embedding flv and swf located outside webroot

Question

I have a script that uploads outside of the webroot. Through the website I then link users to images documents etc.

So for an image the link would be:

media.php?file=nameoffile.jpg&user=userid&folder=images

This is then used to display the image:

<img src="media.php?file=nameoffile.jpg&user=userid&folder=images" width="100" border="0">

This works fine for images and providing a link to download a document.

The problem I face is embedding, I use ffmpeg to convert all allowed videos types to flv (these videos are tested and working great), but when I try to embed the flv video it never works (it works with the direct link of the file just not through media.php). If possible I would also like to embed .swf.

I am using jwplayer to embed (works with the direct link of the file just not through media.php)

        <!-- START OF THE PLAYER EMBEDDING TO COPY-PASTE --> 
            <object id="player" classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" name="player" width="328" height="200"> 
            <param name="movie" value="player.swf" /> 
            <param name="allowfullscreen" value="true" /> 
            <param name="allowscriptaccess" value="always" /> 
            <param name="flashvars" value="media.php?file=nameoffile.flv&user=userid&folder=videos" /> 
            <embed 
                type="application/x-shockwave-flash"
                id="player2"
                name="player2"
                src="player.swf"
                width="328" 
                height="200"
                allowscriptaccess="always" 
                allowfullscreen="true"
                flashvars="file=media.php?file=nameoffile.flv&user=userid&folder=videos"
            /> 
            </object> 
            <script type="text/javascript" src="jwplayer.js"></script>
            <!-- END OF THE PLAYER EMBEDDING --> 

Here is media.php:

        $path_parts = pathinfo($_SERVER['REQUEST_URI']);
        $file = basename(urldecode($_GET['file']));
        $user = basename(urldecode($_GET['user']));
        $folder = basename(urldecode($_GET['folder']));
        $ext = pathinfo($file, PATHINFO_EXTENSION);

        $fileDir = 'pathoutsidewebroot';
        $filePath = $fileDir . $file;

        switch(
        $ext) {
            case "flv": $ctype="video/x-flv"; break;
            // adobe
            case "pdf": $ctype="application/pdf"; break;
            // ms office
            case "doc": $ctype="application/msword"; break;
            case "rtf": $ctype="application/rtf"; break;
            case "xls": $ctype="application/vnd.ms-excel"; break;
            case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
            // open office
            case "odt": $ctype="application/vnd.oasis.opendocument.text"; break;
            case "ods": $ctype="application/vnd.oasis.opendocument.spreadsheet"; break;
            default: $ctype = "application/force-download"; break; 
}

        if(in_array($ext, $valid_formats_vid)){
            if (file_exists($filePath)) {
                header('Content-Type: ' . mime_content_type($filePath));
                header('Content-Length: ' . filesize($filePath));
                readfile($filePath);
        }
        }

        else if(in_array($ext, $valid_formats_img)) {
            if (file_exists($filePath)) {
                header('Content-Type: ' . mime_content_type($filePath));
                header('Content-Length: ' . filesize($filePath));
                readfile($filePath);
            }
        }
        else if(in_array($ext, $valid_formats_docs)) {
                    if (file_exists($filePath))
                    {
            header("Pragma: public");
            header("Expires: 0");
            header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
            header("Cache-Control: private",false);
            header("Content-Type: $ctype");
            header("Content-Disposition: attachment; filename=\"".basename($filePath)."\";");
            header("Content-Transfer-Encoding: binary");
            header("Content-Length: ".@filesize($filePath));
            set_time_limit(0);
            @readfile($filePath) or die("File not found.");                 }
        }

Header from embed that is through media.php

Cache-Control:no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection:Keep-Alive
Content-Disposition:filename=encoded_2012-10-19_22.37.09_1359032866.flv
Content-Length:0
Content-Type:video/x-flv
Date:Thu, 24 Jan 2013 16:26:32 GMT
Expires:Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive:timeout=5, max=88
Pragma:no-cache
Server:Apache/2.2.20 (Ubuntu)
X-Powered-By:PHP/5.3.6-13ubuntu3.8

Header from direct link to file (the one that works)

Accept-Ranges:bytes
Connection:Keep-Alive
Content-Length:2428614
Content-Type:video/x-flv
Date:Thu, 24 Jan 2013 16:23:54 GMT
ETag:"26ca3d8-250ec6-4d4087c796500"
Keep-Alive:timeout=5, max=100
Last-Modified:Thu, 24 Jan 2013 13:07:00 GMT
Server:Apache/2.2.20 (Ubuntu)

Managed to change it to this through media.php (but still not working)

            header("Content-Type: $ctype");
            header('Content-Length: ' . filesize($filePath));
            header('Accept-Ranges: bytes');
            $now = time( );
            $then = gmstrftime("%a, %d %b %Y %H:%M:%S GMT", $now + 365*86440);
            header("Expires: $then");
            ob_clean();
            flush();
            readfile($filePath);



Accept-Ranges:bytes
Cache-Control:no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection:Keep-Alive
Content-Length:2428614
Content-Type:video/x-flv
Date:Thu, 24 Jan 2013 16:44:18 GMT
Expires:Fri, 24 Jan 2014 20:47:38 GMT
Keep-Alive:timeout=5, max=79
Pragma:no-cache
Server:Apache/2.2.20 (Ubuntu)
X-Powered-By:PHP/5.3.6-13ubuntu3.8

Answer 1

The problem is here:

flashvars="file=media.php?file=nameoffile.flv&user=userid&folder=videos"

flashvars receives a query string, so this is interpreted as

file   : media.php?file=nameoffile.flv
user   : userid
folder : videos

You need to urlencode the file parameter:

flashvars="file=media.php?file=nameoffile.flv&user=userid&folder=videos"