Its javascript, sorry for the error, although I thought referring to javascript as java was OK. They both require the same runtime, don't they? I keep it turned off with "noscript" in firefox and try not to use any java anything on my websites because it taxes the client computer more than I want to, so I'm a little ignorant about it. I use it sparingly at best, and then only if its intergrated with something I install.
And I localized the .htaccess to the directory he is hitting. I'm not trying to exclude people that legitimately don't send referrers because they are paranoid and use a proxy or whatever, but I fucking hate a thief.
Here is the code he is using. I hope it escapes (// ) OK and doesnt fuck up my post.
// <!--
// var D=document
// var IframeName=Math.round(Math.random()*1000000)
// var baseHeader='http://www.mydomain.com'
// var basePath='/path to my images/'
// var galUrls=new Array("list of my image's names")
// var curNum=0
// var tmp
// function loadPhoto(num) {
// if (num) {
// tmp=D.RECLAMA1 ||
// D.getElementById('RECLAMA1').contentWindow
// tmp.history.go(0)
// tmp=D.RECLAMA2 ||
// D.getElementById('RECLAMA2').contentWindow
// tmp.history.go(0)
// }
// curNum=(curNum+num)%galUrls.length
// var url=galUrls[curNum]
// url=baseHeader+((url.charAt(0)=='/') ? '' : basePath)+url
// tmp=D.PHOTO || D.getElementById('PHOTO').contentWindow
// tmp.name=IframeName
// open("javascript
:\"<img style='cursor:hand'
// onClick='parent.loadPhoto(1)' src='"+url+"'>\"",IframeName)
// D.forms[0].CURRENT.value=curNum+1
// D.all['CURRENT'].innerHTML=curNum+1
// D.getElementById('PREV').style.visibility=(curNum>0) ? 'visible' : 'hidden'
// D.getElementById('NEXT').style.visibility=((curNum+1)<url.length) ? 'visible' : 'hidden'
// return false
// }
// function fitPhoto() {
// tmp=D.PHOTO || D.getElementById('PHOTO').contentWindow
// var im=tmp.document.images[0]
// tmp.resizeTo(im.width+4,im.height+4)
// }
//-->