help protecting files

perpetualwombat

Hello I am setting up a non commercial site to raise awareness about local music and I'm streaming audio and I'd like the files to be protected. What I have so far is a .htaccess file that restricts users from getting to the directory of the mp3s as well as the following code to hide the file path. I did not realize however that simply navigating to the file path http://www.mywebsite.org/songref.php?fileID=1 would grant access to the file. I thought that it would prevent access to the file. Is there a way I can prevent access to the fileID address?

Here's my code. Thanks in advance for the help.

$file_id = $_GET["fileID"];

$audio=array(
'1' => 'song01.mp3',
'2' => 'song02.mp3',
'3' => 'song03.mp3',
'4' => 'song01.mp3',
'5' => 'song02.mp3'

);



$file = $_SERVER['DOCUMENT_ROOT'] . "/af09_11/$audio[$file_id]";


if (file_exists($file)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename='.basename($file));
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    header('Pragma: public');
    header('Content-Length: ' . filesize($file));
    ob_clean();
    flush();
    readfile($file);
    exit;
}

bradgrafelman

How do you authenticate users who are allowed to retrieve the file? That is, how is the above PHP script supposed to know whether or not it should serve up the request file?

perpetualwombat

I am playing the audio files using soundmanager2 similar to this http://www.schillmania.com/projects/soundmanager2/demo/play-mp3-links/
It's a playlist so the files are in a list and play one after another.
Playlist is like this:

<ul class="playlist">
<li>
<a type="audio/mpeg" href="/songref.php?fileID=1"></a>
</li>
<li>
<a type="audio/mpeg" href="/songref.php?fileID=2"></a>
</li>
</ul>

Is it possible for the site to read and play the audio files without users being able to access the files by typing http://site.com/songref.php?fileID=1
Currently they cannot access the files by means of their true path /mp3/song01.mp3 because of an .htaccess file. But you can stil right click and save as or as I said, just type in the address with the songref.php

johanafm

perpetualwombat;10987723 wrote:
Is it possible for the site to read and play the audio files without users being able to access the files by typing http://site.com/songref.php?fileID=1

Yes, stop serving files like you are now. On the first request, use session_start, check if $SESSION['fileID'] is set, if not assign 1 to $SESSION['fileID'] else increment it by 1. Then play the song indicated by this variable. Provide users with a "next song" link, until they reach the last song. Then provide them with a "first song" link.

perpetualwombat;10987723 wrote:
can stil right click and save as

You should also be aware that wether they can rclick and save as or not, everything that passes through the user's soundcard to become sound can just as easily (well... almost) be sent to disk as sent to sound output.

I'm not just talking about the web, I'm talking about any program that plays sound, music, whatever. It is just a stream of data after all, so unless the sound data format is not known (and not yet reverse engineered), you can also play the same sound directly from your disk afterwards.

It may however not be legal to do this, due to licensing agreements (such as with Spotify).