Using Windows Media Player to play offline videos: Security RISK?

Using Windows Media Player to play offline videos: Security RISK?

by Frankie Kam -
Number of replies: 8
Picture of Plugin developers

Hi. I'd like to share an idea and code with other Moodlers.

How to play an offline video from a Moodle site in tandem with an online video like Youtube or Blip.tv. The advantage of this is the user has a choice of playing streaming video direct from the Internet or direct from the local hard disk.

My main worry is whether or not my implementation will cause any major security problems for the Moodle site. Will my Moodle site or local hard disk be heavily compromised? If so, what can I do to plug any security risks?

Here's my code. You can create a web page resource and just copy and paste the code in. My local video plays from the c:\videos folder(!). You can change the text introduceaskdotcom.wmv into some other video file name. Create a folder named videos in your PC's root C drive. Copy your video file into the folder and then test your moodle webpage link.


<p><span style="font-family: comic sans ms;" face="comic sans ms"> </span></p> <center><span style="font-family: comic sans ms;" face="comic sans ms"><center>
<h1>Video: Introducing Yourself</h1></center>
<table border="1" width="100%"><tbody>
<tr>
</tr>
<tr>
<td width="450" valign="top"><br /> <center>
<h2> Local Video</h2> </center>
</td>
<td width="*" valign="top"><br /> <center>
<h2> Online Video</h2></center>
</td>
</tr>
<tr>
<td width="450" valign="top"><br /> <center> <embed height="344" width="425" quality="low" src="C:\videos\introduceaskdotcom.wmv" controls="[object NPObject JS wrapper class]" autostart="false" /></center>
<p> </p>
</td>
<td width="*" valign="top"><br /> <center>
<object height="344" width="425"> <param name="movie" value="

;" /> <param name="allowFullScreen" value="true" /> <param name="allowscriptaccess" value="always" /> <param name="quality" value="low" />
<embed height="344" width="425" src="http://www.youtube.com/v/AA6f7kf4fto&hl=en&fs=1&" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" quality="low" />
</object></center>
</td>
</tr></tbody>
</table><b><br /></b></span></center><br />

Any comments on this will be greatly appreciated.

Frankie Kam
htp://scm.moodleace.com

Average of ratings: -
In reply to Frankie Kam

Re: Using Windows Media Player to play offline videos: Security RISK?

by Mark Johnson -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

Hi Frankie,

I'm not sure that this is a security risk, but I'm not sure that your idea is portable.

If you point the video to C:\videos\introduceaskdotcom.wmv, then users would only be able to view the video if they have that video in that location. This means that unless every user will be accessing he Moodle site from the same computer, they wont be able to view it (unless you've already got a solution in mind).

If you want to give users the option to view the video locally, you could upload the WMV file to moodle, have them download it and play it locally though Windows Media or whatever player they have.

Average of ratings: -
In reply to Mark Johnson

Re: Using Windows Media Player to play offline videos: Security RISK?

by Frankie Kam -
Picture of Plugin developers

Hi Mark.

Thanks for your reply. Yes, you're right! It's definitely not portable unless the user has the exact same video file (introduceaskdotcom.wmv) inside the very same folder ("c:\videos") inside his (or her) harddisk. For it to wor, the user has to copy the file inside his harddisk - and of course create the folder first.

What I do at my college is to copy all my course's relevant video files into all 22 PCs' c:\video folder. So when I have 22 students log onto the Moodle site, I do not have 22 streaming Youtube videos which would cripple our Broadband line, but rather, I have 22 videos playing direct from 22 PCs' local hard disk.

Students are able to move the slider to any part of the video. Also they no longer have to endure any lag or see Youtube's rotating circles (which indicates lagtime). So there is some method in my madness. wink

If my course were mature enough and I had all the relevant videos prepared (this has never ever happened - yet!) inside a CD-ROM, I could pass the CD-ROM to the student. The student then pops the CD-ROM into his or her PC, logs online to my Moodle site. Lo and behold! The student's slow dial-up or lagged Broadband is no longer a constraint because my code will allow the Moodle site to play the video direct from the student's CD-ROM drive.

This is one way to overcome Internet lag when it comes to streaming MP3s or video files. And students are always impatient when it comes to streaming videos - they (and I too) want the video to play straight-away.

As for portability, Linux and Mac users won't be able to play the video since "c:\videos" is a Windows-thing. But in my college all students use Windows. So in my college enviroment, there is no need to be that portable.

Frankie Kam

Average of ratings: -
In reply to Frankie Kam

Re: Using Windows Media Player to play offline videos: Security RISK?

by Ken Task -
Picture of Particularly helpful Moodlers

Granted, in lab situation, using the configured Windows PC's all would work and work nicely.  Besides 'other' desktop/laptop operating systems, what happens when/IF students begin to use personal devices smartphone/tablets?

Seems the current solution might have future limitations for students and will necessitate yet another solution.

'in the 'spirit of sharing',

Ken

Average of ratings: -
In reply to Ken Task

Re: Using Windows Media Player to play offline videos: Security RISK?

by Frankie Kam -
Picture of Plugin developers

Hi Ken.

>what happens when/IF students begin to use personal devices smartphone/tablets?
>

Sigh. The PC's days are numbered. Mobile E-Learning is already here.

> Seems the current solution might have future limitations for students and will necessitate yet another solution.

Yes you are absolutely correct. Different devices would mean that this code would no longer work on those machines, unless hardcoded specifically for them.

If there were a way for the
code src="C:\videos\introduceaskdotcom.wmv" to be replaced by some universal selector, I would be all ears. in the meantime, it will only benefit Windows users, I'm afraid.

For PC users, is there any way to make the code flexible enough to select the CD-ROM drive (E: ? F: ? D: ?) without allowing any access to a harddisk? I haven't found a solution yet, other than to tell the students to create a folder named videos inside their C drive, and then copy the video or mp3 files to that folder. So far NONE have done it. So this means that I would have to package that into an install executable so that just by clicking on the installer, the video and mp3 media files will get copied into the c"\videos folder. Just my thoughts on this.

Anyway, I think that the benefits outweigh the limitations provided students can use Windows-based PCs and follow the instructions of either using an installer or my manually creating a videos folder on their C drive.

Thanks for reading this.

Frankie Kam

Average of ratings: -
In reply to Frankie Kam

Re: Using Windows Media Player to play offline videos: Security RISK?

by Dusan Ristic -

For windows enviroment you could try to add another (unique) drive letter for storage device on all lab computers ie. letter Z or Y, something on the end of alphabet. In this case, when using cd-rom, you can mount it to a local directory on c: disk ie. create c:\cdrom and mount cd-rom to that dir.

You can easily do this in Control Panel -> Computer Managment -> Storage -> Disk managment - just right click on cd rom and change drive letters and paths, then add new mount point.

Since you are talking about students using this solution in local network, why not just upload videos to server? Or create a network drive to upload videos and use same drive letter when mapping it on lab PCs ?

We've started using phpmotion to upload video files to local server and embed it like youtube video on moodle pages. Still no feedback from students or teachers, although we have uploaded 100+ videos and added them to courses.

Only drawback is this could require greater bandwith. Still need time to see how will it perform.

Average of ratings: -
In reply to Dusan Ristic

Re: Using Windows Media Player to play offline videos: Security RISK?

by Frankie Kam -
Picture of Plugin developers

Hi Dusan

>add another (unique) drive letter for storage device on all lab computers ie. letter Z or Y, ...
>... Disk managment - just right click on cd rom and change drive letters and paths, then add new mount point.
>
Thanks. This is really helpful and extends the concept in the right direction.
Frankie Kam

Average of ratings: -
In reply to Frankie Kam

Re: Using Windows Media Player to play offline videos: Security RISK?

by Ian Webb -

Do you have the option of setting up a caching proxy? Videos should be easily cacheable and that way you can just embed the videos from Moodle regularly, it will work cross platform etc.


Squid in transparent caching proxy mode, for example, should work fine.

Average of ratings: -
In reply to Ian Webb

Re: Using Windows Media Player to play offline videos: Security RISK?

by Frankie Kam -
Picture of Plugin developers

Hi Ian.

Wow I heard of people using squid for its caching features, but I never thought it could be used to cache these type of videos. Great to hear that the transparent caching proxy mode...unfortunately, I think that setting up a Squid server is beyond me right now. The most I've got is to setup eAccelerator and Apache's mod_deflate to work on my site. That's taken a lot of energy and time from me. Maybe some other time in future. Thanks anyway.

Frankie Kam
P.S., where can I go to know how to setup a Squid Proxy?

Average of ratings: -