Fancybox stopped working properly on Chrome and only when user not logged in

Hi

Easy Fancybox had been working great. Recently though I’ve been trying to develop a way to mask image urls and I thought I had it cracked but now I’ve come across a problem on Chrome.

You can see an example at http://www.jatest.dreamhosters.com/test-page/

On this page I have two examples of the same image. One fires up fancybox in the standard way, while the other uses the new hidden url approach.

It works 100% on Firefox and IE, but when I try it on Chrome it doens’t work when the user is not logged in. It works fine when a user is logged in (doesn’t seem to matter what kind of user).

Here’s how I’m doing the hidden url approach. (This is a sort of cut-down version to keep it simple, but this is exactly how it’s implemented on the test page example I’ve given.)

On the “test-page” I have the following code (with a session_start() further up the page)

<?php
				
$img_src = 'http://www.jatest.dreamhosters.com/wp-content/uploads/Choir-practice.jpg';
				
//deletes all session variables related to fancybox hidden urls
//only used to keep the number of session variables down
foreach ($_SESSION as $key => $session_variable) {
	$locator = strpos( $key, 'rfhash' );
	if ( $locator > 0 ) { //if this session variable was created for fancybox hidden url (because it contains _rfhash)
		unset($_SESSION[$key]);
	}
}
				
//create new session variable
$imageHash = '_rfhash'.md5(uniqid());
$_SESSION[$imageHash] = $img_src;
				
$hidden_img_src = add_query_arg('h', $imageHash, 'http://'.$_SERVER['HTTP_HOST'].'/get-image/');
				
?>
				
Unhidden url<br />
<a class = "fancybox" href = "<?php echo $img_src; ?>">
	<img src="<?php echo $img_src; ?>" width = "700" height = "525">
</a>
<br />
Hidden url<br />
<a class = "fancybox {type: 'image'}" href = "<?php echo $hidden_img_src; ?>">
	<img src="<?php echo $hidden_img_src; ?>" width = "700" height = "525">
</a>

Then on the get-image page that the “masked” url points to, I have:

session_start();
if (isset($_GET['h'])) {
	$hash = $_GET['h'];
 
	if (isset($_SESSION[$hash]) && $_SESSION[$hash]) {
		echo file_get_contents($_SESSION[$hash]);
		unset($_SESSION[$hash]);
	}
}

I’ve run out of ideas in trying to work out what’s going wrong. I’ve compared the source code (logged in vs logged out) and I can’t see any difference except for what I would expect to see (e.g., Logout link instead of login link, plus navigation items in the menu that are only visible to logged in users).

I’d be really grateful for any help you can give!

Thanks
Jon