[RESOLVED] File Download from a seperate server and record users download to db issue

dmacman1962

Hi All,

On our main site I need to create a link to allow logged in users either download or view in their browser, a video file hosted on our .tv site, but I keep running into roadblocks.

Two things to keep in mind.
1) the links and database are on our main site.
2) the file itself it hosted on our .tv site.

I tried to use a 'in between' page to write our the Id,datetime, and what file the are downloading/viewing, but here is where I run into issues.

1) The file on our .tv site is a .mov file in and I can just direct them to it and it will open in the browser, but I cannot stop someone from downloading the file directly and bypassing my if/else code to check if they are logged in.

2) I tried to use an in between page to store their data and send them to a page on our main site with a link to download or to open the file remotely within that page, but the server is set with remote file download off, and I do not know if I want to enable that just for this purpose.

So what I would like to do is:

(main site)
A page with the link to download/view the movie, but redirect them to login if they have not done so. (I got this accomplished).

Then, if they are logged in, give them the link to download the file (and hide the location, on our other server if possible), and record their actions. Or let them view the file in the browser, from our other server and hide the link, and record their action.

I hope I am not complicating this and I am clear enough.

As always, thanks in advance.
Don

Exangelus

For the downloading

//send file to user without him knowing him the location
//the required headers
$filename = SECRET_DIR . $_GET['file']; // the file
header("Pragma: public"); // required
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: private",false); // required for certain browsers 
header("Content-Type: text/plain;"); //the mimetype
// change, added quotes to allow spaces in filenames, by Rajkumar Singh
header("Content-Disposition: attachment; filename=\"".$filename."";");
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".filesize($filename));
readfile($filename);

Put all movies in a dir with a long strange name(a-z A-Z 0-9 30 chars or so) this is SECRET_DIR

Now make this a file named download.php and let the name of the movie be given to it using a get var.
To make it safe, when somebody clicks on a movie to download(in a list or something I suppose) he calls a other file say 'handler.php' first. This file is able to see if the user is logged in and knows which file the user wants to download. This file makes a new record in the db stating user x wants to download file y. Than it requires or redirects the user to download.php?file=x
Download.php checks in the database too see if user y has requested to download file x and if so tells the db the request has been accepted( to make sure it cant be used again ) and then outputs the headers and starts the download.

This way. A user cannot just download any file by calling download.php?file=
when they know the filename because they didn't visit handler.php which knows if they're allowed to and if so would give them a downloadcredit.

bradgrafelman

Exangelus;10943952 wrote:
Put all movies in a dir with a long strange name(a-z A-Z 0-9 30 chars or so) this is SECRET_DIR

Sounds like security through obscurity - never a good technique. Better would be to simply deny direct access to the folder via a .htaccess file, or storing the files outside the root of the site.

dmacman1962

I think I might be giving the wrong impression here. These movies are educational movies for teachers, and we want to use this as a test to see if they will lean towards downloading or viewing them vs. us shipping them the actual free DVD, and save shipping costs.

They are not copy protected or of a 'secret' nature, just educational videos we currently supply teachers.

I need to get them statistics on % of them that download or view the clips, so I am trying to log their ID and date-time stamp whether they download it or view it.

The reason it is not on our main site, is the 2nd site is our .tv site and has more bandwidth available and at a lesser cost to us.

We currently have previews of our videos on our site, and we use Flash to display them. We either us an iframe, or video embedded from another URL will work, I did not want to have to this route if something simpler would work.

I am trying to avoid the .htaccess route since it would force them to use a name/password (and they are already logged into the site), and if they email other teachers the link and username/pw, they will be able to download the videos without logging in first, and therefore, skew my statistics testing.

Please let me know if I am making it clear enough, and if there is a simpler way, or if I will have to use the Flash method for this.

Regards,
Don

Exangelus

bradgrafelman;10943985 wrote:
Sounds like security through obscurity - never a good technique. Better would be to simply deny direct access to the folder via a .htaccess file, or storing the files outside the root of the site.

Your right, never even considered using either .htaccess or to put it outside of the root.
Concerning .htaccess, is there any good documentation about all the functions you can use it for? Apart of mod rewrite and allowing html files to use php I can bearily find information (altough I probably didn't know where to look 😉)

bradgrafelman

Exangelus;10944064 wrote:
Concerning .htaccess, is there any good documentation about all the functions you can use it for?

Yes.

dmacman1962 wrote:
I am trying to avoid the .htaccess route since it would force them to use a name/password (and they are already logged into the site), and if they email other teachers the link and username/pw, they will be able to download the videos without logging in first, and therefore, skew my statistics testing.

No, I'm not saying use .htaccess to enable HTTP authentication. I'm saying use .htaccess to disable all direct access to the raw files themselves.

That way, the only way you could access/download the files in question would be via a PHP script you setup that can log who downloads what.

Exangelus

bradgrafelman;10944080 wrote:
Yes.

Knew it had to be simple :o thanks!

dmacman1962

Thanks,

I will work on with the suggestion of having the files outside of the root.

Don