir, $album, $image, 'grid'); $altText = humanizeFilename($image) . ' - ' . $album; ?>
1): ?>