Access From Script Only

PHP
1

I have a flash script which reads in the url of a music file i have in a directory and plays it.

I currently have a redirect file to somewhat cloak the file.

For example,

mp3 file located at :

domain.com/songs/ha.mp3

i link to

domain.com/song.php?id=FDF2342FD

Which redirects to ha.mp3 based on what my mysql db holds.

The problem is, when they type in domain.com/song.php?id=FDF2343FD , they are redirected to the actual mp3 file.

Is there a way to keep them from knowing the mp3 file name? Or prevent them from downloading it?

If not, is there a way to prevent the redirection on song.php if it is not called from the script? (although this is a PHP issue)

Thanks,
Oleg

2

Rather than redirect, you could have the file “read” or “get contents” of the song if certain criteria were met (eg. valid session).

As for downloading, you can stop hot-linking and direct linking, but for someone to listen to it on their computer it has to be downloaded. And if they know how, they can save it.

3

So you can download all the songs on myspace?

e.g. http://www.myspace.com/chapter11 - could you download all those music files?

I’ve been thinking a lot on how to do this and I think verification through sessions is the best way, but i’ve never used them before and the manual is aweful.

So far, I start a session on songs.php which has 5 songs (5 instances of flash mp3 players) and create a $_SESSION[‘key’] = “keywordonlyiknow”

I want the play.php?file=encryptedfilename file to see if the session is created and then play the file, otherwise, it shouldn’t do anything.

That way, if someone just enters play.php?file=encryptedfilename, it shouldn’t get the file since the session wasn’t created on songs.php

Is this possible?

4

question remains. no progress =/

5

Sorry, I meant to get back sooner, but got distracted.

What I meant by downloading songs, was not by requesting them directly, but by going about it the “right” way. Once it’s on someone’s computer for them to listen to, they can save it if they know how (i.e. in the browser’s cache).

If you put the song files outside of the site’s root folder, they can’t be had by HTTP requests. They can only be accessed by a file under the root that “gets” the files. If you have the page that links to that file set a session variable and check to make sure it’s set and valid then AFAIK the only way someone can download a song file is through your page that sets the session variable.