Link to home
Start Free TrialLog in
Avatar of luigidenaro
luigidenaro

asked on

Read flash variable from external domain with javascript

Dear Experts,

Anyone know if it's possible to avoid flash sandbox security to read a variable inside an swf from a javascript?

I don't need to pass the variable from flash to javascript calling some function, I need to directly read a variable inside flash using flash_object.GetVariable("myvariable");

More details:
I have the following.
A Swf file called test.swf with just this two lines:
line 1: var test="12345";
line 2: stop();

then I have a test_readflashvar.js file on the same site with just the flash object code that is written through document.write
and a javascript function testing() that tries to read variable test inside swf.
I have a timer that execute it every x secs.

function write_flash_object(url) {
 //code that write my flash object to document
}

function testing() {
    var o = getFlashMovieObject("flashobj"); //function that search for flash object
    if (o==null || o.PercentLoaded()<100) return;

    alert(o.GetVariable("j"));

    return;
}

Then I add the script to any of my websites (different domain where is located the swf file) <script src="http://target_domain/test_readflashvar.js"></script>

And when I load the page with the included script,  and it executes and the line alert(o.GetVariable("j")); I get the unspecified javascript error (=security access error).

Can anyone give a hint to overpass flash sandbox security control?

Regards,
Luigi.
Avatar of smaccari
smaccari

The problem is on javascript side i think.
In JS you cannot access any variable/object/function if they are not on the same domain (through an iframe for example).
That's a browser security issue.
Maybe this apply too on flash objects if not on same domain than the script.
Avatar of luigidenaro

ASKER

It's a flash plugin security issue, I know, but maybe someone knows an alternative way to overpass it.
Well, after trying and trying I found the solution.
Using this directive on main flash it avoid security restrictions for any domain.

System.security.allowDomain("*");
If u want to allow just a domain then is so simply like replacing the * for a domain in the way http://www.domain.com

The problem on this is that the swf remains exposed for external hacking.
ASKER CERTIFIED SOLUTION
Avatar of GranMod
GranMod

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial