Protection videos with session

Nexweb

Hey Guys, here is the problem: I have a website that used to have basic authentification and I changed it to session auth. Everything is working fine execpt for one thing, videos. I have many videos (movies) on the site that needs to be protected with session, and I don't know how to do so.

Right now, what I am trying to put a file as prepend in the video folder that verifies the session, just like the site, but a prepend file won't be executed on .wmv or .mpeg file, so I need to change with mode rewrite the file .wmv and mpeg to .php. Now, my prepend file gets executed before the videos play, but when the video play, I get parse errors... I now added the following headers in the prepend file:

header("Content-Type: application/octet-stream");
header("Content-Transfer-Encoding: binary");

but still no luck, any ideas ? If some stuff is unclear, please let me know. Thanks

swr

Instead of trying to get PHP to process a video, have a PHP script that does the authentication, sets the headers, and sends the file. The video files themselves should probably be in a non-web-accessible directory (maybe a directory protected by .htaccess set to deny all).

Something like this (completely untested):

// <- insert user authentication here
$video = $_GET['videofile'];
preg_match($video, '/^[\w\-\.]+$/') or  die("Illegal video filename.");
$file = fopen("/path/to/videos/$video") or die("Could not open video file.");
header("Content-Type: video/mpeg");
fpassthru($file);
fclose($file);

swr

Oops... there's supposed to be a backslash before the w in the regular expression, but this board software seems to like to eat backslashes.

Nexweb

Thanks swr, for you anwser. But I already had something like that working, the major isssue is that my boss wants the link toward the video to point directly at a .wmv file or mpeg, but not a .php file. I tried to convince them otherwise, but without success. I really need to keep the link directly toward the video, that's the reason why I use a prepend file.

Nexweb

I finally found the solution... just for the record, here it is:

	$file_path = $_SERVER['PHP_SELF'];
	//GET THE FILENAME AND EXTENSION
	$exploded_info = split('/',$file_path);
	$file_name = $exploded_info[count($exploded_info)-1];
	$file_extension = strstr($file_name,'.');

$filesize = filesize($file_name);

//SENDING THE CORRECT HEADERS
header("Cache-Control: no-store, no-cache, must-revalidate");  
header("Cache-Control: post-check=0, pre-check=0", false);
if ($_SERVER['HTTPS'] == "on")
   header("Pragma: public");
else
   header("Pragma: no-cache");

header("Cache-Control: private");

//FIND THE CORRECT HEADER FOR THE EXTENSION
switch($file_extension){
	case ".wmv":
		$content = "video/x-ms-wmv";
		$disposition = "inline";
		break;
	case ".mpg":
		$content = "video/mpeg";
		$disposition = "inline";
		break;
   case "jpg": 
        $content="image/jpeg";
        $disposition="inline";  
		break;
   case "gif": 
        $content="image/gif";
        $disposition="inline";        
        break;
}

header('Content-Type: $content');
header("Content-length: $filesize");
header('Content-Disposition: $disposition');

// READ THE FILE
readfile($file_name);

Nexweb

All that is missing is to had the session protection