Acces control profile hole

Hi,

We use an access control profile to limit the viewing per domain. But if we change the resolution (flavors) a direct link appears in browser network log :

http://mydomain.com/api_v3/index.php?service=stats&apiVersion=3.1&expiry=86400&clientTag=kwidget%3Av2.38.1&format=1&ignoreNull=1&action=collect&event:eventType=17&event:clientVer=2.38.1&event:currentPoint=0&event:duration=11154.52&event:eventTimestamp=1453130496070&event:isFirstInSession=false&event:objectType=KalturaStatsEvent&event:partnerId=100&event:sessionId=5615765a-bcf0-da0a-3d73-8027980d080f&event:uiconfId=23448188&event:seek=false&event:entryId=0_eyyomq1h&event:widgetId=_100&event:referrer=http%3A%2F%2Fcleeng.com%2Fembed%2FR587818969_FR%3FdimWidth%3D640%26dimHeight%3D490&kalsig=d5f35315e4fd10553e3bf268da9d96b2

http://mydomain.com/p/100/sp/10000/serveFlavor/entryId/0_eyyomq1h/v/2/flavorId/0_rwpdu584/forceproxy/true/name/a.mp4

The first url is useless, but the second works fine instead of been blocked.

I did not find this issue elsewhere.

Regards

no one cares about this bug in access control profile ?

Hello,

Do you mean when you select a different flavour in the player? For me, flavour selection is blocked in such a case.
Can you provide a sample embed where you have the issue and an explanation as to what you mean about changing resolution? if you cannot provide direct access, please provide the uiconf config for your player and I’ll try to create the same locally.

HI,
It is difficult to give you a sample, we use access control profile to sell the video.

In our case, it is possible to change the flavours in the players, yes.

how do we get the uiconf config of the player ?

Hello,

Please connect to the DB and:
mysql> select * from ui_conf where id=$YOUR_UI_CONF_ID;
in my example:
conf_file_path: /content/generatedUiConf/23/454/ui_conf_23454739__2.xml
so what I need is the contents of:
/opt/kaltura/web//content/generatedUiConf/23/454/ui_conf_23454739__2.config.xml

I also need the values for tags and html5_url, so for instance:
tags: autodeploy, kms_v5.0.0, kms_kdp3,player,quiz_player,html5v2
html5_url: /html5/html5lib/v2.38.1/mwEmbedLoader.php

Then I can create the same player locally.

Thanks,

here the ui_conf file :

{
	"plugins": {
		"topBarContainer": {
			"plugin": true
		},
		"controlBarContainer": {
			"plugin": true
		},
		"scrubber": {
			"plugin": true
		},
		"largePlayBtn": {
			"plugin": true
		},
		"playHead": {
			"plugin": true
		},
		"playPauseBtn": {
			"plugin": true
		},
		"volumeControl": {
			"showSlider": true,
			"layout": "horizontal",
			"pinVolumeBar": false,
			"accessibleControls": false,
			"accessibleVolumeChange": 0.1,
			"plugin": true
		},
		"durationLabel": {
			"plugin": true
		},
		"currentTimeLabel": {
			"plugin": true
		},
		"keyboardShortcuts": {
			"volumePercentChange": "0.1",
			"shortSeekTime": "5",
			"longSeekTime": "10",
			"volumeUpKey": "38",
			"volumeDownKey": "40",
			"togglePlaybackKey": "32",
			"shortSeekBackKey": "37",
			"shortSeekForwardKey": "39",
			"openFullscreenKey": "70",
			"closeFullscreenkey": "27",
			"gotoBeginingKey": "36",
			"gotoEndKey": "35",
			"longSeekForwardKey": "ctrl+39",
			"longSeekBackKey": "ctrl+37",
			"percentageSeekKeys": "49,50,51,52,53,54,55,56,57",
			"plugin": true
		},
		"liveCore": {
			"plugin": true
		},
		"liveStatus": {
			"plugin": true
		},
		"liveBackBtn": {
			"plugin": true
		},
		"fullScreenBtn": {
			"plugin": true
		},
		"logo": {
			"href": "http://xxxx.fr",
			"title": "XXXX",
			"plugin": true,
			"img": "http://xxxx.fr/images/xxxx-Watermark.png"
		},
		"statistics": {
			"plugin": true
		},
		"sourceSelector": {
			"switchOnResize": false,
			"simpleFormat": true,
			"displayMode": "sizebitrate",
			"plugin": true
		},
		"googleAnalytics": {
			"plugin": true,
			"urchinCode": "UA-XXXXXX"
		}
	},
	"uiVars": [
		{
			"key": "autoPlay",
			"value": false,
			"overrideFlashvar": false
		},
		{
			"key": "autoMute",
			"value": false,
			"overrideFlashvar": false
		},
		{
			"key": "enableTooltips",
			"value": true,
			"overrideFlashvar": false
		},
		{
			"key": "adsOnReplay",
			"value": true,
			"overrideFlashvar": false
		}
	],
	"layout": {
		"skin": "kdark"
	}
}

We’d check for tags in the video and the player, we didn’t find them. Where must we look for ?
We have 28 mwEmbedLoader.php files, how to know which one is in use ?

Hi @Frat,

The tags and html5_url are columns in the ui_conf table.

Thanks,

hi, and thx for the help.

here the tags and html5_url :
tags : html5studio,player
html5_url : /html5/html5lib/v2.38.1/mwEmbedLoader.php

regards,

Hi @Frat,

I’m afraid I could not reproduce it. I created a player based on your JSON config, with the same exact version - v2.38.1 and the player is entirely dysfunctional.
It displays a dialog with "Unauthorized Country"
and all the widgets are disabled.

I blocked this entry from viewing from France so you can take a look:

Thanks,

Hi,
yes I agree, the video is blocked from France. But I can ask a canadian friend to send me an url of this video :
"http://cfvod.kaltura.com/scf/pd/p/1829791/sp/182979100/serveFlavor/entryId/1_ddrwr3yz/v/1/flavorId/1_tbrro965/name/a.mp4?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cDovL2Nmdm9kLmthbHR1cmEuY29tL3NjZi9wZC9wLzE4Mjk3OTEvc3AvMTgyOTc5MTAwL3NlcnZlRmxhdm9yL2VudHJ5SWQvMV9kZHJ3cjN5ei92LzEvZmxhdm9ySWQvMV90YnJybzk2NS9uYW1lLyoiLCJDb25kaXRpb24iOnsiRGF0ZUxlc3NUaGFuIjp7IkFXUzpFcG9jaFRpbWUiOjE0NTQ2ODY4OTl9fX1dfQ__&Signature=QJh6k6o4B8mVpjN0lfVuE6QqjfMgyJTmXJIKyF7Nnf8fZABk8J5Ot3o0eRZ9e50CqkCyOTyFuTWi3CXz51YHrZAmxI8GmIZC8jPcXzyYgUQdb31yvQ3WR5mSl14HrzNOUzz~FOOl37C7RAV26UbW~WiLOGdIDo-UnYtAbe9jhby9xolyLXMfBgZGS5KmxA0zr8OsUn7XfU0RjrOSqqcb5F9iu~-0hcg05vWAlPVsv9dawlyfv-M2d7zw398tEMbHKQC78evtmR8XJJr2FDv7U8FyD96mN7VG2ZpWA8ZSF4nXHuRz9w2U0jhB9ai8kfaMtSV8ldmISNiWP7ERkvr5EQ__&Key-Pair-Id=APKAJT6QIWSKVYK3V34A "
and I can see the video from france.
I’ve get this url in the network log of my browser (I’ve use a canadian vpn). And yes I need someone who can see the video to get it.

Regards,

Hi @Frat,

Yes, this is as designed. Geo blocking will not prevent someone with a direct link to the video from downloading it.
If you want to achieve that, you can use encryption and tokens. If you use a token with a very short window, it will help protect your content from being downloaded directly by the URL being sent to someone else.
You might also want to consider a DRM mechanism, which we do offer in our SaaS.

Hi,
ok, it came from of a missunderstanding of access control profile.

thank you.