From aa7f151edd8a0b64be414dbdb65a0354b0699694 Mon Sep 17 00:00:00 2001 From: Juan Leyva Date: Thu, 28 Sep 2017 10:00:21 +0200 Subject: [PATCH] MDL-60355 media_vimeo: Support restricted videos by domain in the app As reported in MOBILE-1511, Vimeo videos restricted by domain are not working in the app. The reason is simple: The restriction is done by the Referer HTTP header, when a video is embedded via an iframe in the Moodle Site, Vimeo checks the Referer to see if it matches the specified domain. When the video is embedded in the mobile app, the Referer is the one provided by the app Cordova container so Vimeo won't allow playing the video. The solution is to add an extra iframe on top of the Vimeo embedding one (like a proxy), the app will display an iframe pointing to a page in the site that will include the iframe pointing to vimeo so the restriction check will work. --- media/player/vimeo/wsplayer.php | 61 +++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 media/player/vimeo/wsplayer.php diff --git a/media/player/vimeo/wsplayer.php b/media/player/vimeo/wsplayer.php new file mode 100644 index 00000000000..61a19422f48 --- /dev/null +++ b/media/player/vimeo/wsplayer.php @@ -0,0 +1,61 @@ +. + + +/** + * A script to embed vimeo videos via the site (so vimeo privacy restrictions by domain will work in the mobile app). + * + * The site is doing a double frame embedding: + * - First, the media player replaces the vimeo link with an iframe pointing to vimeo. + * - Second, the app replaces the previous iframe link with a link to this file that includes again the iframe to vimeo. + * Thanks to these changes, the video is embedded in a page in the site server so the privacy restrictions will work. + * + * Note 1: Vimeo privacy restrictions seems to be based on the Referer HTTP header. + * Note 2: This script works even if the plugin is disabled (some users could be using the vimeo embedding code). + * + * @package media_vimeo + * @copyright 2017 Juan Leyva + * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later + */ + +define('NO_MOODLE_COOKIES', true); + +require_once(__DIR__ . '/../../../config.php'); +require_once($CFG->dirroot . '/webservice/lib.php'); + +$token = required_param('token', PARAM_ALPHANUM); +$video = required_param('video', PARAM_ALPHANUM); // Video ids are numeric, but it's more solid to expect things like 00001. +$width = required_param('width', PARAM_INT); +$height = required_param('height', PARAM_INT); + +// Authenticate the user. +$webservicelib = new webservice(); +$webservicelib->authenticate_user($token); + +$output = << + + + + + + + +OET; +echo $output;