Macromedia Flash Server - Embedded swf referrer?

Author

Embedded swf referrer?

Kevin Wong

2006-03-23, 8:47 pm

Is there a way to tell the url of the html page where a swf is being embedded? Firefox does send the referrer when requesting the swf but IE does not. Is there a way to get the referrer in all circumstances? With actionscript, it seems like you can only g
et the url of the swf and not necessarily the url of where it is embedded. Any ideas and thoughts would be appreciated.

Thanks
Kevin
________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

Simon Lord

2006-03-23, 8:47 pm

My flash pages are fed by PHP. So, I make use of the following PHP
function which is stored in a common lib I include in all my PHP
pages (see below).

In my template file (html + php variables) I have the following
(you'll need to read between the lines a little)...

<param name="movie" value="{site_url}/images/siteheader.swf?thePath=<?
php echo COM_getCurrentURL(); ?>" />
<embed src="{site_url}/images/siteheader.swf?thePath=<?php echo
COM_getCurrentURL(); ?>" />

.... here's the php function COM_getCurrentURL(); which I'm calling
above (COM_getCurrentURL returns the full path to the current
location). It's the only way I've been able to get flash to know the
url to its location. You may need to modify this to suit your needs.

/**
* Try to figure out our current URL, including all parameters.
*
* This is an ugly hack since there's no single variable that returns
what
* we want and the variables used here may not be available on all
servers
* and / or setups.
*
* Seems to work on Apache (1.3.x and 2.x), IIS, and Zeus ...
*
* @return string complete URL, e.g. 'http://www.example.com/
blah.php?foo=bar'
*
*/
function COM_getCurrentURL()
{
global $_CONF, $HTTP_SERVER_VARS;

$thisUrl = '';

if( empty( $HTTP_SERVER_VARS['SCRIPT_URI'] ))
{
if( !empty( $HTTP_SERVER_VARS['DOCUMENT_URI'] ))
{
$thisUrl = $HTTP_SERVER_VARS['DOCUMENT_URI'];
}
}
else
{
$thisUrl = $HTTP_SERVER_VARS['SCRIPT_URI'];
}
if( !empty( $thisUrl ) && !empty( $HTTP_SERVER_VARS
['QUERY_STRING'] ))
{
$thisUrl .= '?' . $HTTP_SERVER_VARS['QUERY_STRING'];
}
if( empty( $thisUrl ))
{
$requestUri = $HTTP_SERVER_VARS['REQUEST_URI'];
if( empty( $HTTP_SERVER_VARS['REQUEST_URI'] ))
{
// on a Zeus webserver, prefer PATH_INFO over SCRIPT_NAME
if( empty( $HTTP_SERVER_VARS['PATH_INFO'] ))
{
$requestUri = $HTTP_SERVER_VARS['SCRIPT_NAME'];
}
else
{
$requestUri = $HTTP_SERVER_VARS['PATH_INFO'];
}
if( !empty( $HTTP_SERVER_VARS['QUERY_STRING'] ))
{
$requestUri .= '?' . $HTTP_SERVER_VARS['QUERY_STRING'];
}
}

$firstslash = strpos( $_CONF['site_url'], '/' );
if( $firstslash === false )
{
// special case - assume it's okay
$thisUrl = $_CONF['site_url'] . $requestUri;
}
else if( $firstslash + 1 == strrpos( $_CONF['site_url'], '/' ))
{
// site is in the document root
$thisUrl = $_CONF['site_url'] . $requestUri;
}
else
{
// extract server name first
$pos = strpos( $_CONF['site_url'], '/', $firstslash + 2 );
$thisUrl = substr( $_CONF['site_url'], 0, $pos ) .
$requestUri;
}
}

return $thisUrl;
}

On Mar 22, 2006, at 7:06 PM, Kevin Wong wrote:

> Is there a way to tell the url of the html page where a swf is
> being embedded? Firefox does send the referrer when requesting the
> swf but IE does not. Is there a way to get the referrer in all
> circumstances? With actionscript, it seems like you can only get
> the url of the swf and not necessarily the url of where it is
> embedded. Any ideas and thoughts would be appreciated.
>
> Thanks
> Kevin
> ________________________________________
_______
> FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
> To change your subscription options or search the archive:
> http://chattyfig.figleaf.com/mailman/listinfo/flashcomm
>
> Brought to you by Fig Leaf Software
> Premier Authorized Adobe Consulting and Training
> http://www.figleaf.com
> http://training.figleaf.com

________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

Jim Duber

2006-03-23, 8:47 pm

Simon,

Have you tested how this works within the context of "hot linking" (aka
"bandwith hogging") whereby a rogue site links to your swf via a fully
qualified URL? In other words, the path to the swf file in the code
params and embed tag is set something like:

src = "http://yourwebsite.com/yourpath/your.swf

Does your php function block such unauthorized access?

Thanks very much,

Jim

On Mar 22, 2006, at 4:22 PM, Simon Lord wrote:

> My flash pages are fed by PHP. So, I make use of the following PHP
> function which is stored in a common lib I include in all my php pages
> (see below).
>
> In my template file (html + php variables) I have the following
> (you'll need to read between the lines a little)...
>
> <param name="movie"
> value="{site_url}/images/siteheader.swf?thePath=<?php echo
> COM_getCurrentURL(); ?>" />
> <embed src="{site_url}/images/siteheader.swf?thePath=<?php echo
> COM_getCurrentURL(); ?>" />
>
> ... here's the php function COM_getCurrentURL(); which I'm calling
> above (COM_getCurrentURL returns the full path to the current
> location). It's the only way I've been able to get flash to know the
> url to its location. You may need to modify this to suit your needs.
>
> /**
> * Try to figure out our current URL, including all parameters.
> *
> * This is an ugly hack since there's no single variable that returns
> what
> * we want and the variables used here may not be available on all
> servers
> * and / or setups.
> *
> * Seems to work on Apache (1.3.x and 2.x), IIS, and Zeus ...
> *
> * @return string complete URL, e.g.
> 'http://www.example.com/blah.php?foo=bar'
> *
> */
> function COM_getCurrentURL()
> {
> global $_CONF, $HTTP_SERVER_VARS;
>
> $thisUrl = '';
>
> if( empty( $HTTP_SERVER_VARS['SCRIPT_URI'] ))
> {
> if( !empty( $HTTP_SERVER_VARS['DOCUMENT_URI'] ))
> {
> $thisUrl = $HTTP_SERVER_VARS['DOCUMENT_URI'];
> }
> }
> else
> {
> $thisUrl = $HTTP_SERVER_VARS['SCRIPT_URI'];
> }
> if( !empty( $thisUrl ) && !empty(
> $HTTP_SERVER_VARS['QUERY_STRING'] ))
> {
> $thisUrl .= '?' . $HTTP_SERVER_VARS['QUERY_STRING'];
> }
> if( empty( $thisUrl ))
> {
> $requestUri = $HTTP_SERVER_VARS['REQUEST_URI'];
> if( empty( $HTTP_SERVER_VARS['REQUEST_URI'] ))
> {
> // on a Zeus webserver, prefer PATH_INFO over SCRIPT_NAME
> if( empty( $HTTP_SERVER_VARS['PATH_INFO'] ))
> {
> $requestUri = $HTTP_SERVER_VARS['SCRIPT_NAME'];
> }
> else
> {
> $requestUri = $HTTP_SERVER_VARS['PATH_INFO'];
> }
> if( !empty( $HTTP_SERVER_VARS['QUERY_STRING'] ))
> {
> $requestUri .= '?' . $HTTP_SERVER_VARS['QUERY_STRING'];
> }
> }
>
> $firstslash = strpos( $_CONF['site_url'], '/' );
> if( $firstslash === false )
> {
> // special case - assume it's okay
> $thisUrl = $_CONF['site_url'] . $requestUri;
> }
> else if( $firstslash + 1 == strrpos( $_CONF['site_url'], '/' ))
> {
> // site is in the document root
> $thisUrl = $_CONF['site_url'] . $requestUri;
> }
> else
> {
> // extract server name first
> $pos = strpos( $_CONF['site_url'], '/', $firstslash + 2 );
> $thisUrl = substr( $_CONF['site_url'], 0, $pos ) .
> $requestUri;
> }
> }
>
> return $thisUrl;
> }
>
>
>
>
>
> On Mar 22, 2006, at 7:06 PM, Kevin Wong wrote:
>
>
> ________________________________________
_______
> FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
> To change your subscription options or search the archive:
> http://chattyfig.figleaf.com/mailman/listinfo/flashcomm
>
> Brought to you by Fig Leaf Software
> Premier Authorized Adobe Consulting and Training
> http://www.figleaf.com
> http://training.figleaf.com
>

________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

Jerry Chabolla

2006-03-23, 8:47 pm

Hey Kevin,

I've seen an article written by Danny Patterson where he check the location
with JavaScript and the new flash.external.ExternalInterface class.

This was the example code

-----------------------------
// In the html
<script language="JavaScript">
function getLocation() {
return window.location.toString();
}
</script>

// In your fla/swf
import flash.external.ExternalInterface;

function displayPageLocation():Void {
locationDisplay.text = ExternalInterface.call("getLocation");
}

locationButton.addEventListener("click", mx.utils.Delegate.create(this,
displayPageLocation));
-------------------------------

Here is the link to the article:
http://www.communitymx.com/abstract.cfm?cid=0922A

Jerry

-----Original Message-----
From: flashcomm-bounces-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
[mailto:flashcomm-bounces-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org] On Behalf Of Kevin Wong
Sent: Wednesday, March 22, 2006 4:07 PM
To: flashcomm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
Subject: [FlashComm] Embedded swf referrer?

Is there a way to tell the url of the html page where a swf is being
embedded? Firefox does send the referrer when requesting the swf but IE does
not. Is there a way to get the referrer in all circumstances? With
actionscript, it seems like you can only get the url of the swf and not
necessarily the url of where it is embedded. Any ideas and thoughts would be
appreciated.

Thanks
Kevin
________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

Simon Lord

2006-03-23, 8:47 pm

I run ZEUS on my webserver which has an option to deny hot-linking to
images, swf's etc. Pure magic, no idea how it works.

I don't run FMS publicly on the box anymore, but when I did it would
verify if you were logged into the domain as a member (also only
allowed connections from my domain).

On Mar 22, 2006, at 8:35 PM, Jim Duber wrote:

> Simon,
>
> Have you tested how this works within the context of "hot
> linking" (aka "bandwith hogging") whereby a rogue site links to
> your swf via a fully qualified URL? In other words, the path to the
> swf file in the code params and embed tag is set something like:
>
> src = "http://yourwebsite.com/yourpath/your.swf
>
> Does your php function block such unauthorized access?
>
> Thanks very much,
>
> Jim
>
>
> On Mar 22, 2006, at 4:22 PM, Simon Lord wrote:
>
>
> ________________________________________
_______
> FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
> To change your subscription options or search the archive:
> http://chattyfig.figleaf.com/mailman/listinfo/flashcomm
>
> Brought to you by Fig Leaf Software
> Premier Authorized Adobe Consulting and Training
> http://www.figleaf.com
> http://training.figleaf.com

________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

Jim Duber

2006-03-23, 8:47 pm

Thanks for the info, Simon.

In fact, the article that Jerry pointed to in his response solves the
issue--after minimal testing--for Flash 8 content via
ExternalInterface:

http://www.communitymx.com/abstract.cfm?cid=0922A

Thanks, Jerry!

All the best,
Jim

On Mar 22, 2006, at 6:40 PM, Simon Lord wrote:
[vbcol=seagreen]
> I run ZEUS on my webserver which has an option to deny hot-linking to
> images, swf's etc. Pure magic, no idea how it works.
>
> I don't run FMS publicly on the box anymore, but when I did it would
> verify if you were logged into the domain as a member (also only
> allowed connections from my domain).
>
>
> On Mar 22, 2006, at 8:35 PM, Jim Duber wrote:
>

<snip>

________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

Stefan Richter

2006-03-23, 8:47 pm

I haven't checked out the link but I think I could circumvent this method by
hotlinking the swf and then deploy this on my html page:

// In the html
<script language="JavaScript">
function getLocation() {
return "http://www.the_domain_the_swf_expects.com";
}
</script>

Stefan

> -----Original Message-----
> From: flashcomm-bounces-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
> [mailto:flashcomm-bounces-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org] On Behalf Of
> Jim Duber
> Sent: 23 March 2006 03:11
> To: FlashComm Mailing List
> Subject: Re: [FlashComm] Embedded swf referrer?
>
> Thanks for the info, Simon.
>
> In fact, the article that Jerry pointed to in his response
> solves the issue--after minimal testing--for Flash 8 content via
> ExternalInterface:
>
> http://www.communitymx.com/abstract.cfm?cid=0922A
>
> Thanks, Jerry!
>
> All the best,
> Jim
>
>

________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

Jim Duber

2006-03-23, 8:47 pm

Good point, Stefan. I just checked and you are soooooo
right....again.... ;^)

Thanks,
Jim

On Mar 23, 2006, at 12:05 AM, Stefan Richter wrote:

> I haven't checked out the link but I think I could circumvent this
> method by
> hotlinking the swf and then deploy this on my html page:
>
> // In the html
> <script language="JavaScript">
> function getLocation() {
> return "http://www.the_domain_the_swf_expects.com";
> }
> </script>
>
> Stefan
>
>
>
>
>
> ________________________________________
_______
> FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
> To change your subscription options or search the archive:
> http://chattyfig.figleaf.com/mailman/listinfo/flashcomm
>
> Brought to you by Fig Leaf Software
> Premier Authorized Adobe Consulting and Training
> http://www.figleaf.com
> http://training.figleaf.com
>

________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

andrew.lucking-EhxJCXIpbR04bPgdlwbF9EEOCMrvLtN

2006-03-23, 8:48 pm

Sorry to jump in here...

Would getting window.location from ExternalInterface directly be less
"circumvent-able"?
ExternalInterface.call("window.location.toString")

A.

|---------+--------------------------------------->
| | Jim Duber <jim-jjDRYJ2TO7cAvxtiuMwx3w@public.gmane.org> |
| | Sent by: |
| | flashcomm-bounces@chattyfig.|
| | figleaf.com |
| | |
| | |
| | 2006-03-23 10:49 AM |
| | Please respond to FlashComm |
| | Mailing List |
| | |
|---------+--------------------------------------->
>---------------------------------------------------------------------------------------------------------------|
| |
| To: FlashComm Mailing List <flashcomm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org> |
| cc: |
| Subject: Re: [FlashComm] Embedded swf referrer? |
>---------------------------------------------------------------------------------------------------------------|

Good point, Stefan. I just checked and you are soooooo
right....again.... ;^)

Thanks,
Jim

On Mar 23, 2006, at 12:05 AM, Stefan Richter wrote:

> I haven't checked out the link but I think I could circumvent this
> method by
> hotlinking the swf and then deploy this on my html page:
>
> // In the html
> <script language="JavaScript">
> function getLocation() {
> return "http://www.the_domain_the_swf_expects.com";
> }
> </script>
>
> Stefan
>
>
>
>
>
> ________________________________________
_______
> FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
> To change your subscription options or search the archive:
> http://chattyfig.figleaf.com/mailman/listinfo/flashcomm
>
> Brought to you by Fig Leaf Software
> Premier Authorized Adobe Consulting and Training
> http://www.figleaf.com
> http://training.figleaf.com
>

________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

Jayson K Hanes

2006-03-23, 8:48 pm

That should be more reliable and less likely to be thwarted.. But it
requires flash8=20

I'm sure there is a browser out there that it won't work with tho...

> -----Original Message-----
> From: flashcomm-bounces-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org=20
> [mailto:flashcomm-bounces-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org] On Behalf Of=20
> andrew.lucking-EhxJCXIpbR04bPgdlwbF9EEOCMrvLtNR@public.gmane.org
> Sent: Thursday, March 23, 2006 12:37 PM
> To: FlashComm Mailing List
> Subject: Re: [FlashComm] Embedded swf referrer?
>=20
>=20
> Sorry to jump in here...
>=20
> Would getting window.location from ExternalInterface directly=20
> be less "circumvent-able"?
> ExternalInterface.call("window.location.toString")
>=20
> A.
>=20
________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

Kevin Wong

2006-03-23, 8:48 pm

Thanks all for the great info. My problem has one additional twist. The page hosting the swf is not on one of my servers. In other words, the page with the actual embed tag referencing my swf is some MySpace page. I assume this because my apache log shows
the referer URL when the page loads the swf under Firefox. Unfortunately, no such referer is sent when a user gets my swf with IE. And since the swf is embedded on MySpace, I have no control nor ability to put Javascript on the page to get the document.l
ocation. Ideas?

Thanks in advance
Kevin

________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com

Alan Queen

2006-03-27, 11:57 pm

I have the same problem with myspace... they actuall change the
AllowScriptAccess param to "never" no matter what u set it to ;)

so using any type of external interface or getUrl tricks doesnt work
on that site..

On 3/23/06, Kevin Wong <kevingwong-/E1597aS9LQAvxtiuMwx3w@public.gmane.org> wrote:
> Thanks all for the great info. My problem has one additional twist. The p=
age hosting the swf is not on one of my servers. In other words, the page w=
ith the actual embed tag referencing my swf is some MySpace page. I assume =
this because my apache log shows the referer URL when the page loads the sw=
f under Firefox. Unfortunately, no such referer is sent when a user gets my=
swf with IE. And since the swf is embedded on MySpace, I have no control n=
or ability to put Javascript on the page to get the document.location. Idea=
s?
>
> Thanks in advance
> Kevin
>
> ________________________________________
_______
> FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
> To change your subscription options or search the archive:
> http://chattyfig.figleaf.com/mailman/listinfo/flashcomm
>
> Brought to you by Fig Leaf Software
> Premier Authorized Adobe Consulting and Training
> http://www.figleaf.com
> http://training.figleaf.com
>

--
- Alan Queen
________________________________________
_______
FlashComm-1Ss2GqJETD3yZ38Mhd3e/9ZfFG6BLHNm@public.gmane.org
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcomm

Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com