Playing Flash and Media Files Inline

Is it possible? Is there any security issue? I am thinking of releasing this hack, but I am not sure about the demands and security issue on this.

History:

Originally, I have window media files played directly (inline) in phpbb. When I moved to vb, I tried to seek help from vb.com to modify their attachment system without success. I understand that Vb's attachment system for security purpose. Therefore, I have to find other means to achieve what I want. I come up with this hack when my board is at its infancy stage. It probably still is infancy because, it is used as a test and fun board when I am at work .


Requirement:

This hack might not work on all system due to different configuration, platform, and such. I will try to help you all as much as I can.

This hack will use your board attachment system to run mp3, wma, wmv, flash files. It is a bit server intensive. So be warned


Security Risk:

It has been known that flash files can be used to exploit and compromise certain securities on user computer. You might want to verify your flash attachment before enable flash playing inline on your forum.

Enut with the blah blah ??

Open your functions_showthread.php

Find

PHP Code:

function construct_postbit($post, $maintemplatename = 'postbit', $alternate = '')
{ 


Add under

PHP Code:

// flash attachment
    global $flashid,$flashfilename,$flashextension,$flashfilenameandlocation,$flashfilesize;

// wma attachment
    global $wmaid,$wmafilename,$wmaextension,$wmafilenameandlocation,$wmafilesize;
    // wmv attachment
    global $wmvid,$wmvfilename,$wmvextension,$wmvfilenameandlocation,$wmvfilesize;    
    // mp3 attachment
    global $mp3id,$mp3filename,$mp3extension,$mp3filenameandlocation,$mp3filesize;
//default media tag
    $media_controller= "$vboptions[bburl]/attachment.php?attachmentid="; 


Find

PHP Code:

$attachment['filename'] = fetch_censored_text(htmlspecialchars_uni($attachment['filename']));
            $attachment['attachmentextension'] = strtolower(file_extension($attachment['filename']));
            $attachment['filesize'] = vb_number_format($attachment['filesize'], 1, true); 


Add Under

PHP Code:

//flash attachment
            $flashfilename=$attachment['filename'];                            
            $flashextension=$attachment['attachmentextension'];                            
            $flashfilesize=$attachment['filesize'];                            
            $flashid=$post['userid'];                            
            $flashfilenameandlocation=$media_controller . $attachmentid  ;
            //wma attachment
            $wmaid=$post['userid'];
            $wmafilename=$attachment['filename'];
            $wmaextension=$attachment['attachmentextension'];                                        
            $wmafilenameandlocation=$media_controller . $attachmentid  ;            
            $wmafilesize=$attachment['filesize'];            
            //wmv attachment
            $wmvid=$post['userid'];
            $wmvfilename=$attachment['filename'];
            $wmvextension=$attachment['attachmentextension'];                            
            $wmvfilenameandlocation=$media_controller . $attachmentid  ;            
            $wmvfilesize=$attachment['filesize'];            
            //wmv attachment
            $mp3id=$post['userid'];
            $mp3filename=$attachment['filename'];
            $mp3extension=$attachment['attachmentextension'];
            $mp3filenameandlocation=$media_controller . $attachmentid  ;
            $mp3filesize=$attachment['filesize']; 


Find

PHP Code:


eval('$post[\'imageattachmentlinks\'] .= "' . fetch_template('postbit_attachment') . '";');
                            $show['imageattachmentlink'] = true;
                        }
                        break; 


Add Under

PHP Code:


case 'swf':
                        eval('$post[\'flashattachments\'] .= "' . fetch_template('postbit_attachmentflash') . '";');                        
                        $show['flashattachment'] = true;                        
                    break;    
                    
                    case 'wma':
                        eval('$post[\'wmaattachments\'] .= "' . fetch_template('postbit_attachmentwma') . '";');                        
                        $show['wmaattachment'] = true;                        
                    break;    
                    
                    case 'wmv':
                        eval('$post[\'wmvattachments\'] .= "' . fetch_template('postbit_attachmentwmv') . '";');                        
                        $show['wmvattachment'] = true;                        
                    break;    
                    
                    case 'mp3':
                        eval('$post[\'mp3attachments\'] .= "' . fetch_template('postbit_attachmentmp3') . '";');                        
                        $show['mp3attachment'] = true;                        
                    break; 


GLOBAL Phrases:

Var: attach_wmv
Text: Window Media Video

Var: attach_mp3
Text: MPEG-1 layer 3 Audio Encoding :

Var: attached_flash
Text: Attached Flash File:

Var :attach_wma
Text : Window Media Audio :

Templates:

Go to your Postbit template

Find

					$post[imageattachments]
					</div>
				</fieldset>
			</if>

Add Under

<if condition="$show[flashattachment]">
<fieldset class="fieldset">
<legend>$vbphrase[attached_flash] $flashfilename </legend>

<div style="padding:$stylevar[formspacer]px">
$post[flashattachments]
</div>
</fieldset>

</if>



<if condition="$show[wmaattachment]">
<fieldset class="fieldset">
<legend>$vbphrase[attach_wma] $wmafilename</legend>

<div style="padding:$stylevar[formspacer]px">
$post[wmaattachments]
</div>
</fieldset>

</if>

<if condition="$show[wmvattachment]">
<fieldset class="fieldset">
<legend>$vbphrase[attach_wmv] $wmvfilename</legend>

<div style="padding:$stylevar[formspacer]px">
$post[wmvattachments]



</div>
</fieldset>

</if>
	
<if condition="$show[mp3attachment]">
<fieldset class="fieldset">
<legend>

$vbphrase[attach_mp3] $mp3filename</legend>

<div style="padding:$stylevar[formspacer]px">
$post[mp3attachments]

</div>
</fieldset>

</if>

Go to your board admin and add the templates under postbits.


The included templates file uses the existing templates on my board. Feel free to modified.


If you need help drop a line here or at www.aotrangmongmo.com

[Moya]

Ben,

Can I take a look at your working link?

tuanluu,

Can you show me the link please?

turksengel

I will work on this for a vb3.5 once my sever is back online

It is fried. It might take awhile for me to get it up and running.

Thanks

[tuanluu]

what link are u talking about?
the link to my site??
www.luuhoanggallery.com/forums

[Moya]

I register and check out a couple music thread. They all work. Show me the one that doesn't work. I will look into it for you .

[tuanluu]

the one that are show on my page are vbcode that I added b4 that I try to add your hack it does not thanks for your help....is your site back on yet?

[Moya]

Hi Tuan

I tried to upload a test file in mp3 but you have a 2mb limitation on your server.

I tried to upload a wma. This file type is not allowed.

Can you look into this for me!

Thanks

[tuanluu]

Okay I will try

[tuanluu]

Okay I just add wma extension and allow up to 9 mb everything should be fine now right

[Moya]

Originally Posted by tuanluu

Okay I just add wma extension and allow up to 9 mb everything should be fine now right

Uhmmmm this is what I get

 File Too Large. Exceeds PHP's limit of 2.00 MB.

You will need to increase the upload limitation in the php.ini on your server.

On the second thought, can you give me admin access to your files and forum admin pannel

[Borgs8472]

I'd use this hack if it was only avalible to admins/mods. (because I want my members to have other attachments still)

[tuanluu]

okay I will promote u to be admin okay