Skip to content

verify 1.2.0, cmi5 1.1.0, embed 1.1.1

Choose a tag to compare

View all tags
@alekswebnet alekswebnet released this 23 Oct 12:44
verify-v1.2.0
5fe5c45

@missing-elements/h5p-verify 1.2.0, @missing-elements/h5p-cmi5 1.1.0 and @missing-elements/h5p-embed 1.1.1. The player stays at 1.1.1, the runtime and the libraries at 1.0.0, and the normalizer at 1.1.0.

A package address is played only as http or https (#72)

The embed page and startCmi5 now resolve the package address they are given and hand it to the element only as an http or https URL. Any other address plays nothing:

  • The embed page refuses a src= with any other scheme, with "The package address is not an http or https URL." It posts the refusal to the embedding page as an error with code: 'refused', like its other refusals. Before, a data: URL was taken for another site's package and played untrusted.
  • startCmi5 takes the package from the src option, the launch URL's ?src= or launchParameters, and resolves it against the page's address. An address with any other scheme raises the new unsafe-src event, as unsafe-return-url does for the return address, and the next source is tried. session.src is now the absolute address the element was given.

Neither could run script before: the element fetches its src and never navigates to it. The pages now refuse such an address outright, with a message, instead of relying on that.

cmi5 is a minor because unsafe-src is new in Cmi5Event. A switch over the events with no default branch has to handle it.

h5p-verify --preview: the package in the real player, in your browser (#70)

The check says whether a package starts. Whether it is right, a person judges by playing it. --preview checks nothing: it opens the package in the real player in your default browser, served from your computer.

npx @missing-elements/h5p-verify@latest course.h5p --preview
  • Any content type the player plays, with the same player, runtime and library sources as the check. --untrusted, --libraries and --no-refresh-libraries mean what they mean for the check.
  • A large video starts at once. The package is served with Range, as a static host serves it, so nothing is read whole or extracted to disk.
  • It ends by itself, ten seconds after its last tab closes, so an agent can start it in the background and leave it. Ctrl+C ends it too.
  • --no-open prints the address instead of opening a browser.
  • The check's own options, such as --out or --json, are refused with --preview rather than ignored. Exit code 2 means the preview could not start.

Also in 1.2.0: given a folder instead of a .h5p, the check stops with Not a file: <path>.

Upgrading

  • An embed site: write it again with npx @missing-elements/h5p-embed@latest <folder> --force, and deploy it. A site gets the new page only when it is written again.
  • cmi5: update @missing-elements/h5p-cmi5, and handle unsafe-src if you switch over the events without a default branch.
  • The verifier: npx @missing-elements/h5p-verify@latest runs 1.2.0.

Full Changelog: v1.1.1...verify-v1.2.0

Assets 2
Loading