By Aibu on

Hi all,
I have a strange question to make:

Is it possible to execute a php file that resides inside Drupal file system folder?

If I try to access a php file stored on my folder, I just get a file download instead of executing it.
The reason why I am putting it there, is because I want Drupal to protect access to this file, or in better words, I would like that access to this file is only available when recalled by Drupal pages and not directly accessible through the web browser.

Thank you all in advance for any suggestion!

⋅ Categories: Drupal 6.x

Comments

pbarnett’s picture

pbarnett commented

Yup; that's definitely a strange thing to want to do.

You could use an include statement (see http://php.net/manual/en/function.include.php) or load the file into a variable and eval it.

Pete.

Aibu’s picture

Aibu commented

Hi pbarnett, thanks for the answer,
but by doing what you suggested, I still have the problem of protecting the file.

As you said, if I understood well, I could create a node, for example, and include the php file inside this node.

But now, is there a way to restrict access to that node only by Drupal and not by normal users?

Can Drupal read and process a php file that other users cannot see?

Thanks a lot!

pbarnett’s picture

pbarnett commented

I'm sorry; I don't understand what you're trying to do here... can you explain further?

Pete.

Aibu’s picture

Aibu commented

No problem, is quite complicated!

Basically I am trying to pass flv paths to a flash video player.

So:

1) The player only wants path to the flv files in relative urls;
2) I have put my flv files outside the web root of the server for security;
3) I have a php script that parses flv files, so what I do is that I pass the url to this script to the flash player (that as I said only wants relative urls) and with the php script I retrieve files from outside the webroot;

This works perfectly beside the fact that if I access the php file directly, I can download files from outside the web root without problems...

What I am trying to do is to protect this file so that only Drupal can call it directly and that is not accessible from a browser. What I thought was to put this php file inside the Drupal filesystem, in order to protect the access, but if it's put there, it wont execute, and the browser just gives me a downloadable php file... I also tried with .htaccess without success (either all can view the file, or noone).

I would really be glad if you could give me an idea!

Thanks a lot in advance!

pbarnett’s picture

pbarnett commented

OK; try this in a page -

<?php
$path_to_file = 'path/to/file';
$handle = fopen(path_to_file);
$filecontent = fread($handle, 1E6);
fclose($handle); // at this point the php is stored in $filecontent
eval($filecontent); // this executes the code from the file
?>

I haven't tested this, so your mileage may vary...

Alternatively, it would be easy to modify the player's php code to accept an absolute path...

Pete.

Aibu’s picture

Aibu commented

Hi Pete,
thanks a lot, this seems to work (beside one problem that I am trying to figure out... pass parameters throught eval in the form of longurl.php?parameter).

By the way, the problem occurs because the swf player that I have is compiled and closed, so I can not modify the way it retrieves parameters.

Thanks a lot for the suggestion, it was really appreciated!

pbarnett’s picture

pbarnett commented

Have you tried appending the ?parameter to the page URL?

Pete.

antoniotorres’s picture

antoniotorres commented

try this http://drupal.org/project/nodeaccess