Joomla: Limiting hotlinking access to images and video - php

Question

I hope i get help soon :)
The Problem simply is this:
I built a custom component(php software) which will soon be listed on Joomla Extension directory for users to download. In this component, images and videos are linked to via urls (hotlinked).
Now on my website, users are made to pay for subscription.
Want i want to achieve is simply to allow the component i built to be granted access to images and videos to users who have an active subscription on my website, and restrict the component access to images and videos to users whose subscription has expired.
I just need an idea of how to go about this.
Your responses are Highly anticipated, thank you.

Answer 1

So I understand you would allow the component to be downloaded freely, but it won't display the hotlinked media to expired suscribers or not registered users.
I guess you would have to keep your registered user host in a table, and instead of hotlinking to the image directly serve it through a php script that would check subscription status (based on the request host url) before displaying the image or a "unsuscribed" fallback image.
The other way would be to restring the content in your webserver, either in .htaccess or in the vhost definition of nginx. But this would mean to manually add or remove suscribers constantly.
Very loose example: your suscriber request the image as
<img src="http://yoursite.com/image.php?img=akdbnrieodoidnsd"/>
from his site http://suscribersite.com
Your image script is the following
$imghash=$_GET['img'];
//strip non alphanumeric characters, to avoid malicious requests
$cleanhash =preg_replace('/[^a-z_\-0-9]/i','', $imghash);
header('content-type: image/png');
if(valid_suscriber($_SERVER['HTTP_REFERER'])) {
$img = file_get_contents("/non-public-directory/$cleanhash.png");
} else {
$img = file_get_contents("/non-public-directory/unauthorized.png");
}
echo $img;
You'll have to implement the valid_suscriber function to check the http_referer suscribersite.com against your suscriber table. Be warned, though, the http_referer can be easily spoofed.
The real solution to your case would be to perform an oauth handshake prior to any request, and append the oauth token to each subsequent request. This is much more cumbersome but less prone to tampering.