mahara-contributors team mailing list archive

[Aaron Wells <1567208@xxxxxxxxxxxxxxxxxx>]

I also tried disabling byte-ranges, and disabling cacheing, while
researching this bug, and neither of those had any affect on it.
Interestingly, disabling byte-ranges made many browsers unable to render
an MP4-H264 file rendered with the "Baseline" profile, while the exact
same file rendered with the "High" profile was viewable!

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1567208

Title:
  HTML5 videos on non-public pages can't play on LG Android 5.0 Chrome

Status in Mahara:
  Confirmed

Bug description:
  I noticed this bug when trying to play HTML5 videos from Mahara, in my
  phone (an LG G2 Mini, running ANdroid 5.0). Some videos worked fine;
  others showed up as a black box. That is, JSPlayer would load it as if
  the video's thumbnail was a black rectangle. It would show the "big
  play button" indicating ready to play, and clicking that would cause
  the player controls to display and then fade, as if a video was
  successfully playing. But the play bar wouldn't move forward, and no
  content would be displayed.

  After poring through the server logs, it appears that what is
  happening, is that Android Chrome doesn't actually request the media
  files itself. Instead, it delegates this to the OS's mediaplayer
  (called "stagefright" in stock Android), which makes the HTTP
  requests. In my phone, LG has replaced stagefright with its own
  program that has the user-agent "Player/LG Player 1.0 for ANdroid
  5.0.2 (stagefright alternative)"

  The bug appears to be that LG Player, when making these requests, does
  *not* use the cookies from the current browser session. So the request
  seems to be coming from a logged-out user. If the page of the video is
  not public, Mahara responds to the request for download.php with a 303
  redirect to the login page. The LG Player follows this redirect,
  receives the HTML from the login page, and hands it back to Chrome as
  if it were the video. Chrome then treats it as an invalid video file,
  hence the blacked out player.

  It seems there was a similar bug in stock Android (with Chrome and
  stagefright), which may have only applied to cookies that were set to
  "HttpOnly". See
  https://code.google.com/p/android/issues/detail?id=66050 . That bug
  was resolved over a year ago.

  We do use the "HttpOnly" flag on our session cookie in Mahara.
  However, this problem still occurred after I disabled HttpOnly, so it
  looks like this is a separate issue, probably a bug in the LG Player.
  (Which is not surprising, because phone manufacturers tend to be
  pretty lax on fixing bugs in their customized Android distributions.)

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1567208/+subscriptions