Let's go with a little bit of hacking for the masses. Adobe implementation of security relies in some cases on the crossdomain.xml file hosted at the server that holds the data. You can access that data, generally, with your browser, but you can't with the Flash Player if the crossdomain file doesn't allow you. Actionscript will throw a Sandbox violation error.
In many cases we want access to data that is available to us by other means but restricted to Flash by this file. In my case I was trying to access Google Geolocation API from actionscript:
http://maps.google.com/maps/geo?q=...
This is the content of http://maps.google.com/crossdomain.xml :
<site-control permitted-cross-domain-policies="by-content-type"/>
</cross-domain-policy>
I have yet to figure out if there is a workaround in actionscript, but I come across a nifty php that will let you overpass those crossdomain restrictions. Here it goes:
crossdomain-proxy.php
$post_data = $HTTP_RAW_POST_DATA;
$header[] = "Content-type: text/xml";
$header[] = "Content-length: ".strlen($post_data);
preg_match("/url=(.*)/",$_SERVER['REQUEST_URI'],$params);
$ch = curl_init( $params[1] );
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
if ( strlen($post_data)>0 ){
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
}
$response = curl_exec($ch);
if (curl_errno($ch)) {
print curl_error($ch);
} else {
curl_close($ch);
header("Content-type: text/xml; Content-length: ".strlen($response));
print $response;
}
?>
This code was extracted from Yoppa blog where he goes into detail explaining how to use it. In case your Japanese is rusty here's how it goes.
Instead of requesting the url:
we are going to request:
This bypasses the security error and retrieves the exact same content as the original url.
Now I have to admit that I don't understand every bit of code in that php file, but I checked it first to make sure that my server wasn't going to explode with it, and it works really well..
If I were you, I would restrict the calls to this php to my own domain only.
Just to make sure that those smart-ass hackers out there won't use my php's url to retrieve their content.
Recent Comments