L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-48085 flowplayer: prevent flash parameters via url

Browse Source
This commit is contained in:
Petr Skoda
2015-11-04 10:38:43 +00:00
committed by Dan Poltawski
parent 493e0febed
commit 3a4d04cdb7
12 changed files with 184 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/flowplayer/flowplayer-3.2.18.swf
BIN
View File
Binary file not shown.
lib/flowplayer/flowplayer-3.2.18.swf.bin
+1
View File
File diff suppressed because one or more lines are too long
lib/flowplayer/flowplayer-3.2.18.swf.php
+32
View File
@@ -0,0 +1,32 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* Flowplayer handling file.
*
* @package core
* @copyright Petr Skoda <[email protected]>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
define('NO_DEBUG_DISPLAY', true);
define('NO_MOODLE_COOKIES', true);
define('NO_UPGRADE_CHECK', true);
require('../../config.php');
require('../../lib/flowplayer/lib.php');
flowplayer_send_flash_content('flowplayer-3.2.18.swf');
lib/flowplayer/flowplayer.audio-3.2.11.swf
BIN
View File
Binary file not shown.
lib/flowplayer/flowplayer.audio-3.2.11.swf.bin
+1
View File
File diff suppressed because one or more lines are too long
lib/flowplayer/flowplayer.audio-3.2.11.swf.php
+32
View File
@@ -0,0 +1,32 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* Flowplayer audio swf handling.
*
* @package core
* @copyright Petr Skoda <[email protected]>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
define('NO_DEBUG_DISPLAY', true);
define('NO_MOODLE_COOKIES', true);
define('NO_UPGRADE_CHECK', true);
require('../../config.php');
require('../../lib/flowplayer/lib.php');
flowplayer_send_flash_content('flowplayer.audio-3.2.11.swf');
lib/flowplayer/flowplayer.controls-3.2.16.swf
BIN
View File
Binary file not shown.
lib/flowplayer/flowplayer.controls-3.2.16.swf.bin
+1
View File
File diff suppressed because one or more lines are too long
lib/flowplayer/flowplayer.controls-3.2.16.swf.php
+32
View File
@@ -0,0 +1,32 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* Flowplayer audio controls handling.
*
* @package core
* @copyright Petr Skoda <[email protected]>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
define('NO_DEBUG_DISPLAY', true);
define('NO_MOODLE_COOKIES', true);
define('NO_UPGRADE_CHECK', true);
require('../../config.php');
require('../../lib/flowplayer/lib.php');
flowplayer_send_flash_content('flowplayer.controls-3.2.16.swf');
lib/flowplayer/lib.php
+78
View File
@@ -0,0 +1,78 @@
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* Flowplayer library.
*
* @package core
* @copyright Petr Skoda <[email protected]>
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
defined('MOODLE_INTERNAL') || die();
/**
* Safer flash serving code.
*
* @param string $filename
* @return void does not return, ends with die()
*/
function flowplayer_send_flash_content($filename) {
global $CFG;
// Note: Do not use any fancy APIs here, this must work in all supported versions.
// No url params.
if (!empty($_GET) or !empty($_POST) or !empty($_REQUEST)) {
header("HTTP/1.1 404 Not Found");
die;
}
// Our referrers only, nobody else should embed these scripts.
if (!empty($_SERVER['HTTP_REFERER'])) {
$refhost = parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST);
$host = parse_url($CFG->wwwroot . '/', PHP_URL_HOST);
if ($refhost and $host and strtolower($refhost) !== strtolower($host)) {
header("HTTP/1.1 404 Not Found");
die;
}
}
// Fetch and decode the original content.
$content = file_get_contents($CFG->dirroot . '/lib/flowplayer/' . $filename . '.bin');
if (!$content) {
header("HTTP/1.1 404 Not Found");
die;
}
$content = base64_decode($content);
// No caching allowed.
if (strpos($CFG->wwwroot, 'https://') === 0) {
// HTTPS sites - watch out for IE! KB812935 and KB316431.
header('Cache-Control: private, max-age=10, no-transform');
header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT');
header('Pragma: ');
} else {
header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0, no-transform');
header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT');
header('Pragma: no-cache');
}
// Send the original binary code.
header('Content-Type: application/x-shockwave-flash');
echo $content;
die;
}
lib/flowplayer/readme_moodle.txt
+1
View File
@@ -1,6 +1,7 @@
Description of FlowPlayer import
Our changes:
* the handling of flash content now it's done by PHP, checking url parameter to avoid security issues.
* we do not load the flow player if flash not present - this is much better
for accessibility and flash incompatible devices - they may play mp3 or flv directly
* no splashscreens
lib/javascript-static.js
+6 -4
View File
@@ -1697,6 +1697,7 @@ M.util.load_flowplayer = function() {
loaded = true;
var controls = {
url: M.cfg.wwwroot + '/lib/flowplayer/flowplayer.controls-3.2.16.swf.php',
autoHide: true
}
/* TODO: add CSS color overrides for the flv flow player */
@@ -1704,9 +1705,9 @@ M.util.load_flowplayer = function() {
for(var i=0; i<M.util.video_players.length; i++) {
var video = M.util.video_players[i];
if (video.width > 0 && video.height > 0) {
var src = {src: M.cfg.wwwroot + '/lib/flowplayer/flowplayer-3.2.18.swf', width: video.width, height: video.height};
var src = {src: M.cfg.wwwroot + '/lib/flowplayer/flowplayer-3.2.18.swf.php', width: video.width, height: video.height};
} else {
var src = M.cfg.wwwroot + '/lib/flowplayer/flowplayer-3.2.18.swf';
var src = M.cfg.wwwroot + '/lib/flowplayer/flowplayer-3.2.18.swf.php';
}
flowplayer(video.id, src, {
plugins: {controls: controls},
@@ -1742,6 +1743,7 @@ M.util.load_flowplayer = function() {
return;
}
var controls = {
url: M.cfg.wwwroot + '/lib/flowplayer/flowplayer.controls-3.2.16.swf.php',
autoHide: false,
fullscreen: false,
next: false,
@@ -1806,8 +1808,8 @@ M.util.load_flowplayer = function() {
controls.height = 25;
controls.time = true;
}
flowplayer(audio.id, M.cfg.wwwroot + '/lib/flowplayer/flowplayer-3.2.18.swf', {
plugins: {controls: controls, audio: {url: M.cfg.wwwroot + '/lib/flowplayer/flowplayer.audio-3.2.11.swf'}},
flowplayer(audio.id, M.cfg.wwwroot + '/lib/flowplayer/flowplayer-3.2.18.swf.php', {
plugins: {controls: controls, audio: {url: M.cfg.wwwroot + '/lib/flowplayer/flowplayer.audio-3.2.11.swf.php'}},
clip: {url: audio.fileurl, provider: "audio", autoPlay: false}
});
}