Prevent direct access to wordpress videos (Prevent direct access files)

Question

I own a wordpress-based Learning application, and I have several video lessons in the directory public_html/wp-content/uploads/...

I would like to prevent direct access to these videos, since it is necessary to purchase the course to be able to attend them.

In studying the question I came across the following propositions of solution to this problem:

Solution 1: Block requests coming from the WEB, using a file .htaccess, to my video files (.mp4) and serve them to the client with PHP, through the function readfile(). This way I could check if the user can access the file before serving it. This solution is functional, but I did not like it, because I believe that the server’s resource consumption will be very high, since PHP will be reading/processing the files.

In this case I would add a file .htaccess in wp-content/uploads/ with the following Directives:

     Rewriterule \.mp4$ dl-file.php [L]

And would use a script (dl-file.php) analogous to this to serve the video file :

 /*
 * dl-file.php
 *
 * Protect uploaded files with login.
 *
 * @link http://wordpress.stackexchange.com/questions/37144/protect-wordpress-uploads-if-user-is-not-logged-in
 *
 * @author hakre <http://hakre.wordpress.com/>
 * @license GPL-3.0+
 * @registry SPDX
 */

require_once('wp-load.php');

is_user_logged_in() ||  auth_redirect();

list($basedir) = array_values(array_intersect_key(wp_upload_dir(), array('basedir' => 1)))+array(NULL);

$file =  rtrim($basedir,'/').'/'.str_replace('..', '', isset($_GET[ 'file' ])?$_GET[ 'file' ]:'');
if (!$basedir || !is_file($file)) {
    status_header(404);
    die('404 &#8212; File not found.');
}

$mime = wp_check_filetype($file);
if( false === $mime[ 'type' ] && function_exists( 'mime_content_type' ) )
    $mime[ 'type' ] = mime_content_type( $file );

if( $mime[ 'type' ] )
    $mimetype = $mime[ 'type' ];
else
    $mimetype = 'image/' . substr( $file, strrpos( $file, '.' ) + 1 );

header( 'Content-Type: ' . $mimetype ); // always send this
if ( false === strpos( $_SERVER['SERVER_SOFTWARE'], 'Microsoft-IIS' ) )
    header( 'Content-Length: ' . filesize( $file ) );

$last_modified = gmdate( 'D, d M Y H:i:s', filemtime( $file ) );
$etag = '"' . md5( $last_modified ) . '"';
header( "Last-Modified: $last_modified GMT" );
header( 'ETag: ' . $etag );
header( 'Expires: ' . gmdate( 'D, d M Y H:i:s', time() + 100000000 ) . ' GMT' );

// Support for Conditional GET
$client_etag = isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) ? stripslashes( $_SERVER['HTTP_IF_NONE_MATCH'] ) : false;

if( ! isset( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) )
    $_SERVER['HTTP_IF_MODIFIED_SINCE'] = false;

$client_last_modified = trim( $_SERVER['HTTP_IF_MODIFIED_SINCE'] );
// If string is empty, return 0. If not, attempt to parse into a timestamp
$client_modified_timestamp = $client_last_modified ? strtotime( $client_last_modified ) : 0;

// Make a timestamp for our most recent modification...
$modified_timestamp = strtotime($last_modified);

if ( ( $client_last_modified && $client_etag )
    ? ( ( $client_modified_timestamp >= $modified_timestamp) && ( $client_etag == $etag ) )
    : ( ( $client_modified_timestamp >= $modified_timestamp) || ( $client_etag == $etag ) )
    ) {
    status_header( 304 );
    exit;
}

// If we made it this far, just serve the file
readfile( $file );

In this case the video files would not be outside of public_html, since I would still need to assess the consequences of this, for my Wordpress application, and still the impacts under some utilities I use, based on the internal API of the WP-CLI.

Solution 2: Using an apache module called mod_xsendfile to serve the file, after checking, with PHP, whether or not the user can get access to that video. mod_xsendfile is an unofficial module, from a third party, and the latest update dates from 2012. Because of these factors, added to the fact that the project does not have an active community, I chose not to use this solution.

Solution 3: Prevent direct access through a file .htacess performing header checking %{HTTP_REFERER}. This is not a reliable way, since I must allow, for usability reasons, access when %{HTTP_REFERER} is also empty, that is, just a customer modify %{HTTP_REFERER} to have access to video lessons (.mp4) private. If the value of %{HTTP_REFERER} is reliable, 100% of the time, this would be a good solution, because the delivery of the video file would be conditioned to my application, which decides whether or not the user should access the class.

Solution 4: Using a plugin called Prevent Direct Access To deliver the file to the user the plugin uses a script very similar to the one displayed on solution 1, which also made it unviable, plus the cost of the license is high. But in general it is a good solution when the files to be made available are not very large.

Solution 5: Finally I imagined a possible solution to my problem, but I still lack the necessary knowledge to verify its applicability, follows:

Whenever a user performs a direct request to a video file I perform a flag check through a file .htaccess. As for this flag I’m still not sure what it might be, a parameter get, or an apache environment variable, or a header.

If this flag has a given value I send the file, or if it has another value, other than necessary for the file to be sent, it is not sent to the user. Finally if this flag does not exist, at the time of checking, I rewrite the URL with a directive RewriteRule which will point to a PHP script.

This script checks whether or not the user can access the video file (checks if it is logged in and if it has purchased the course, basically) and then arrow the respective flag, and make a new request to the video file, which will cause the .htaccess previously run again, but now the flag exists as it was set in the script. Thus the file .htaccess will find the flag set, and depending on the value decides whether or not to deliver the requested file to the user. After sending the reply the flag is then destroyed.

As I mentioned, I cannot say if this is possible, and what structures to use. It is a supposed solution, which I need to check if it is possible. If not how I could do to prevent direct access to videos, remembering to consider the solutions I have already found and discarded previously.

Answer 1

Place the files you want to protect in a subdirectory of the directory in which your code is running:

www.foo.com/player.html
www.foo.com/videos/video.mp4

Save a file in this subdirectory called ". htaccess" and add the lines below:

www.foo.com/videos/. htaccess

Contents of . htaccess:

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://foo.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www.foo.com/.*$ [NC]
RewriteRule .(mp4|mp3|avi)$ - [F]

Now the source link will be fake, but we still need to ensure that any user who is trying to download the file cannot directly receive the file.

For a more complete solution, place your video with a fake screen (or html screen) and never link directly to the video. To disable right-click add to your HTML:

<body oncontextmenu="return false;">

The result:

www.foo.com/player.html will play the video correctly, but if you visit www.foo.com/videos/video.mp4 will receive an error message:

Error Code 403: FORBIDDEN

NOTE: This will work for direct download, Curl, hotlinking, etc.

To make it even harder, you can send a request to the server through a temporary md5 hash, and return your video through this temporary instance, so you won’t have a full video path inside your fake screen when this hash expires.

Example file (load_video.php):

//digamos que você tem isso no banco de dados
$videos = [
 ['directory' => 'videos','file' => 'video_nome_1', 'type' => 'mp4', 'id' => 1],
 ['directory' => 'videos','file' => 'video_nome_2', 'type' => 'mp4', 'id' => 2]
 ['directory' => 'videos','file' => 'video_nome_3', 'type' => 'mp4', 'id' => 3]
];

$data_list_videos = [];

foreach($videos as $k => $video) {
    $data_list_videos[md5($video['id']. range('a', 'd'))] = $video;
}

if($_POST) {
   $validate = (new DateTime())->getTimestamp();  
   $video = $data_list_videos[$_POST['video']];
   return json_encode([
     'status' => true,
     'video' => base64_encode($video),
     'validate' => $validate
   ]); 
}

In your view you could call something like this with ID 2 for example, and set the video path in your element #leitor, in case I’m using the jquery library to make a post:

<script>
     <?php $id = md5(2 . range('a', 'd')); ?>

            $.post('/load_video.php?video=<?php echo $id?>',function(rtn) {
                var data = JSON.parse(rtn);
                  if(data.status && (<?php echo (new DateTime())->getTimestamp();?> == data.validate)) {

                   var result = data.video;
                   var data_video = window.atob(result);
                  var srcVideo = [
                       '/',
                       data_video.directory,
                       '/',
                       data_video.file,
                       '.',
                       data_video.type,
                       '?',
                       validate=data.validate
                  ];
             var leitor = document.querySelector('#leitor');
             $.get('/leitor.php?video='+window.btoa(srcVideo.join(''))+'&validate='+data.validate, function(srcVideo) { 
                   leitor.src = JSON.parse(srcVideo).src;
                   leitor.setAttribute('type', 'video/'+data_video.type);
             });

       }
 });
</script>
    <video width="320" height="240" controls>
      <source id="leitor">
    </video>

In the video file, it can be a leitor.php you load a video player it returns the url:

/leitor.php?validate=1572363160&video=L3ZpZGVvL3ZpZGVvX25vbWVfMi5tcDQ=

   if ($_GET['validate'] == (new DateTime())->getTimestamp()) {
       echo json_decode(['src' => base64_decode($_GET['video'])]);
    }