Below is an update on changes to support this plugin:
--------------
What I've done:
Under the assumption that we won't be able to rely on passing session cookies from flash I have built support for passing session ids in the urls into Harmoni, polyphony, and Segue.
In Harmoni:
- The harmoni config now allows specification of an array of actions that enable passing of session ids in the url.
- The url writer will allow the session id in the urls for these actions (strip it for others).
To prevent session fixation and hijacking attacks, when the session id is passed in the url, no Set-Cookie header is sent for that session id to prevent fixation on that session. While a user could be logged in with one session, be given a url with another session id (and have a file successfully loaded for that other session), their session cookies won't be modified.
In Polyphony:
- new file access actions:
repository/viewfile_flash.act.php
repository/viewthumbnail_flash.act.php
To prevent session fixation by giving a url to a user with an existing session id, allowing them to log in, then acting as them, these actions to not prompt for login (though they do check authorization based on current session state.
In Segue:
- new configuration for the polyphony file-access actions in harmoni_default.conf.php
- new methods in MediaFile:
getUrlForFlash()
getThumbnailUrlForFlash()
These are the methods you will be able to use in your plugin.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Would also be good if some of the audio player's runtime options could be exposed in the plugin gui for users to set and as parameters in the text-template version
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Logged In: YES
user_id=789554
Originator: YES
David has been working on this.
Below is an update on changes to support this plugin:
--------------
What I've done:
Under the assumption that we won't be able to rely on passing session cookies from flash I have built support for passing session ids in the urls into Harmoni, polyphony, and Segue.
In Harmoni:
- The harmoni config now allows specification of an array of actions that enable passing of session ids in the url.
- The url writer will allow the session id in the urls for these actions (strip it for others).
To prevent session fixation and hijacking attacks, when the session id is passed in the url, no Set-Cookie header is sent for that session id to prevent fixation on that session. While a user could be logged in with one session, be given a url with another session id (and have a file successfully loaded for that other session), their session cookies won't be modified.
In Polyphony:
- new file access actions:
repository/viewfile_flash.act.php
repository/viewthumbnail_flash.act.php
To prevent session fixation by giving a url to a user with an existing session id, allowing them to log in, then acting as them, these actions to not prompt for login (though they do check authorization based on current session state.
In Segue:
- new configuration for the polyphony file-access actions in harmoni_default.conf.php
- new methods in MediaFile:
getUrlForFlash()
getThumbnailUrlForFlash()
These are the methods you will be able to use in your plugin.
Logged In: YES
user_id=789554
Originator: YES
Audio Player plugin is now done for Segue 2.2.0.
Still need to do a video player, though the text-template somewhat lessens this need.
Would be good to have a text-template for the audio player plugin (like the video text-template) and a plugin for video (like the audio player plugin)
Audio/video plugins should allow users to choose media from the media library or put in a url to an media file.
Would be good if audio plugin could read ID3 tags from mp3 files and have an option to display ID3 tag info.
Would also be good if some of the audio player's runtime options could be exposed in the plugin gui for users to set and as parameters in the text-template version