Restricting Videos

Bigred23

I would like to restrict videos files to members who are logged in using php.

This is my scenario:
A person logs in, and it redirects them to [url]http://mysite.com/view.php[/url] . Now on that page I want them to be able to see a video which is in a sub-directory called "videoclips". I would like only people who are logged in (using php) to see this video and prevent anyone from directly linking/downlading it. Such as going straight to [url]http://mysite.com/videoclips/clipname.mpg[/url] . I searched up on it and the closest that came to my problem was using a .htaccess file method. Which in case you would put a .htaccess file in the videoclips directory with the following code:

Order allow,deny
Deny from all
<Files "view.php">
Order Deny,Allow
Allow from All
</Files>

My problem is that that code doesn't work. Any help on this problem would be greatly appreciated, thanks in advance.

Kudose

The easiet method would be to store the files outside of the DocumentRoot, make view.php accessible to members only using sessions, then have view.php force the download (via link or other methods).

Bigred23

I do have that, the only problem is, the .htaccess won't even allow the "view.php" file to download it.

EDIT*
I'm having the same problem this person orginally had, only his solution didn't work.
http://www.phpbuilder.com/board/showthread.php?t=10328810

Kudose

With the method I described above, you do not need to utilize .htaccess.

Bigred23

Can you explain "store the files outside of the DocumentRoot" to me. Even if I did this, wouldn't the public be able able to direct link to a video still (If I understand what you meant by DocumentRoot)?

Kudose

No. You cannot access files outside of the DocumentRoot (web root) via URL.

i.e. Usually the DocumentRoot is /www/htdocs/username/htdocs/ (i.e. index.php)

You need to put your files in /www/htdocs/username/videos

audiomove

use sessions as Kudose describes. If a client trys to view the page have your code search for a session id, if none found redirect to login page or some access denied page.

Bigred23

It seems I am able to make new document roots, but everytime I link to the videos with /hsphere/whatever/user/videos it automatially changes the link to http://mysite.com/hsphere/whatever/user/videos

Any tips?

Kudose

When you FTP into your site, what do you see?

Something like this:

public_html
public_ftp
www

If so, just make another directory here and place your files in there. This location is outsite the DocumentRoot (which in this case is public_html with www linking to public_html).

Otherwise, post back.

Bigred23

I have these following folders:

.htmaster (which i belive is where the valid users for .htaccess are stored)

mysite.com (which everything inside that folder is public)

mysite-videos (which I made, and seems to not be accessible by the public, also where my videos are stored)

mysite2.com (also public, but for a different website)

Using the include function in a php script in the "mysite.com" folder seems to work to display webfiles (.php, .html, etc.) inside the mysite-videos. However, I cannot use the include function because you use the src for images or videos it always relates back to the "mysite.com" folder.

Weedpacket

No, the src for images or videos relates to the view.php script that Kudose mentioned. view.php can then retrieve the requested content from mysite-videos and pass it back as its response (after checking that the response came from a logged-in member, of course).

Bigred23

Alright fianlly! I got it, thanks guys. Now I have another question...

I am able to force download it, but is there any way that I can "force download" it and then make it show right there in the web-browser (I guess something like you-tube)?

Also, the force download through headers only works with Mozilla, not IE? I have been looking this up, but seems that IE is just buggy? Any suggestions?

Again, thank you very much.