I have a dating site project and I need to provide to customers possibility to upload embed code with pleer from 3rd part services like:
https://soundcloud.com/
http://joxi.ru/EA4zBRLsDloDzm
<iframe width="100%" height="450" scrolling="no" frameborder="no" src="https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/239151794&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false&visual=true"></iframe>
http://pleer.com/
http://joxi.ru/L21zEK6s6kR8RA
<object width="578" height="31"><param name="movie" value="http://embed.pleer.com/small/track?id=B2nq55Bgri8xfBumq&t=grey"></param><embed src="http://embed.pleer.com/small/track?id=B2nq55Bgri8xfBumq&t=grey" type="application/x-shockwave-flash" width="578" height="31"></embed></object><br> <small>Cкачать Linkin Park - Numb бесплатно на pleer.com</small>
e.t.c.
So any customer should be able to add embed pleer code from any(or most) 3rd part sound services. Now question - how can I create it secure way?
Or maybe someone can provide solution with validation for most popular services?
So customer fill some code and I need some way to validate is it real sound and is this code protected from injections.
Thanks!
Related
If I wanted to auto-click a button element in ifarme how would I go about this working ?
function autoclick() {
document.getElementById('u_0_4').contentWindow.document.getElementById("u_0_5").click()
}
<div onload="autoclick()" >
<iframe src="https://www.facebook.com/plugins/like.php?href=https%3A%2F%2Fweb.facebook.com%2FMaherZain&width=450&layout=standard&action=like&size=small&show_faces=true&share=true&height=80&appId=788255487990117" width="450" height="80" style="border:none;overflow:hidden" scrolling="no" frameborder="0" allowTransparency="true" id="u_0_4" ></iframe>
</div>
=====> if have any other way for do that please tell me :(
You cannot do that because otherwise people would just embed a 1x1 iframe and have every visitor "Like" whatever the author wanted. It's a security issue to let different origins have access to the contentWindow of iframes pointing to a different origin.
Imagine if you were able to do that. People could just start embedding gmail or your banking website in a 1x1 iframe and then trigger a few clicks and keyboard events to reset your password.
I would like to simply ask if anyone can help me identify the issue with my code.
I am trying to display a dynamic google maps to simply show the location of every event in my website.
I did some research on it and google kindly gave this code from here:
<iframe width="450" height="250" frameborder="0" style="border:0" src="https://www.google.com/maps/embed/v1/search?key=API_KEY&q=record+stores+in+Seattle">
And then modified to suit my needs.
<iframe width="700" height="350" frameborder="0" style="border:0" src="https://www.google.com/maps/embed/v1/**MODE**?key=**API_KEY**&q=<?php echo $row['location'];"></iframe>
Now I have put the mode as search and put my developer's API key as well. I assume that q="location"
But in the end when I click on the page it only displays the map showing the whole world:
Image of Error
and as you can see I have Location: 123 Clarance Street, Sydney, New South Wales, Australia
which I've basically did is:
Location: <?php echo $row['location']?>
I've also tried:
<iframe width="450" height="250" frameborder="0" style="border:0" src="https://www.google.com/maps/embed/v1/search?key=API_KEY&q=123+Clarence+Street,+Sydney,+New+South+Wales,+Australia">
Just to test if there was something wrong with the PHP code. So at the moment Im stumped and don't know where to look as a lot of the things people are asking online and their solutions didn't help me in my solution.
I'm sure it could be something minor, but just hoping someone out there can help me out. Thanks in advance.
I have been trying ot hunt this down all afternoon, Im pretty new to all this and am building my first site with php
what Im trying to do is I have a google maps embed code stored in a Db which I have assigned to a variable $map, I want to inject the embed code into an existing div.
So basically a click here for map. I may be way off on what I can do here.
Im sure there is a fancier way to do this but Im just learning and trying something simple.
Sorry if this is something that is obvious.
I have no code to show as i have murdered it and it is an unhelpful mess now.
If the page has already been served to the user, you'll need to use javascript to update the div, or reload the page. I jQuery's .post method to dynamically refresh divs with using AJAX. Info at http://api.jquery.com/jQuery.post/.
I use the following code on my website, which sounds similar to what you're trying to do, but in my case, I'm passing the address to the embed code in the $addresssubjectfullgoogle variable:
<iframe width="100%"
height="350"
frameborder="1"
scrolling="no"
marginheight="0"
marginwidth="0" src="
https://maps.google.com/?f=q&t=h&ie=UTF8&output=embed&q=<?php echo $addresssubjectfullgoogle;?>&z=18&ll=<?php echo $addresssubjectfullgoogle;?>&ie=UTF8">
</iframe>
I suspect that you could do something similar except that in your case, the same could might look something like this:
<iframe width="100%"
height="350"
frameborder="1"
scrolling="no"
marginheight="0"
marginwidth="0" src="<?php echo $map;?>">
</iframe>
I hope that's helpful.
I am allowing users to embed videos on their page, but just in case I want to filter the output. To present the video I retrieve the embed statement from the database but when it is filtered, it is presented in raw code. Is there a video friendly way to filter something like this or does anyone have any suggestions on a different way to do it? Thanks in advance for any advice.
while ($row = $query->fetch(PDO::FETCH_ASSOC)) {
$video= htmlspecialchars( $row['video'], ENT_NOQUOTES, 'UTF-8' );
}
echo "$video";
In the database, the video will look like this for example
<object width="464" height="368" id="669545" type="application/x-shockwave-flash"
classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" alt="Aqua Teen Hunger Force - Hand Banana Funny
Videos"><param name="movie" value="http://embed.break.com/NjY5NTQ1"></param><param
name="allowScriptAccess" value="always"></param><embed src="http://embed.break.com/NjY5NTQ1"
type="application/x-shockwave-flash" allowScriptAccess=always width="464" height="368"></embed></
object><br><font size=1><a href="http://www.break.com/usercontent/2009/2/Aqua-Teen-Hunger-Force-Hand-
Banana-669545.html" target="_blank">Aqua Teen Hunger Force - Hand Banana</a> - Watch more <a href="http://
www.break.com" target="_blank">Funny Videos</a></font>
In general you should be htmlspecialchars()ing user-input at the point you insert it into HTML. But in this case you already have HTML, so there's nothing much you can do.
You can't usefully filter embedded plugins. If you are allowing users to specify an arbitrary Flash file or other plugin, you have already effectively given them free cross-site-scripting access into your security context, and no amount of string sanitisation will fix that.
If you really need to allow users to submit arbitrary Flash or other <object>/<embed> code, you will need to host that untrusted code in a separate security context. Typically, you put the main site on www.example.com, and include an <iframe> to stuff.example.com which spits out the untrusted <object> code. Then when the plugin code tries to do something hostile, at least it can only affect stuff.example.com and not any of your real webapp on www.example.com.
Alternatively, you could only allow users to post video content from providers you trust, eg. youtube.com. You then just let them submit a YouTube video ID, and build up the <object> code yourself to point to the URL for that ID.
I asked a question in this link;
Streaming music background
function music(){
$txt = '<object type="application/x-shockwave-flash"
data="http://***.com/slim.swf?&autoplay=true&repeat=true&shuffle=true&song_url=http: //***.com/music.mp3&"
width="200" height="20">
<param name="movie"
value="http://***.com/slim.swf?&autoplay=true&repeat=true&shuffle=true& song_url=http://***.com/music.mp3&" />
<img src="noflash.gif"
width="0" height="0" alt="" />
</object>';
echo $txt;
}
I have added this player with a simple php fonction. The player is working perfect but when page changes, the music restarts. I want that I will be continued.
What is wrong in code?
Update: Ah, so you are in fact using a player with an autoresume function. Well, then turn on the autoresume, will ya?
By default, autoresume is off. To turn it on, you need to add &autoresume=1 to the end of the player URL, as shown here: [...]
Old answer:
I'm afraid I think you got this wrong. The answerer in the other question was talking about creating a whole site in Flash, something that would enable you to have continuous background music.
It's not easy to get continuous music on a HTML page. Check out this question for some pointers.