Just noticed Animoto plugin is no longer working. It prints out "Error retrieving video embed code." I've done a bit of tracing through the code, so far it looks like the following line (#159) in animoto.inc is returning a null.

$response = drupal_http_request($oembed_url);

The oembed_url construction still looks current to me with animoto's documentation, so I'm not sure what's going on. Anyone else having this issue? I'm just curious whether I should pursue debugging this as a code issue or as a server configuration issue.

Thanks,
Jon

CommentFileSizeAuthor
#2 media_animoto-2363861-2.patch994 byteszengenuity
#1 animoto.inc_.2363861.patch885 bytesjdegenova
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

jdegenova’s picture

jdegenova CreditAttribution: jdegenova commented
Assigned: Unassigned » jdegenova
Status: Active » Needs review
FileSize
animoto.inc_.2363861.patch885 bytes

A patch is attached which resolves the issue, at least for me. There are two changes. Animoto was returning a 301 redirect from the http to the https version of the API URL which was causing the embed link to not be returned. I changed EMVIDEO_ANIMOTO_OEMBED_BASE to reflect the use of https. The second change was related to the error message presented to the user when the embed code could not be retrieved. It now provides an alternate way for the website visitor to view the animoto video using a link, so at least if the embed code isn't being retrieved the user can still view the video.

zengenuity’s picture

zengenuity CreditAttribution: zengenuity commented
FileSize
media_animoto-2363861-2.patch994 bytes

You've introduced a XSS vulnerability in this patch. You can demo it by entering the following into the video URL field on a node:

"/></a><script>alert('p0wn3d!');</script>http://animoto.com/play/xxxxxxxxx

The attached patch should fix the problem. Please test it on your site and let me know if it works. Then, I'll commit it and roll a new version.

jdegenova’s picture

jdegenova CreditAttribution: jdegenova commented

Thank you for catching that! Yes, your latest patch works and correctly displays a link to the video on animoto if there is a problem getting the embed code.

I noticed one additional problem today when posting a new video. I'll include it here instead of opening a new issue because I believe it is all related to Animoto requiring HTTPS instead of HTTP. With the current code base, including this latest patch, when attempting to publish a new animoto video on Drupal you receive the error "You have specified an invalid media URL or embed code." if you use a link formatted as "https://animoto.com/play/...", but if you use "http://animoto.com/play/..." it publishes fine. In my testing, changing line 11 from:

define('EMVIDEO_ANIMOTO_PLAYER_PAGE_BASE', 'http://animoto.com/play/');

to

define('EMVIDEO_ANIMOTO_PLAYER_PAGE_BASE', 'https://animoto.com/play/');

resolves this problem.

  • zengenuity committed 7e3912c on 6.x-1.x 
    Issue #2363861 by jdegenova, zengenuity: Not working - Error retrieving...
zengenuity’s picture

zengenuity CreditAttribution: zengenuity commented
Status: Needs review » Fixed

Thanks. Rolled a new release with these changes: 6.x-1.4

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.