how to download mp4 file and hide url path using php

Question

I have a site where users have to pay to for downloads of videos they create on the site. Because of this I need to hide the path for the downloads.

I have the php page where the download button is -

<form id="dl_script_form" action="dl-script.php" method="post" target="_blank">
<input name="userID" type="hidden" value="<?php echo $user->ID;?>" />
<input name="videosID" type="hidden" value="<?php echo $vId; ?>" />
<input name="downloadvids" id="downloadvids" type="submit" value="Download"/>
</form>

And on the dl-script.php --

require_once $_SERVER['DOCUMENT_ROOT'] . '/wp-load.php';

global $post;
$userid = $_POST['userID'];
$videosid = $_POST['videosID'];

$nameOld = '/path/to/'.$userid.'/'.$videosid.'/'.$videosid.'.mp4';
$nameNew = "download.mp4";
header('Content-type: video/mp4');
header("Content-disposition: attachment; filename=$nameNew");
header("Content-Length: ".filesize($nameOld));
readfile($nameOld);
exit(); 

When trying to click submit, a download is started (with the filename as download.mp4) but when I try opening the mp4 in windows media player, it tells me -

Windows Media Player cannot play the file. The Player might not support the file type or might not support the codec that was used to compress the file.

I've checked the file path and was able to play the video in my browser or right click download without a problem.

So with php script the file must be corrupted somehow. I tried adding/removing header content-* and file_get_contents, but still no luck.

What am I doing wrong?

EDIT

For testing purposes I modified the code to download from my second server to my original server where I am running the script from.

$userid = $_POST['userID'];
$videosid = $_POST['videosID'];

$path = 'https://path/to/'.$userid.'/'.$videosid.'/'.$videosid.'.mp4';
$save = '/var/path/to/'.$userid.'/'.$videosid.'/'.$videosid.'.mp4';

file_put_contents($save, fopen($path, 'r'));

$nameNew = "download.mp4";

header('Content-type: video/mp4');
header("Content-disposition: attachment; filename=$nameNew");
header("Content-Length: ".filesize($save));
readfile($save);

This however still doesnt download correctly. If I download the file directly though without the script, it works fine.

Answer 1

The scripts looks fine for what it does.

Based on the comments it seems that you are trying to get the file from a remote location, the function filesize would not work, you have to find another way of getting the filesize or simply removing it

a way to get the filesize is via the headers

the following code should get the filesize from $nameOld remote location

$headers= get_headers($nameOld, 1);
$filesize = $headers['Content-Length'];

get_headers() documentation

readfile() supports remote file locations, but the allow_url_fopen php configuration should be On

---

In order to make it work you will have to find the assosiate error log, if the error reporting is to error_reporting=E_ALL then the file you download contains the error, so if you open it in a text editor you will be able to see the error, otherwise search in your error.log, there is high changes that the allow_url_fopen was not configured properly, but finding the error would help you solve the issue.

---

Edit:

I have tested your code and it is posible to download a sample mp4 from a remote location

$nameOld = 'https://sample-videos.com/video123/mp4/720/big_buck_bunny_720p_2mb.mp4';
$nameNew = "download.mp4";

$headers= get_headers($nameOld, 1);
$filesize = $headers['Content-Length'];

header('Content-type: video/mp4');
header("Content-disposition: attachment; filename=$nameNew");
header("Content-Length: ".$filesize);

readfile($nameOld);

if that doesn't work for you then the issue is in your server settings, probably the allow_url_fopen that I mentioned before.

Answer 2

Could it be some issue with server-side https handling? Have you tried plain http request to second server?

Have you ever considered using secure urls? This could help reduce network and cpu load on your servers. Instead of hiding real URL, you could give user temporary link, which works only for his IP (and expires after some time). This is what most tube sites do. Check this: http://nginx.org/en/docs/http/ngx_http_secure_link_module.html

Answer 3

I wasnt able to get it working with any of the suggestions here, but after continuing to dig deeper, I was able to get it working.

The only issue though is that I have to save the file from my second server to my first server, for the download to work. I then delete it, but I'm pretty sure this is not efficient performance wise. However, nothing else I tried work.

The key thing(s) that got it to work is ob_start(), while (ob_get_level()) { ob_end_clean(); }

full code -

ob_start();

$userid = $_POST['userID'];
$videosid = $_POST['videosID'];

$nameOld = 'https://path/to/get/'.$userid.'/'.$videosid.'/'.$videosid.'.mp4';
$save = '/path/to/save/it/'.$userid.'/'.$videosid.'/'.$videosid.'.mp4';

$nameNew = "download.mp4";

file_put_contents($save, fopen($nameOld, 'r'));

set_time_limit(0);

header('Connection: Keep-Alive');
header('Content-Description: File Transfer');
header('Content-Type: application/force-download');
header("Content-Disposition: attachment; filename=$nameNew");
header('Content-Transfer-Encoding: binary');
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
header('Content-Length: ' . filesize($save));

      while (ob_get_level()) {
        ob_end_clean();
      }

readfile($save);
exit;

// delete file when done
unlink($save);

If anyone can suggest a more efficient code example, please go ahead.