Skip to main content

IE Security Warning with QuickTime Object tags

By Will Beattie

 

I just received a bug report about the infamous Internet Explorer Security Warning for one of the pages in our application that serves video content over HTTPS.

iesecuritywarning

 

After viewing the source I found the offender which turned out to be the codebase attribute set to http://www.apple.com/qtactivex/qtplugin.cab.

<object id="videoObject" classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" 
            codebase="http://www.apple.com/qtactivex/qtplugin.cab" 
            width="330" height="292"> 
            <param name="src" value="https://securedomain/video.mp4" /> 
            <param name="controller" value="true" /> 
            <param name="autoplay" value="False" /> 
            <param name="scale" value="aspect" /> 
            <param name="cache" value="true"/>
            <param name="saveembedtags" value="true"/>
            <param name="postdomevents" value="true"/> 
               
            <!--[if IE] --> 
            <EMBED name="movie"
                height="292"
                width="330"
                scale="aspect"
                src="https://securedomain/video.mp4"
                type="video/quicktime"
                pluginspage="www.apple.com/quicktime/download"
                controller="true"
                autoplay="False"
            /> 
            <!--[endif]--> 
        </object>

The fix was just to change this to https. https://www.apple.com/qtactivex/qtplugin.cab. 

<object id="videoObject" classid="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" 
            codebase="https://www.apple.com/qtactivex/qtplugin.cab" 
            width="330" height="292"> 
            <param name="src" value="https://securedomain/video.mp4" /> 
            <param name="controller" value="true" /> 
            <param name="autoplay" value="False" /> 
            <param name="scale" value="aspect" /> 
            <param name="cache" value="true"/>
            <param name="saveembedtags" value="true"/>
            <param name="postdomevents" value="true"/> 
               
            <!--[if IE] --> 
            <EMBED name="movie"
                height="292"
                width="330"
                scale="aspect"
                src="https://securedomain/video.mp4"
                type="video/quicktime"
                pluginspage="www.apple.com/quicktime/download"
                controller="true"
                autoplay="False"
            /> 
            <!--[endif]--> 
        </object>

Fortunately our users have the option of choosing the HTML5 Video player meaning they don’t need to install any 3rd party plugins to view videos.

Labels:

Comments

  1. mary Brown27 October 2019 at 14:23

    I am glad that I saw this post. It is informative blog for us and we need this type of blog thanks for share this blog, Keep posting such instructional blogs and I am looking forward for your future posts.
    Cyber Security Projects for Final Year

    JavaScript Training in Chennai

    Project Centers in Chennai

    JavaScript Training in Chennai

    ReplyDelete

Post a comment

Popular posts from this blog

Freeing Disk Space on C:\ Windows Server 2008

By Will Beattie
  I just spent the last little while trying to clear space on our servers in order to install .NET 4.5 . Decided to post so my future self can find the information when I next have to do this. I performed all the usual tasks: Deleting any files/folders from C:\windows\temp and C:\Users\%UserName%\AppData\Local\Temp Delete all EventViewer logs Save to another Disk if you want to keep them Remove any unused programs, e.g. Firefox Remove anything in C:\inetpub\logs Remove any file/folders C:\Windows\System32\LogFiles Remove any file/folders from C:\Users\%UserName%\Downloads Remove any file/folders able to be removed from C:\Users\%UserName%\Desktop Remove any file/folders able to be removed from C:\Users\%UserName%\My Documents Stop Windows Update service and remove all files/folders from C:\Windows\SoftwareDistribution Deleting an Event Logs Run COMPCLN.exe Move the Virtual Memory file to another disk However this wasn’t enough & I found the most space was
454 comments
Read more

CPF Contribution Rates for new Singapore Permanent Residents (SPR’s)

By Will Beattie
Recently my wife and I applied and got approved for Singapore Permanent Residency. After completing the formalities the most significant immediate change is the contribution to CPF which is Singapore’s mandatory social security savings scheme requiring contributions from employers and employees. CPF contributions start from the date you obtain SPR status, which is the date of the entry permit.   Being a relentless budgeter I needed to know exactly how much I and my employer would have to contribute so that I could adjust my budget accordingly as the employee contributions get deducted from the monthly salary. After doing some research I discovered that there is a “graduated” approach to CPF contributions for new SPR’s where the contributions gradually increase in the first and second year and then upon reaching the third year are at the full amount. Note: There is an option for employers to contribute the full amount for year 1 and year 2 and the employee can use the graduated ra
288 comments
Read more

Populating Duplicate Fields with DocuSign's REST API

By Will Beattie
If you're using DocuSign's REST API for integrating e-Signing into your application then it's possible you'll come up against the issue of duplicate fields not populating. This is when you have the same field with the same label e.g. Company Name in multiple places on the Document but you only want to send a single label, value instance to the API and have it populate in all places where the field is. When you pass the label and value like so: { label: "company_name", value: "Blogger.com" } If you have the field company_name more than once in the document then only the first field will be populated. After a lot of digging into the DocuSign documentation I discovered the solution is to append "\\*" to the label name: { label: "\\*company_name", value: "Blogger.com" } Why this isn't the default behaviour is beyond me but the solution works as expected. DocuSign Rest API Documentation
95 comments
Read more