Неоткриваема грешка в код изтеглен от нета?!

[redbulldog]

Здравейте! Изтеглих този код с името Prevent direct access to php file, което говори и за това какво прави кода. Оригинала на кода е

<?php
$file_only = basename($_GET['param']);
$file_only = str_replace(" ", "_", $file_only);
// These don't really matter since you're just reading from one folder and you don't check extensions or anything, but I like to do it in case
$file_only = str_replace("\0", "", $file_only); // Poison null byte
$file_only = str_replace(":", "", $file_only); // NTFS ADS
// Key
$shared_key = "something";
$timestamp = time();
$hash = hash_func_hmac($file_only, "$timestamp-$shared_key");
$url = printf("get.php?param=%s&t=%d&key=%s", urlencode($file_only), $timestamp, $hash);
?>
<br />
<object classid="CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6" events="True" codebase="http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab#Version=6,4,5,715" type="application/x-oleobject" width="560" height="440">
	<param name="url" value="<?php echo htmlspecialchars(urlencode($url)) ?>" />
	<param name="playCount" value="1" />
	<param name="autoStart" value="True" />
	<param name="Volume" value="100">

	<param name="ShowDisplay" value="0" />
	<param name="ShowControls" value="1">
	<param name="ShowStatusBar" value="1">

	<embed type="application/x-mplayer2" pluginspage="http://www.microsoft.com/Windows/Downloads/Contents/Products/MediaPlayer/"
		src="<?php echo htmlspecialchars(urlencode($url)) ?>" name="myPlayer" id="myPlayer" autostart="1" showcontrols="1" showdisplay="0" animationatstart="0" transparentatstart="1" AllowChangeDisplaySize="1" enableContextMenu="1" ShowStatusBar="1" EnableFullScreenControls="1" width="560" height="440" />
</object>

и втория файл

<?php
$file_only = $_GET['param'];
$shared_key = "something";
$in_hash = $_GET['key'];
$in_timestamp = intval($_GET['t']);
$in_hash = $_GET['key'];
$expected_hash = hash_func_hmac($file_only, "$in_timestamp-$shared_key");
if ($expected_hash != $in_hash || $in_timestamp < time() - 60 * 15) { // You could do the timestamp check before computing the hash
    header("HTTP/1.1 404 Not Found");
    exit;
}
// I would still do a security check again
// And then load t
?>

Когато разгледах кода видях странна измислена функция с неизвестна цел hash_func_hmac();

Махнах функцията и се получи така:

<?php
//$file_only = basename($_GET['param']);
$file_only = "http://78.90.44.65/test/2/test.mp3";
$file_only = str_replace(" ", "_", $file_only);
// These don't really matter since you're just reading from one folder and you don't check extensions or anything, but I like to do it in case
$file_only = str_replace("\0", "", $file_only); // Poison null byte
$file_only = str_replace(":", "", $file_only); // NTFS ADS
// Key
$shared_key = "something";
$timestamp = time();
$hash = "$timestamp-$shared_key";
$url = printf("get.php?param=%s&t=%d&key=%s", urlencode($file_only), $timestamp, $hash);

echo $timestamp;
?>
<br />
<object classid="CLSID:6BF52A52-394A-11d3-B153-00C04F79FAA6" events="True" codebase="http://activex.microsoft.com/activex/controls/mplayer/en/nsmp2inf.cab#Version=6,4,5,715" type="application/x-oleobject" width="560" height="440">
	<param name="url" value="<?php echo htmlspecialchars(urlencode($url)) ?>" />
	<param name="playCount" value="1" />
	<param name="autoStart" value="True" />
	<param name="Volume" value="100">

	<param name="ShowDisplay" value="0" />
	<param name="ShowControls" value="1">
	<param name="ShowStatusBar" value="1">

	<embed type="application/x-mplayer2" pluginspage="http://www.microsoft.com/Windows/Downloads/Contents/Products/MediaPlayer/"
		src="<?php echo htmlspecialchars(urlencode($url)) ?>" name="myPlayer" id="myPlayer" autostart="1" showcontrols="1" showdisplay="0" animationatstart="0" transparentatstart="1" AllowChangeDisplaySize="1" enableContextMenu="1" ShowStatusBar="1" EnableFullScreenControls="1" width="560" height="440" />
</object>

?>

и следователно другия код

<?php
$file_only = $_GET['param'];
$shared_key = "something";
$in_hash = $_GET['key'];
$in_timestamp = intval($_GET['t']);
$in_hash = $_GET['key'];
$expected_hash = "$in_timestamp-$shared_key";
if ($expected_hash != $in_hash || $in_timestamp < time() - 60 * 15) { // You could do the timestamp check before computing the hash
    header("HTTP/1.1 404 Not Found");
    exit;
	echo "Hi!";
}
// I would still do a security check again
// And then load the file

?>

Така отначалото явно заради онази функция даваше само бял екран.
Вече излиза и плеиъра, но дотам. Нито плейва файл като го задам в адреса - file.php?param=file.mp3 също така пробвах и с Live стриимове, но нищо WMP винаги си изписва ready. Незнам къде е грешката и немога да я намеря вече цял ден си блъскам главата, а целта на самия код е да кодира live сриимовете с hash-ове които се променят през няколко секунди или в интервала които си е зададен във втория код.

Ако някои може да помогне ще ви бъда много, много благодарен.
Благодаря ви предварително!