Unable to play flash videos. Should there be an entry in the uploads table? [#639504]

Dear all:

I've come across a problem whereby certain users of my site can view flash movies and others can't. After some debugging I've found that the problem seems to be due to the lack of a file_download hook somewhere in the video module(s) which should allow the browser to download the .flv file to play it.

At present the site reports the following modules which implement the "file_download" hook: (upload, user, audio, audio_images, image ). I got this list by setting putting in a drupal_set_message() into module_invoke_all() and checking the $hook argument. I've removed one module from this list which is completely unrelated to video and which allows certain users to download the video (and play it) - the reason I've removed it is a I believe it may be a security concern as this module should not be providing any download functionality for video files.

From the list of remaining modules, the upload module seems to be the most appropriate module to be providing download functionality. However, as the uploaded videos do not get an entry in the uploads table, this module can send the file.

So, three questions?

1) Am I correct in assuming that upload module should be providing the download functionality for the flash player to work?
2) Is it correct that no entry is being made in the upload table - should there be an entry?
3) Is this a known issue - it doesn't appear to be from my searches?

If you need any additional info please ask! Willing to test and even write code if needed.
Thanks for your help.

Regards,
Weaver.

Additional information:

Drupal 6.14
Video 6.x-2.8

Comments

Comment #1

weaver-1 commented 22 November 2009 at 02:52

I've worked around this problem using the following modification to upload.module. This is not a fix however, as it doesn't check permissions for the node, it can't as there is no (easy) way to get the nid to check them.

/**
 * Implementation of hook_file_download().
 */
function upload_file_download($filepath) {
  $filepath = file_create_path($filepath);
  $result = db_query("SELECT f.*, u.nid FROM {files} f INNER JOIN {upload} u ON f.fid = u.fid WHERE filepath = '%s'", $filepath);
  if ($file = db_fetch_object($result)) {
    if (user_access('view uploaded files') && ($node = node_load($file->nid)) && node_access('view', $node)) {
      return array(
        'Content-Type: ' . $file->filemime,
        'Content-Length: ' . $file->filesize,
      );
    }
    else {
      return -1;
    }
  }
  else
  {
    $result = db_query("SELECT * from {files} where filepath='%s'",$filepath);
    if( $file = db_fetch_object($result) )
    {
      if( $file->filemime == "application/octet-stream")
      {
        return array(
          'Content-Type: ' . $file->filemime,
          'Content-Length: ' . $file->filesize,
        );

      }
    }
  }
}