Protect download files

[fgarciarico]

I´m developping an application that needs to show some videos, but in
a protected envinroment. Any user must be authenticated to see the
videos. But for example, if anyone know the path of the videos, can
access directly to this site and download it without authentication.

If I write in the location bar the url of a video, I can download
without problem because the application cannot test if the user is
already authenticated or not. I´ve read something about RedirectMatch
and it works well but now the users cannot see the videos.

I try to write an example:

..- #I write this rule in the httpd.conf
RedirectMatch (.*)\.avi$
/myapplication/tools/downloadfile.php?filename=$1

With this rule I redirect all the requests for the video files include
the request of a window media player, but I don´t want to do this.
When I show the video directly on the web, I don´t need to redirect
but when is a direct request from url to download the file, I must
check if the user is authenticated.

I hope that you can understand my bad english.

Fran García

[JDS]

On Fri, 22 Jul 2005 05:11:04 -0700, fgarciarico wrote:

If I write in the location bar the url of a video, I can download
without problem because the application cannot test if the user is
already authenticated or not. I´ve read something about RedirectMatch
and it works well but now the users cannot see the videos.

Do one of the following:

1) Use Basic Auth in the .htaccess file
Example: http://httpd.apache.org/docs/1.3/howto/auth.html

2) Use Basic Auth within PHP
http://us2.php.net/features.http-auth

I recommend number (1). Of course, the trouble with that is that it is
outside any application logic.

You could try putting any .avi (or other protected files) outside the http
virtual directory path and then create a PHP shell app that just gets and
downloads the file for you. (I know you said you are trying something
like this). To do this you will need to use

header("Content-type: blah/blah");

where blah/blah is the correct content type

The important thing here is to put the .avi files (any protected files)
OUTSIDE the http virtual directory path! So that one cannot just type in
a URL and get the file.
--
JDS | je*****@example.invalid
| http://www.newtnotes.com
DJMBS | http://newtnotes.com/doctor-jeff-master-brainsurgeon/

[chotiwallah]

JDS wrote:

On Fri, 22 Jul 2005 05:11:04 -0700, fgarciarico wrote:

If I write in the location bar the url of a video, I can download
without problem because the application cannot test if the user is
already authenticated or not. I´ve read something about RedirectMatch
and it works well but now the users cannot see the videos.

Do one of the following:

1) Use Basic Auth in the .htaccess file
Example: http://httpd.apache.org/docs/1.3/howto/auth.html

2) Use Basic Auth within PHP
http://us2.php.net/features.http-auth

I recommend number (1). Of course, the trouble with that is that it is
outside any application logic.

You could try putting any .avi (or other protected files) outside the http
virtual directory path and then create a PHP shell app that just gets and
downloads the file for you. (I know you said you are trying something
like this). To do this you will need to use

header("Content-type: blah/blah");

where blah/blah is the correct content type

The important thing here is to put the .avi files (any protected files)
OUTSIDE the http virtual directory path! So that one cannot just type in
a URL and get the file.
--
JDS | je*****@example.invalid
| http://www.newtnotes.com
DJMBS | http://newtnotes.com/doctor-jeff-master-brainsurgeon/

put a .htaccess in your video dir containing the line:

deny from all

this will prevent any browser access in that dir

now deliver the videos to your users with a php script that

1. checks the credentials and
2. if ok, delivers the video via the servers filesystem, using i.e.
readfile (which is not affected by .htaccess)

micha

[chotiwallah]

deliver_video.php has to be outside the video dir of course

micha

[Jerry Stuckle]

chotiwallah wrote:

JDS wrote:

On Fri, 22 Jul 2005 05:11:04 -0700, fgarciarico wrote:

If I write in the location bar the url of a video, I can download
without problem because the application cannot test if the user is
already authenticated or not. I´ve read something about RedirectMatch
and it works well but now the users cannot see the videos.

Do one of the following:

1) Use Basic Auth in the .htaccess file
Example: http://httpd.apache.org/docs/1.3/howto/auth.html

2) Use Basic Auth within PHP
http://us2.php.net/features.http-auth

I recommend number (1). Of course, the trouble with that is that it is
outside any application logic.

You could try putting any .avi (or other protected files) outside the http
virtual directory path and then create a PHP shell app that just gets and
downloads the file for you. (I know you said you are trying something
like this). To do this you will need to use

header("Content-type: blah/blah");

where blah/blah is the correct content type

The important thing here is to put the .avi files (any protected files)
OUTSIDE the http virtual directory path! So that one cannot just type in
a URL and get the file.
--
JDS | je*****@example.invalid
| http://www.newtnotes.com
DJMBS | http://newtnotes.com/doctor-jeff-master-brainsurgeon/

put a .htaccess in your video dir containing the line:

deny from all

this will prevent any browser access in that dir

now deliver the videos to your users with a php script that

1. checks the credentials and
2. if ok, delivers the video via the servers filesystem, using i.e.
readfile (which is not affected by .htaccess)

micha

Or, better yet, put them below the document_root. That way you're not depending
on the .htaccess.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[fgarciarico]

I´ve thought something like that but I must show the video files into
a media player object in my web pages and I think that if the video
file isn´t on a valid url, I cannot show it. Or?

[JDS]

On Tue, 26 Jul 2005 00:30:44 -0700, fgarciarico wrote:

I´ve thought something like that but I must show the video files into
a media player object in my web pages and I think that if the video
file isn´t on a valid url, I cannot show it. Or?

You can use a PHP file as the video file. Just send the proper header.
For example, I can use a PHP script as a JPEG or GIF image if I send the
proper header:

header("Content-type: image/jpeg");

AND if the content following is an actual JPEG image.

For example, say I have an image, "image.jpg". I can read it into the PHP
script using one of the binary-safe file reading functions in PHP:

(I think this example will work)

getimage.php:

<?
/* ...Include authentication and security stuff here...*/

$file = "image.jpg";
$file_contents = file_get_contents($file);
header("Content-type: image/jpeg");
print $file_contents;
exit;
?>

Now include getimage.php in your HTML page:

<p>
<img src="getimage.php">
</p>
You should be able to do the same with a video file. Using the video
file's MIME type, of course, in the header.

later...

--
JDS | je*****@example.invalid
| http://www.newtnotes.com
DJMBS | http://newtnotes.com/doctor-jeff-master-brainsurgeon/