2

I am giving an audio to a javascript player, such as (for Safari):

new Audio('give_audio.php?n='+name+'&t=mp3');

I was looking to set the correct headers for Safari for him to retreive the audio duration. I found this topic which helped me a lot: audio.duration returns Infinity on Safari when mp3 is served from PHP

My PHP script 'give_audio.php' is: 

if (isset($_GET['n']) && isset($_GET['t'])) {

  $n = htmlspecialchars($_GET['n']);
  $t = htmlspecialchars($_GET['t']);
  $filename = $n.'.'.$t;
  $path = 'Audio/'.$filename;
  $fsize = filesize($path);
  $shortlen = $fsize - 1;

  $fp = fopen($path, 'r');
  $etag = md5(serialize(fstat($fp)));
  fclose($fp);

  if ($t == 'mp3') $t = 'mpeg';

  header("Pragma: public");
  header("Expires: 0");
  header('Cache-Control: no-cache, no-store');
  header('Content-Transfer-Encoding: binary');
  header('Content-Disposition: inline; filename="'.$filename.'"');      
  header('Content-Length: '.$fsize);
  header('Content-Type: audio/'.$t);
  header('Accept-Ranges: bytes');
  header('Connection: Keep-Alive');
  header('Content-Range: bytes 0-'.$shortlen.'/'.$fsize); 
  header('X-Pad: avoid browser bug');
  header('Etag: '.$etag);

  readfile($path);

} else {   
  header('HTTP/1.0 404 Not Found');
  echo 'Error';    
}

Now Safari finds the audio duration, but it is fake ! It is too long thus there are several seconds at the end with no data, that litteraly block the player...

Moreover, this doesn't work on Opera.

Do you have an idea to fix this ?

Community
  • 1
  • 1
ekqnp
  • 284
  • 3
  • 13
  • 1
    I strongly recommend to improve security. Serving files solely based on `$_GET` variables is no good practice, this way users can retrieve any file from your server by simply changing the GET request. Also, don't put `$_GET` variables directly into the header. You **must** sanitize and validate all `$_GET` variables before actually using them! – Anne Jun 21 '12 at 11:40
  • Thanks Anne, but as I'm novice, I don't understand where in the way I make `new Audio()` I can send `$_POST` variables. Morevoer, I don't put `$_GET` variables directly in the headers as I do `htmlspecialchars`. But it is not enough ? Anyway, still the headers don't work. – ekqnp Jun 22 '12 at 20:06

0 Answers0