Hiding paths, private content etc

[jonperks]

I have created some code that gets an image from a private folder below the root directory and displays it. It doesn't show the path so as far as I can tell I can completely control access to it. This works fine with jpeg images however I now need to do this for video files, wmv and mpeg.

The closest I have got to what I want downloads the video file however I want the video to play in the browser window.

The videos need to be completely hidden and have no access whatsoever except from a php script.

Thanks in advance...

[blear]

if your webserver is linux-based, you could set permissions such that only the "user" php  can access them. What is that,

chmod 400 image.ext

Changes it to read-only access for the owner. You would then have to give ownership of the file over to whatever user your php script accesses your filesystem as. This would also remove the need to hide the files in a directory underneath the root directory. Not perfectly sure how you managed to accomplish that anyways.

[jonperks]

Thanks for the reply

I've never had to prevent access to files before and I'm not sure how I would do what your saying. Are you saying I can hide the username and password for the directory in a php script that will in effect "login" to the folder when someone who has already logged in to the site tries to access it?

If so how do I do that?

My code is below... It works perfect for downloading the video and there is no other way that I can tell of accessing the file.

The script is in the root directory "www"  so path/www/script.php and the video is path/private/videos/1.wmv

[code]
<?php
$filename =  "videos/1.wmv";
$bytes = filesize("../private/$filename");
header("Content-type: application/wmv");
header("Content-disposition: attachment; filename=\"$filename\"");
header("Content-length: $bytes");
@readfile("../private/$filename"); 
?>
[/code]

[jonperks]

If i use htaccess to password protect the directory is there a way that I can use php to automatically enter the username and password when a logged in user tries to access the folder. So that it doesn't prompt them for it?

[jonperks]

I have seen that [code]$_SERVER['PHP_AUTH_USER'];[/code] & [code]$_SERVER['PHP_AUTH_PW'];[/code] hold the htaccess username and password.

How do I set these manually?