Skip to content
Browse files

MDL-28486 Force use of SSL for all youtube and vimeo embeds

If a page is served over SSL (https), then any content loaded from non-SSL
sources (e.g. http://youtube.com/) will cause errors to show in the
browser. To prevent this, it's best to use the SSL equivelants where they
exist (e.g. https://youtube.com/).

Unfortunately, it isn't possible to accurately determine whether the
current page is loaded over an SSL connection or not in Moodle.

Since including content from an external SSL site on a non-SSL moodle page
does not lead to browser warnings, but non-SSL external content on an SSL
moodle page does, we always use SSL where available.

Note: This does not lead to any additional processing requirements for the
moodle site.
  • Loading branch information...
1 parent 42b60b2 commit feddb588ec2f2255a7363d7cc00eca18ac9fde5f @andrewnicols andrewnicols committed
Showing with 10 additions and 17 deletions.
  1. +10 −17 lib/medialib.php
View
27 lib/medialib.php
@@ -493,7 +493,7 @@ protected function embed_external(moodle_url $url, $name, $width, $height, $opti
$output = <<<OET
<span class="mediaplugin mediaplugin_vimeo">
-<iframe title="$info" src="http://player.vimeo.com/video/$videoid"
+<iframe title="$info" src="https://player.vimeo.com/video/$videoid"
width="$width" height="$height" frameborder="0"></iframe>
</span>
OET;
@@ -503,7 +503,7 @@ protected function embed_external(moodle_url $url, $name, $width, $height, $opti
protected function get_regex() {
// Initial part of link.
- $start = '~^http://vimeo\.com/';
+ $start = '~^https?://vimeo\.com/';
// Middle bit: either watch?v= or v/.
$middle = '([0-9]+)';
return $start . $middle . core_media_player_external::END_LINK_REGEX_PART;
@@ -538,14 +538,17 @@ protected function embed_external(moodle_url $url, $name, $width, $height, $opti
self::pick_video_size($width, $height);
return <<<OET
+<span class="mediaplugin mediaplugin_youtube">
<iframe title="$info" width="$width" height="$height"
- src="$site/embed/$videoid?rel=0&wmode=transparent" frameborder="0" allowfullscreen></iframe>
+ src="https://$site/embed/$videoid?rel=0&wmode=transparent" frameborder="0" allowfullscreen="1"></iframe>
+</span>
OET;
+
}
protected function get_regex() {
// Initial part of link.
- $start = '~^(https?://www\.youtube(-nocookie)?\.com)/';
+ $start = '~^https?://(www\.youtube(-nocookie)?\.com)/';
// Middle bit: either watch?v= or v/.
$middle = '(?:watch\?v=|v/)([a-z0-9\-_]+)';
return $start . $middle . core_media_player_external::END_LINK_REGEX_PART;
@@ -588,26 +591,16 @@ protected function embed_external(moodle_url $url, $name, $width, $height, $opti
self::pick_video_size($width, $height);
- // TODO: iframe HTML 5 video not implemented and object does not work
- // on iOS devices.
- $fallback = core_media_player::PLACEHOLDER;
- $output = <<<OET
+ return <<<OET
<span class="mediaplugin mediaplugin_youtube">
-<object title="$info" type="application/x-shockwave-flash"
- data="$site/p/$playlist&amp;fs=1&amp;rel=0" width="$width" height="$height">
- <param name="movie" value="$site/v/$playlist&amp;fs=1&amp;rel=0" />
- <param name="FlashVars" value="playerMode=embedded" />
- <param name="allowFullScreen" value="true" />
-$fallback</object>
+<iframe width="$width" height="$height" src="https://$site/embed/videoseries?list=$playlist" frameborder="0" allowfullscreen="1"></iframe>
</span>
OET;
-
- return $output;
}
protected function get_regex() {
// Initial part of link.
- $start = '~^(https?://www\.youtube(-nocookie)?\.com)/';
+ $start = '~^https?://(www\.youtube(-nocookie)?\.com)/';
// Middle bit: either view_play_list?p= or p/ (doesn't work on youtube) or playlist?list=.
$middle = '(?:view_play_list\?p=|p/|playlist\?list=)([a-z0-9\-_]+)';
return $start . $middle . core_media_player_external::END_LINK_REGEX_PART;

0 comments on commit feddb58

Please sign in to comment.
Something went wrong with that request. Please try again.