ZC35 – Protecting Assets with Zend Controller Plugins

Jon Lebensold · 2009-10-31 02:07:49

I had to take a little hiatus the last few weeks, however I'm hoping to get back into a weekly posting schedule.

This video is an introduction in how to effectively use Zend Controller Plugins. The Zend Documentation refers to Zend Controller plugins being part of the Action Stack which is a simple data structure that can be filled with a bunch of plugins which will run in succession.

We'll create a simple asset protection script using the Zend Framework's built in Zend Controller Plugin architecture.

Grab a copy of the project or browse the repository.

zend_controller, plugin, zend_controller_plugin, zend_session,action stack

beregu · 2009-10-31 12:05:19

Hello Jon,

It is very good to hear that you are getting back into a weekly posting. Your new tutorial was really amazing. Unfortunately, the code you attached with your video seems not working properly on my computer.

After I got authenticated, http://localhost/assets/image.jpg gives me long long strings of something like:

============
ÿØÿàJFIFÿâXICC_PROFILEHLinomntrRGB XYZ Î 1acspMSFTIEC sRGBöÖÓ-HP cprtP3desc„lwtptðbkptrXYZgXYZ,bXYZ@dmndTpdmddÄˆvuedL†viewÔ$lumiømeas$tech0rTRC<gTRC<bTRC<textCopyright (c) 1998 Hewlett-Packard CompanydescsRGB IEC61966-2.1sRGB IEC61966-2.1XYZ óQÌXYZ XYZ o¢8õXYZ b™·…
============

Also, without authentication, the AssestGrabber Plugin doesn't redirect me to the index.

I'm on Windows, WampServer 2.0h (not supports PHP5.3) with its installation default plus Apache mod_rewrite enabled.

Should I check if some special PHP or Apache extensions are enabled? If so, please advice me what to check. :-D

Thank you Jon.

Last edited by beregu (2009-10-31 12:07:33)

tomas.fejfar · 2009-10-31 17:22:15

You should send appropriate headers (=Content-Type).

Jon Lebensold · 2009-11-01 21:17:51

good call tomas.

in production code, you would set the Content-Type in the header.

something like header('Content-Type: image/jpg'); in the AssetGrabber plugin.

if we were building generic component, then it would probably involved detecting the mimetype of the file we were grabbing and setting the headers appropriately.

beregu · 2009-11-02 03:18:30

Thanks.. :-P
It works now.

batman · 2009-11-02 15:48:55

Hello,

Nice idea protecting files with plugins, but there is only one thing that bothers me. Is it fast? What if I would like to check 100 or even 1000 files in one action?

Jon Lebensold · 2009-11-02 16:53:46

hmmm... I think it's fast in the sense that you're essentially stopping the rest of the MVC architecture to load. You could use the parameters that are routed (like I did with the filename) to help you find the right file. Another option would be store a lookup in Zend_Cache to cut down on the I/O operations on a per-request basis.

batman · 2009-11-02 19:46:22

Cache is a must for this kind of operations. But I'm wondering what will happen if I will try to display hundreds of files on one page? After all some part of routing is still on and php interpreter is running. Well, I'll give it a try.

Jon Lebensold · 2009-11-03 18:57:11

that's a good point. If they're thumbnails, you could make those requests run straight through Apache and make asynchronous calls for the session-required assets.

Manuel · 2009-11-10 15:29:15

That's where CSS Sprites becomes handy. You can reduce GET requests pretty easily.

01Kuzma · 2010-01-30 14:42:52

Hello!
Firstly I'd thank you for this tutorial!
I've a question:
On a secured page I'd to display secured links pointing to video files.
Video player must grab them and play
Video files are stored in Application/uploads directory.How I can form links with your plugin and send them into a view template as <a href..> tags that video player might play them?
Thank you!

Jon Lebensold · 2010-01-31 18:34:16

hey Kuzma, you'll probably need a two-part solution, with a view helper that generates the right url, which in turn hits the plugin with the necessary parameters to return the video file and the necessary mimetype.

T_bo · 2010-05-11 09:38:12

Hello everyone,
i didn't know that there was already a discussion about those point, i came just for put my solution of extending this excellent assets grabber.( I have also implemented several function to use it with auth, acl and cahce but it's not the point)
The usefull tweak are as jon says on comment 4 a mime-type detection :
first thing it's better to use $this->_response instead of the echo.
with this function you could set a lot of usefull header, i first use an auto-detect mime-type

$this->_response->setHeader('Content-Type',mime_content_type($file_path));    
$this->_response->setBody(file_get_contents($file_path));
$this->_response->sendResponse(); 
// where $file_path is your file path...

To make some streaming-like it's a bit harder the response must look something like that :

        $this->_response->setHeader('Content-Type',mime_content_type($file_path));
    $this->_response->setHeader('Connection','Keep-Alive');
    $this->_response->setHttpResponseCode(206);
    $this->_response->setHeader('Keep_Alive','timeout=15, max=98');
    $this->_response->setHeader('Content-Length',filesize($file_path));
    $this->_response->setBody(file_get_contents($file_path));
    $this->_response->sendResponse();

To make real streaming you have to use the stream_context_create() option of file_get_contents and to accept header request to grab the offset of the file and passing it to the context.

Note that in php 5.3 you have better method based on PECL to check mime-type and other info for your file. And lastely having a function that check if the file exists and if it is readable is always a good idea.

That's it for my little contribution, hope it could be usefull for someone.

Zendcasts Forum

#1 2009-10-31 02:07:49

ZC35 – Protecting Assets with Zend Controller Plugins

#2 2009-10-31 12:05:19

Re: ZC35 – Protecting Assets with Zend Controller Plugins

#3 2009-10-31 17:22:15

Re: ZC35 – Protecting Assets with Zend Controller Plugins

#4 2009-11-01 21:17:51

Re: ZC35 – Protecting Assets with Zend Controller Plugins

#5 2009-11-02 03:18:30

Re: ZC35 – Protecting Assets with Zend Controller Plugins

#6 2009-11-02 15:48:55

Re: ZC35 – Protecting Assets with Zend Controller Plugins

#7 2009-11-02 16:53:46

Re: ZC35 – Protecting Assets with Zend Controller Plugins

#8 2009-11-02 19:46:22

Re: ZC35 – Protecting Assets with Zend Controller Plugins

#9 2009-11-03 18:57:11

Re: ZC35 – Protecting Assets with Zend Controller Plugins

#10 2009-11-10 15:29:15

Re: ZC35 – Protecting Assets with Zend Controller Plugins

#11 2010-01-30 14:42:52

Re: ZC35 – Protecting Assets with Zend Controller Plugins

#12 2010-01-31 18:34:16

Re: ZC35 – Protecting Assets with Zend Controller Plugins

#13 2010-05-11 09:38:12

Re: ZC35 – Protecting Assets with Zend Controller Plugins

Board footer