Snitz Forums 2000
Snitz Forums 2000
Home | Profile | Register | Active Topics | Members | Search | FAQ
Username:
Password:
Save Password
Forgot your Password?

 All Forums
 Snitz Forums 2000 MOD-Group
 MOD Add-On Forum (W/Code)
 Using video/flash in topics?
 New Topic  Reply to Topic
 Printer Friendly
Previous Page | Next Page
Author Previous Topic Topic Next Topic
Page: of 17

Podge
Support Moderator

Ireland
3775 Posts

Posted - 24 February 2006 :  11:41:10  Show Profile  Send Podge an ICQ Message  Send Podge a Yahoo! Message  Reply with Quote
Credit is all yours Marcel.

These are all tags currently supported correct?
[wma][wmv][flash][qt][tube] ?

[gv][/gv] for Google Video? How are we going to check that the code for Google Video is valid? or do we need to?

What problems are we likely to have with a [media][/media] tag?
<

Podge.

The Hunger Site - Click to donate free food | My Blog | Snitz 3.4.05 AutoInstall (Beta!)

My Mods: CAPTCHA Mod | GateKeeper Mod
Tutorial: Enable subscriptions on your board

Warning: The post above or below may contain nuts.
Go to Top of Page

Podge
Support Moderator

Ireland
3775 Posts

Posted - 24 February 2006 :  12:10:22  Show Profile  Send Podge an ICQ Message  Send Podge a Yahoo! Message  Reply with Quote
The main problem I have with the Google code is that it is html encoded e.g.

<embed style="width:400px; height:326px;" id="VideoPlayback" align="middle" type="application/x-shockwave-flash" src="http://video.google.com/googleplayer.swf?videoUrl=http%3A%2F%2Fvp.video.google.com%2Fvideodownload%3Fversion%3D0%26secureurl%3DpwAAAC5Q3TqJgtkaUrxYFgQyqSGrLfHDUKDZ798RZfi1QH7rT93axrH2SKNy07NGdy7oM2-27AJ6t_3p79r4lUD_Iv_ChwRx8BULvO1mQ1GpxikFq1beBWSxPtkQ7MS2qykUcmvnH_lMqZ21njcwTZRA_2TB5mthL2HKIRSc75zAEmsGY68LGyAtkkmPVinLCgI95e_eK8M4O4ZapDm03mfWFgnsbatXThANxE0zJcNuAL-L%26sigh%3D7EJ-E9K3BLvF5-iWcSrHpOBP3x4%26begin%3D0%26len%3D127966%26docid%3D6906105323088846127&thumbnailUrl=http%3A%2F%2Fvideo.google.com%2FThumbnailServer%3Fcontentid%3D9d81b82ea215b110%26second%3D5%26itag%3Dw320%26urlcreated%3D1140800616%26sigh%3D-Yodhwv6rzDYf2XerioVJvaCp6M&playerId=6906105323088846127&playerMode=embedded" allowScriptAccess="sameDomain" quality="best" bgcolor="#ffffff" scale="noScale" wmode="window" salign="TL" > </embed>

Won't this be flagged as 'illegal' unless the check is taken out? If the check is taken out a malicious user could post html even if its disabled.<

Podge.

The Hunger Site - Click to donate free food | My Blog | Snitz 3.4.05 AutoInstall (Beta!)

My Mods: CAPTCHA Mod | GateKeeper Mod
Tutorial: Enable subscriptions on your board

Warning: The post above or below may contain nuts.
Go to Top of Page

Podge
Support Moderator

Ireland
3775 Posts

Posted - 24 February 2006 :  12:17:14  Show Profile  Send Podge an ICQ Message  Send Podge a Yahoo! Message  Reply with Quote
The only thing I can think of is to check that the text begins with

<embed style="width:400px; height:326px;" id="VideoPlayback" align="middle" type="application/x-shockwave-flash" src="http://video.google.com/googleplayer.swf?

and ends with

&playerMode=embedded" allowScriptAccess="sameDomain" quality="best" bgcolor="#ffffff" scale="noScale" wmode="window" salign="TL" > </embed><

Podge.

The Hunger Site - Click to donate free food | My Blog | Snitz 3.4.05 AutoInstall (Beta!)

My Mods: CAPTCHA Mod | GateKeeper Mod
Tutorial: Enable subscriptions on your board

Warning: The post above or below may contain nuts.
Go to Top of Page

MarcelG
Retired Support Moderator

Netherlands
2625 Posts

Posted - 24 February 2006 :  13:48:51  Show Profile  Visit MarcelG's Homepage  Reply with Quote
quote:
Originally posted by Podge
These are all tags currently supported correct?
[wma][wmv][flash][qt][tube] ?
...
What problems are we likely to have with a [media][/media] tag?


Yep, that's the lot.
I suggest [real][/real] for the realplayer, and I guess that that's about 99,9% of all online media content covered.

I'm not sure which problems you'd have with the media tag, as long as the mime-type of the content is recognizable by means of the URL format.
However, as we want to prevent any cross site scripting, we won't allow any strange characters in that URL. That might be a problem for some media types and hosting environments, but we'll still cover >80% of the users, which is fine to me.

quote:
Originally posted by Podge

The main problem I have with the Google code is that it is html encoded e.g.

<embed style="width:400px; height:326px;" id="VideoPlayback" align="middle" type="application/x-shockwave-flash" src="encoded url" allowScriptAccess="sameDomain" quality="best" bgcolor="#ffffff" scale="noScale" wmode="window" salign="TL" > </embed>

Won't this be flagged as 'illegal' unless the check is taken out? If the check is taken out a malicious user could post html even if its disabled.

Indeed, this will be a possible cross-site-scripting weakness...
The way I circumvented this at oxle, was by using the linkshrinker to store the "http://video.google.com/googleplayer.swf?videoUrl=encodedurl" part in a seperate db (the linkshrinker db), and use the linkshrinker-url as input url for the embedded flash object.
Seems to work, at least on the vid.asp page, but requires some sort of seperate db and forwarder function, if it was to be used outside oxle and without the linkshrinker functionality... <

portfolio - linkshrinker - oxle - twitter

Edited by - MarcelG on 24 February 2006 13:51:07
Go to Top of Page

-gary
Development Team Member

406 Posts

Posted - 24 February 2006 :  14:02:41  Show Profile  Reply with Quote
I've seen some large forums stop allowing even image links to sites that use question marks in URLs because of successful XSS attacks.<

KawiForums.com


Go to Top of Page

Podge
Support Moderator

Ireland
3775 Posts

Posted - 24 February 2006 :  14:52:17  Show Profile  Send Podge an ICQ Message  Send Podge a Yahoo! Message  Reply with Quote
If I use a regex to extract the google url to the video, urldecode it then it might pass the check.

This is the regex I'm using (vb). It should only match Google urls so if someone links to a non google url nothing will happen.
Problem arises again if they alter the google url querystring. If it passes the check though it should be ok, correct ?

objRegExpr.Pattern = "(http):\/\/video\.google\.com+([\w\-\.,@?^=%&:/~\+#]*[\w\-\@?^=%&/~\+#])?"<

Podge.

The Hunger Site - Click to donate free food | My Blog | Snitz 3.4.05 AutoInstall (Beta!)

My Mods: CAPTCHA Mod | GateKeeper Mod
Tutorial: Enable subscriptions on your board

Warning: The post above or below may contain nuts.
Go to Top of Page

Podge
Support Moderator

Ireland
3775 Posts

Posted - 24 February 2006 :  20:20:23  Show Profile  Send Podge an ICQ Message  Send Podge a Yahoo! Message  Reply with Quote
Small typo in vid.asp
The following is correct


	'done with quicktime, now the youTube files   
	
	elseif lcase(request.querystring("t"))="y" or lcase(left(FileToShow,26)) = "http://www.youtube.com/?v=" then
	if request.querystring("h")<>"" and IsNumeric(request.querystring("h")) = true then
		intHeight = request.querystring("h")
	else
		intHeight = 395
	end if
	if request.querystring("w")<>"" and IsNumeric(request.querystring("w")) = true then
		intWidth = request.querystring("w")
	else
		intWidth = 480
	end if
	Response.Write	"<font face=""" & strDefaultFontFace & """ size=""" & strFooterFontSize & """><nobr>Please wait while the youTube video loads!</nobr></font></td>" & vbNewLine & _
			"</tr><tr>" & vbNewLine  & vbNewLine & _
			"<td valign=""top"" align=""middle"" bgcolor=""" & strCategoryCellColor & """ colspan=""1"">" & vbNewLine & _
			"<script language=""javascript"">EmbedTubeVideo(""" & FileToShow & """," & intWidth & "," & intHeight & ",""false"");</script>"
	
	'done with youTube, now the flash files


I'll post the Google Video code tomorrow. Its nearly finished.<

Podge.

The Hunger Site - Click to donate free food | My Blog | Snitz 3.4.05 AutoInstall (Beta!)

My Mods: CAPTCHA Mod | GateKeeper Mod
Tutorial: Enable subscriptions on your board

Warning: The post above or below may contain nuts.

Edited by - Podge on 24 February 2006 20:20:50
Go to Top of Page

ILLHILL
Junior Member

Netherlands
341 Posts

Posted - 24 February 2006 :  21:56:48  Show Profile  Reply with Quote
Because people are going to ask for posting icons:


I'm not too happy with the youtube icon, but it's a start

Greets, Dominic<

Edited by - ILLHILL on 24 February 2006 21:58:18
Go to Top of Page

Karel Bata
Junior Member

United Kingdom
122 Posts

Posted - 25 February 2006 :  07:50:00  Show Profile  Visit Karel Bata's Homepage  Reply with Quote
Or buttons?



Howsabout this for media?

or this?

<


Edited by - Karel Bata on 25 February 2006 09:00:02
Go to Top of Page

ILLHILL
Junior Member

Netherlands
341 Posts

Posted - 25 February 2006 :  08:04:29  Show Profile  Reply with Quote
I meant posting buttons indeed, but I read icons and somehow that slipped in. lol
I forgot I have different buttons than the original ones.<

CLPPR.com - All The News Only Seconds Away
Go to Top of Page

MarcelG
Retired Support Moderator

Netherlands
2625 Posts

Posted - 25 February 2006 :  10:26:06  Show Profile  Visit MarcelG's Homepage  Reply with Quote
Podge, I guess that if your regexp checks the consistency of the URL, it would be rather safe.
As long as there aren't any ', " and < or > in it, it would be safe if I'm not mistaking.

About the buttons: nice ones!!! I like the postingbuttons, but we forgot the audio button (the wma code, used for all audio playable with the windows media player)<

portfolio - linkshrinker - oxle - twitter

Edited by - MarcelG on 25 February 2006 10:27:13
Go to Top of Page

Podge
Support Moderator

Ireland
3775 Posts

Posted - 25 February 2006 :  10:59:49  Show Profile  Send Podge an ICQ Message  Send Podge a Yahoo! Message  Reply with Quote
The regex extracts the url including the querystrings, I then check that string (instead of fString) and its gets passed to the Javascript function if it passes (and it does). At the moment I'm still getting the function right and you will have to test it for me afterwards. I have it working in a post but there is a problem with vid.asp. The Google url is partially url encoded when passed to vid.asp and gets chopped off.

Nice buttons / icons. One thing though. Don't we need two Windows Media icons? One for audio and one for video? A Google Video icon / button would be cool too.<

Podge.

The Hunger Site - Click to donate free food | My Blog | Snitz 3.4.05 AutoInstall (Beta!)

My Mods: CAPTCHA Mod | GateKeeper Mod
Tutorial: Enable subscriptions on your board

Warning: The post above or below may contain nuts.
Go to Top of Page

ILLHILL
Junior Member

Netherlands
341 Posts

Posted - 25 February 2006 :  17:36:37  Show Profile  Reply with Quote
Bumped into something.
When you try to edit a topic/reply containing flash, the edit field shows this:

[flash" SRC="LinkToFlashFile.swf" HIDDEN="false" AUTOSTART="true" LOOP="true" volume="100"></EMBED>

<

CLPPR.com - All The News Only Seconds Away
Go to Top of Page

Karel Bata
Junior Member

United Kingdom
122 Posts

Posted - 25 February 2006 :  18:50:33  Show Profile  Visit Karel Bata's Homepage  Reply with Quote

Tough call on the buttons.

There are no specific Yahoo Video, or Windows audio logos (that I know of)

What about these? The speaker could work for all audio files. This mod would be brilliant for sites dealing with music!


So far...




    Quote: When you try to edit a topic/reply containing flash, the edit field shows this:
    [flash" SRC="LinkToFlashFile.swf" HIDDEN="false" AUTOSTART="true" LOOP="true" volume="100"></EMBED>
...and that is precisely why I'm going to be looking for someone else to play host to my forum. I wouldn't know where to begin fixing a bug like that.

<

Edited by - Karel Bata on 26 February 2006 05:30:48
Go to Top of Page

Podge
Support Moderator

Ireland
3775 Posts

Posted - 27 February 2006 :  11:33:30  Show Profile  Send Podge an ICQ Message  Send Podge a Yahoo! Message  Reply with Quote
Nice icons, Karel. Shouldn't it be Google Video? Haven't heard of Yahoo video.

I hope to get some work done this evening.<

Podge.

The Hunger Site - Click to donate free food | My Blog | Snitz 3.4.05 AutoInstall (Beta!)

My Mods: CAPTCHA Mod | GateKeeper Mod
Tutorial: Enable subscriptions on your board

Warning: The post above or below may contain nuts.
Go to Top of Page
Page: of 17 Previous Topic Topic Next Topic  
Previous Page | Next Page
 New Topic  Reply to Topic
 Printer Friendly
Jump To:
Snitz Forums 2000 © 2000-2021 Snitz™ Communications Go To Top Of Page
This page was generated in 0.27 seconds. Powered By: Snitz Forums 2000 Version 3.4.07