php curl vs browser
littlejam
Joined: 2010-06-04
Posts: 6 |
Posted: Wed, 2010-06-23 07:56 |
Hello, when I'm trying to access a gallery-file with curl I get an security violation error... $fileurl = "example.com/main.php?g2_view=core.DownloadItem&g2_itemId=1234&g2_serialNumber=2&g2_GALLERYSID=12345678901234567890123456789012" $ch = curl_init(); // set url curl_setopt($ch, CURLOPT_URL, $fileurl); // connect and dump result to screen curl_exec($ch); // close curl resource to free up system resources curl_close($ch); Running the script results in the following error: Type Gallery Error Location http://example.com/main.php?g2_view=core.DownloadItem&g2_itemId=1234&g2_serialNumber=2&g2_GALLERYSID=12345678901234567890123456789012 User Id 5 Client 123.123.123.123 Zusammenfassung user id: 5 doesn't have permission: core.viewSource for item id: 1234 Referer null Details Error (ERROR_MISSING_OBJECT, ERROR_PERMISSION_DENIED) : user id: 5 doesn't have permission: core.viewSource for item id: 1234 in modules/core/classes/helpers/GalleryUserHelper_simple.class at line 47 (GalleryCoreApi::error) in modules/core/classes/GalleryCoreApi.class at line 550 (GalleryUserHelper_simple::assertHasItemPermission) in modules/core/DownloadItem.inc at line 222 (GalleryCoreApi::assertHasItemPermission) in modules/core/DownloadItem.inc at line 84 (DownloadItemView::_assertPermissions) in main.php at line 450 (DownloadItemView::renderImmediate) in main.php at line 104 in main.php at line 88 Request variables: Array ( [view] => core.DownloadItem [itemId] => 1234 [serialNumber] => 2 [GALLERYSID] => 12345678901234567890123456789012 ) However the exact same URL entered in a browser-window results in downloading the correct file including the correct filename and filesize. The curl-command works also with unprotected files so this might be a security issue. Can someone point me in the right direction? Greets |
|
Posts: 4342
Yes.
The SID refers to a session, and is only valid temporarily, and for a given browser/ip address combo. In this case your SID isn't valid for that request. SID's are not transferable. G2 is designed to be queried by browsers which maintain session via the cookie (which is the normal way for the SID to be returned) and not by things like curl. You can't copy a SID from a browser url and expect it to work anywhere else.
Posts: 8339
You can view gallery items externally using the ImageBlock module as well as my mediaBlock.
An example of curl usage w/ mediaBlock here.
You can also embed Gallery2 into your site with my easy embed tool.
-s
FlashYourWeb and Your Gallery with The E2 XML Media Player for Gallery2
Posts: 4342
@suprsidr: does ImageBlock/curl work for images that require a login/password to view? The core.DowloadView method will also work, if images are not protected.
Posts: 6
Thanks for the quick answer.
If I can't use the SID for my curl-request then how can I do it otherwise.
The idea is to enable progressive streaming with flash files in G2.
It already works with files that are world-accessible.
My hope is to make it work also with protected files without any hacks around the G2 security system.
Greets
littlejam
Posts: 8339
I actually have a file that was for streaming flv based on xmoov if you are interested.
-s
FlashYourWeb and Your Gallery with The E2 XML Media Player for Gallery2
Posts: 4342
If you think about it, you'll see that's going to be tricky, as a matter of definition. The G2 security system is built to prevent access to files to other than browser sessions with authenticated credentials as a user for whom permissions allow access to that file - that's what it does. How then could you have anonymous streaming of a protected file? If you could, it wouldn't be protected.
Posts: 6
Thanks suprsidr I'll have a look into it.
How do I use it?
Yes you are right with that.
Maybe suprsidrs approach is the better one.
I'll try to add seeking capability.
greets
littlejam
Posts: 8339
place in your gallery's root directory
point your flash video player to yoursite.com/gallery2/mediaStreamer.php?g2_itemId=150
where 150 is the id of your flv
at one time I had variables for pseudo streaming scrubbing/queuing but lost interest and removed them.
-s
FlashYourWeb and Your Gallery with The E2 XML Media Player for Gallery2
Posts: 6
Ok, seeking is now possible.
However there is no security at this point so there is some more coding that have to be done.
I'm crawling through the g2-api for the right calls. Hints are welcome ;-)
The script works with JWPlayer (v. 4.5).
It must be placed into the modules/flashvideo/lib-directory of G2.
The flashvars should look somehow like this...
It is important that the file-parameter consists of more than the g2_itemId (more precisely: more than only numbers) otherwise the JWPlayer throws an error which can only be avoided by changing and recompiling the player itself.
I added g2_serialNumber and g2_GALLERYSID divided by dots; at the moment these are of no other purpose than preventing JWPlayer from failing.
Posts: 8339
Yup, I originally had the seek in there, but found not one of my videos has the proper keyframes even ones I encoded w/ Adobe's media encoder - so I lost interest.
I left out permissions for a specific app I built, but the following should work before we bother loading the item:
-s
FlashYourWeb and Your Gallery with The E2 XML Media Player for Gallery2
Posts: 6
Thanks a lot suprsidr.
The script works now as expected :-D
You might wish to read this...
http://www.orlandmedia.com/blog/adobe-flash/choosing-a-flash-video-format-for-pseudostreaming/
It only works good and simple with .flv-files.
Even if you encode with AME you have to insert the metadata with another tool.
I used flvtool2.exe
This adds the metadata.
After that you can upload the file into g2 and seek to any point in the clip.
Greets
Posts: 8339
I may play with this again, I had added the necessary seek functionality to my E2 player.
If you send me your working copy w/ FlashVideoRenderer.class I'll update my mediaStreamer download w/ your updates for anyone else who is interested.
-s
FlashYourWeb and Your Gallery with The E2 XML Media Player for Gallery2