Serve videos with "Require all denied" in httpd.conf

[jepperandersen]

I am securing my piwigo installation by having a "Require all denied" directive in httpd.conf, such that galleries/ and upload/ cannot be browsed. Piwigo works marvellously serving normal photos of all resolution in this mode. However, when it comes to serving video files from the server, one is met with the error message "This video could not be loaded, either because the server or network failed, or because the format is not supported". The httpd-log says:

[authz_core:error] [pid 14304] [client 192.168.1.17:37676] AH01630: client denied by server configuration:

If I put a directive "Require all granted", then the video is served correctly.

My question is this: Since piwigo can server all the photos with the directive "Require all denied", is it possible to modify the piwigo-videojs such that also videos can be served in the "locked-down" mode?

Thanks,
Jeppe

[xbgmsharp]

We can try to find a way to allow this special directive in Apache. By default with PWG galleries/ and upload/ cannot be browsed.
Could you please provide a copy of your Apache config so i can reproduce in my dev environment
I don't see how piwigo-videojs does a request any different from PWG.
Could you also provide an HAR file with each configuration set, using the development tools in Firefox or Chrome, sent it to me by email.

[jepperandersen]

Many thanks for your reply.
I am not sure I understand how "by default with PWG galleries/ and upload/ cannot be browsed." If I point my browser to http://your.server.com/piwigo/upload/ or /galleries/ then I can browse those (unless a restrictive .htaccess is in place). Is that not so? At least, that is what I found, and why I started investigating how to stop that behaviour.
My httpd.conf contains the two directives:

<Directory "/var/www/html/foto/piwigo/upload">
    AllowOverride none
   Require all denied
</Directory>
<Directory "/var/www/html/foto/piwigo/galleries">
    AllowOverride none
    Require all denied
</Directory>

to stop the directories being browsable. If they say 'Require all granted' instead, then I can browse the galleries/ and upload/ directories.
PWG works as normal (with private galleries), shows all pictures etc. But the videos are not being served, with the error message described in my first post.
I am having difficulties making the HAR files, since firefox in linux will not play the videos in question (not yet supported by videojs under linux), and I have never tried making a HAR before. Please let me know if it is still needed, then I will try from windows.
Thanks,
Jeppe

[xbgmsharp]

If you check the index.php of each directory you will find it does a redirect to the main page.

# less /var/www/piwigo/galleries/index.php 

You need to make sure you have index.php.
For the upload directory, I checked, and you are right we can browse it default.
However if you go down to the file level, you will get a Not allowed! message serve by a file created by PSG call index.htm, eg: /var/www/piwigo/upload/2015/02/19/index.htm

Apache by default is set to:

<Directory /var/www/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

If I set the Apache as below, I received an HTTP/403 instead for every page and the PWG is not working at all. Please provide by email the URL or your PWG instance and the Apache configuration so I can reproduce the issue and provide a fix.

<Directory /var/www/>
        AllowOverride None
        Require all denied
</Directory>

The all point of VideoJS is to play video the same way independently of the OS/Browser.
You need to ensure you video are in the correct format according to your OS/Browser.
https://github.com/xbgmsharp/piwigo-videojs/wiki/How-to-add-videos#issue-content-you-know

[xbgmsharp]

To be clear, there is no reason why VideoJS would not work by blocking the directory browsing. All need files (video and poster, etc..) are specify with the full URI. I need to ensure it is you received an HTTP/403 from Apache and it is not a format issue. Then if I can reproduce the issue, I will fix any bug.

[jepperandersen]

Odd - your description is very different from the behavior I see.
I am running Piwigo 2.7.4. I have listed all the albums as private (under "albums->properties").
Permissions to view an album is then granted through group membership.
With the directive:

<Directory "/var/www/html/gallery/galleries">
    AllowOverride none
    Require all denied
</Directory>

I can still use PWG, and even download original sized photos. However, I cannot simply browse the directory by pointing the browser to the URL
However, the videos are not being served. If I change the directive to
Require all granted
then I can browse the directory (even with the index.php in place), and access the file if I know the direct link (which I cannot with "Require all denied"), and the videos are being served again.

The current configuration is with "Require all denied".
As you see, the photos are being served correctly, but the video is not.

Thanks,
Jeppe

[xbgmsharp]

OK I understand now, you have a specific Directorive on you pache configuration for upload and galleries. I did not see it because the </Directory> was not being display by Github.
PWG is not requesting directly the file. Every request are made via action.php for the content and via _i.php for the thumbnails.
Do you have any special setting in PWG or any .htaccess settings?

[nochnaltersack]

Sorry for writing another comment on this old issue. I have the same problem but don't want to remove the "Require all denied" directive for security reasons.
Is it possible to use action.php to define the video source in html? I have changed the video tags src attribute and the nested source tag src attribute from the gallery url of a video to an action.php call manually via Firefox developer tools and the video is showing up.

[daniele-athome]

Did you eventually solve this? I might be having a similar issue in #188.