From 548b7112a2c4e7da914e60cd2dd1cb4bb1d8db64 Mon Sep 17 00:00:00 2001
From: Andrew Robert Nicols <andrew.nicols@luns.net.uk>
Date: Mon, 23 Jul 2012 12:32:46 +0100
Subject: [PATCH] MDL-28486 Force use of SSL for all youtube and vimeo embeds

If a page is served over SSL (https), then any content loaded from non-SSL
sources (e.g. http://youtube.com/) will cause errors to show in the
browser. To prevent this, it's best to use the SSL equivelants where they
exist (e.g. https://youtube.com/).

Unfortunately, it isn't possible to accurately determine whether the
current page is loaded over an SSL connection or not in Moodle.

Since including content from an external SSL site on a non-SSL moodle page
does not lead to browser warnings, but non-SSL external content on an SSL
moodle page does, we always use SSL where available.

Note: This does not lead to any additional processing requirements for the
moodle site.
---
 lib/medialib.php | 29 ++++++++++-------------------
 1 file changed, 10 insertions(+), 19 deletions(-)

diff --git a/lib/medialib.php b/lib/medialib.php
index 57a9e902bb0..229006083f4 100644
--- a/lib/medialib.php
+++ b/lib/medialib.php
@@ -493,7 +493,7 @@ class core_media_player_vimeo extends core_media_player_external {
 
         $output = <<<OET
 <span class="mediaplugin mediaplugin_vimeo">
-<iframe title="$info" src="http://player.vimeo.com/video/$videoid"
+<iframe title="$info" src="https://player.vimeo.com/video/$videoid"
   width="$width" height="$height" frameborder="0"></iframe>
 </span>
 OET;
@@ -503,7 +503,7 @@ OET;
 
     protected function get_regex() {
         // Initial part of link.
-        $start = '~^http://vimeo\.com/';
+        $start = '~^https?://vimeo\.com/';
         // Middle bit: either watch?v= or v/.
         $middle = '([0-9]+)';
         return $start . $middle . core_media_player_external::END_LINK_REGEX_PART;
@@ -541,8 +541,9 @@ class core_media_player_youtube extends core_media_player_external {
 
         if (empty($CFG->xmlstrictheaders)) {
             return <<<OET
-<iframe title="$info" width="$width" height="$height"
-  src="$site/embed/$videoid?rel=0&wmode=transparent" frameborder="0" allowfullscreen></iframe>
+<span class="mediaplugin mediaplugin_youtube">
+<iframe title="$info" width="$width" height="$height" src="https://$site/embed/$videoid?rel=0&wmode=transparent" frameborder="0" allowfullscreen="1"></iframe>
+</span>
 OET;
         }
 
@@ -551,7 +552,7 @@ OET;
         $output = <<<OET
 <span class="mediaplugin mediaplugin_youtube">
 <object title="$info" type="application/x-shockwave-flash"
-  data="$site/v/$videoid&amp;fs=1&amp;rel=0" width="$width" height="$height">
+  data="https://$site/v/$videoid&amp;fs=1&amp;rel=0" width="$width" height="$height">
  <param name="movie" value="$site/v/$videoid&amp;fs=1&amp;rel=0" />
  <param name="FlashVars" value="playerMode=embedded" />
  <param name="allowFullScreen" value="true" />
@@ -564,7 +565,7 @@ OET;
 
     protected function get_regex() {
         // Initial part of link.
-        $start = '~^(https?://www\.youtube(-nocookie)?\.com)/';
+        $start = '~^https?://(www\.youtube(-nocookie)?\.com)/';
         // Middle bit: either watch?v= or v/.
         $middle = '(?:watch\?v=|v/)([a-z0-9\-_]+)';
         return $start . $middle . core_media_player_external::END_LINK_REGEX_PART;
@@ -607,26 +608,16 @@ class core_media_player_youtube_playlist extends core_media_player_external {
 
         self::pick_video_size($width, $height);
 
-        // TODO: iframe HTML 5 video not implemented and object does not work
-        // on iOS devices.
-        $fallback = core_media_player::PLACEHOLDER;
-        $output = <<<OET
+        return <<<OET
 <span class="mediaplugin mediaplugin_youtube">
-<object title="$info" type="application/x-shockwave-flash"
-  data="$site/p/$playlist&amp;fs=1&amp;rel=0" width="$width" height="$height">
- <param name="movie" value="$site/v/$playlist&amp;fs=1&amp;rel=0" />
- <param name="FlashVars" value="playerMode=embedded" />
- <param name="allowFullScreen" value="true" />
-$fallback</object>
+<iframe width="$width" height="$height" src="https://$site/embed/videoseries?list=$playlist" frameborder="0" allowfullscreen="1"></iframe>
 </span>
 OET;
-
-        return $output;
     }
 
     protected function get_regex() {
         // Initial part of link.
-        $start = '~^(https?://www\.youtube(-nocookie)?\.com)/';
+        $start = '~^https?://(www\.youtube(-nocookie)?\.com)/';
         // Middle bit: either view_play_list?p= or p/ (doesn't work on youtube) or playlist?list=.
         $middle = '(?:view_play_list\?p=|p/|playlist\?list=)([a-z0-9\-_]+)';
         return $start . $middle . core_media_player_external::END_LINK_REGEX_PART;