mahara-contributors team mailing list archive

[Aaron Wells <1567208@xxxxxxxxxxxxxxxxxx>]

I tried changing the code so that it returned a "403 Forbidden" response
rather than a 303 to the login page, and that didn't make any
difference. I tried adding some content to the response ("You must be
logged in to view this file") to see if that would the browser aware it
was an invalid video file, but that didn't work. I tried changing the
mimetype to something nonsensical, and that didn't work either.

These all *did* work in other browsers. In fact, in other browsers, just
sending our current 303 redirect to the login page, followed by the
login page itself with its 200 OK response, triggered the browser to
correctly show a "Unsupported media type or network error" placeholder
instead of the black box.

So, it looks like there is not much I can do with this. The one
remaining option might be to instead return a small valid video file
that displays an error message in the video. But I think that would be
overkill. So I'm just going to change this one to "Won't Fix". It's a
problem in the operating system, and there's no easy way we can work
around it.

** Changed in: mahara
       Status: Confirmed => Won't Fix

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1567208

Title:
  HTML5 videos on non-public pages can't play on LG Android 5.0 Chrome

Status in Mahara:
  Won't Fix

Bug description:
  I noticed this bug when trying to play HTML5 videos from Mahara, in my
  phone (an LG G2 Mini, running ANdroid 5.0). Some videos worked fine;
  others showed up as a black box. That is, JSPlayer would load it as if
  the video's thumbnail was a black rectangle. It would show the "big
  play button" indicating ready to play, and clicking that would cause
  the player controls to display and then fade, as if a video was
  successfully playing. But the play bar wouldn't move forward, and no
  content would be displayed.

  After poring through the server logs, it appears that what is
  happening, is that Android Chrome doesn't actually request the media
  files itself. Instead, it delegates this to the OS's mediaplayer
  (called "stagefright" in stock Android), which makes the HTTP
  requests. In my phone, LG has replaced stagefright with its own
  program that has the user-agent "Player/LG Player 1.0 for ANdroid
  5.0.2 (stagefright alternative)"

  The bug appears to be that LG Player, when making these requests, does
  *not* use the cookies from the current browser session. So the request
  seems to be coming from a logged-out user. If the page of the video is
  not public, Mahara responds to the request for download.php with a 303
  redirect to the login page. The LG Player follows this redirect,
  receives the HTML from the login page, and hands it back to Chrome as
  if it were the video. Chrome then treats it as an invalid video file,
  hence the blacked out player.

  It seems there was a similar bug in stock Android (with Chrome and
  stagefright), which may have only applied to cookies that were set to
  "HttpOnly". See
  https://code.google.com/p/android/issues/detail?id=66050 . That bug
  was resolved over a year ago.

  We do use the "HttpOnly" flag on our session cookie in Mahara.
  However, this problem still occurred after I disabled HttpOnly, so it
  looks like this is a separate issue, probably a bug in the LG Player.
  (Which is not surprising, because phone manufacturers tend to be
  pretty lax on fixing bugs in their customized Android distributions.)

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1567208/+subscriptions