Enabling 'Protect audio files from direct downloads' breaks player - help with protection. [#1304220]

Someone tell me why my configuration is wrong. Is working fine with private files stored outside of the site's web root and download protection disabled in jPlayer config.
My problem is with - and maybe this my misconfiguration of something - The path used by jPlayer is the '/system/files/{path...}'. If you right click on a song title in the playlist and say, Open in new tab, an anonymous user automatically gets a free song. Turning on 'Download protection' in the jPlayer config gives the following error the second a page with a player instance is loaded:
access denied system/files/private/audio/song.mp3
access denied system/files/private/audio/song.mp3
Two exact same warnings are thrown. When I click play on the jPlayer instance I get the warning one more time.
access denied system/files/private/audio/song.mp3
and then this...
PDOException: SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry '1-28-1318092363' for key 'PRIMARY': INSERT INTO {jplayer_denied} (uid, fid, hostname, timestamp) VALUES (:db_insert_placeholder_0, :db_insert_placeholder_1, :db_insert_placeholder_2, :db_insert_placeholder_3); Array ( [:db_insert_placeholder_0] => 1 [:db_insert_placeholder_1] => 28 [:db_insert_placeholder_2] => 192.168.1.102 [:db_insert_placeholder_3] => 1318092363 ) in drupal_write_record() (line 6868 of /var/www/html/sitename/includes/common.inc).

The players button changes from play-to-pause and then right back to pause. Everything works fine when not using "Protect downloads" but doing so means Drupal just serves my songs to whoever.

Anyone have any insight into this?

Comments

Comment #1

now100handed CreditAttribution: now100handed commented 12 October 2011 at 14:12

Priority:

Major

» Critical

Comment #2

drupal a11y CreditAttribution: drupal a11y commented 18 November 2011 at 09:39

Got the same issue:

Type	php
Date	Friday, November 18, 2011 - 10:36
User	mori
Location	http://luvliterecordings.dev/system/files/audio/lowfi/01_intro_by_cleydys_villalon_2.mp3
Referrer	
Message	PDOException: SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry '1-260-1321608962' for key 'PRIMARY': INSERT INTO {jplayer_denied} (uid, fid, hostname, timestamp) VALUES (:db_insert_placeholder_0, :db_insert_placeholder_1, :db_insert_placeholder_2, :db_insert_placeholder_3); Array ( [:db_insert_placeholder_0] => 1 [:db_insert_placeholder_1] => 260 [:db_insert_placeholder_2] => 127.0.0.1 [:db_insert_placeholder_3] => 1321608962 ) in drupal_write_record() (line 6884 of /Applications/MAMP/htdocs/luvliterecordings.dev/includes/common.inc).
Severity	error
Hostname	127.0.0.1

Comment #3

sullix CreditAttribution: sullix commented 26 April 2012 at 09:52

Same.

And, in this case, Mobile Safari crashes on iPhone/iPad iOS5 when I touch on Play ; with iOS4, it doesn't play anything but it doesn't crash neither.

Comment #4

deviantintegral CreditAttribution: deviantintegral commented 11 May 2012 at 18:31

I don't know what I was thinking when I created the primary key, because it's clear that there's a potential for a collision on the timestamp. For now, I would just delete the primary key. I'll write up a patch to add a proper auto_increment for the table.

Crashing Safari shouldn't be possible - that indicates a bug in the browser. But, if we can isolate the reason for the crash, we might be able to work around it until Apple fixes it.

Comment #5

deviantintegral CreditAttribution: deviantintegral commented 11 May 2012 at 18:52

Version:	7.x-2.x-dev	» 6.x-1.x-dev
Status:	Active	» Patch (to be ported)

I just pushed up 99c4537 that contains an update hook that adds a serial key. As well, I fixed two other bugs from the refactoring of the protection code into it's own module.