Avg. Rating 4.0

Problem

This short tutorial explains the some of the security issues involved with loading swfs into the main timeline from an external server over the Internet.

Solution

Add a Cross Domain policy on the root directory your server. Use the System.security.allowDomain() function to allow external swf files from a specified folder to access functions and variables in the main application timeline.

Detailed explanation

Sample files

Please click on this link — Tutorial Assets — to download the sample files I will be using. (zip format).

The files included in the loadingExternal.zip are as following:

loader.fla & swf  : Main application

Swf to be placed on the mobile in the Others dir.

content.fla & swf  : External Content File

Swf To be placed on the server.

----------------------------------------------------------------------------------------------

Quick word on Cross Domain Policies

Although it is not necessary for the purpose of this tutorial, it is a good idea to have a cross - domain policy located on the root directory of your server. This is a xml file containing the following code, named as crossdomain.xml:

<!–THIS FILE ALLOWS FLASH TO COMMUNICATE WITH FILES ON YOUR SERVER –>
<!– http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=tn_14213 –>
<cross-domain-policy>
<allow-access-from domain=”*”/>
</cross-domain-policy>

You will find that if your application etc is trying to access data from an external XML file or data source, with out this the player will not grant access. As this example does not contain any xml or external data sources (barring the externally loaded swf), you don’t need to do this, but i strongly recommend it in case you incorporate XML into your apps at a later date, and spend hours pulling out your hair because it won’t load the data .

For more info on this subject, see Allowing cross-domain data loading in the flash CS3 help files.

Allowing Externally loaded SWF’s to access main SWF timeline Variables/functions

Although in effect it is only really one line of code you need to add, i have created a small application to highlight the impact of it.

The simple loader.swf application is loaded by the user on the mobile phone. Once opened, the user clicks select/enter to load in the external content in a empty movieclip on the stage (holder_mc) from the server using the phones internet connection. The user can then browse the content on the handset, while still inside the loader application.

If this is done without allowing the domain in the System.security class, the content.swf will still load into the holder_mc, but it will not be able to access any variables/functions etc which have be setup on the main (_root) timeline. This can be very restrictive, obviously, and stops any dynamic functionality between the 2 movies.

by adding the following line of code into the first timeline frame of the Loader.swf, you solve this problem

System.security.allowDomain(”http://www.yourdomain.com/external/content/folder/”);

this will allow any external swf files loaded in from www.yourdomain.com/external/content/folder/ to access functions and variables in the main loader.swf’s timeline.

To illustrate this, open loader.fla, and look at the code on frame 1 of the actions layer on the main timeline.

line 9 - 14 contains the following:

//–this is the line of code to allow the external swf to access vars/functions/etc from this timeline–//

// swap this for the location of your content.swf file, or leave to use the on located on my server. //

System.security.allowDomain(”http://www.outside-media.co.uk/blog/content/tutorials/”);

//****************************************************************//

With this code in place the app works perfectly.

Try commenting it out (add // in front of it), publishing it, then running it on your mobile to see the effect.

the first thing you’ll notice is that the text along the bottom bar will still say loading.., as this is changed to “content Loaded” via script located on the first frame of the actions layer of the content.swf.

page 2 of the content.swf file now doesn’t show the name and number variables as they are located within the loader.swf timeline. Job still shows as this is a local variable loaded within the content.swf timeline. Also, the simple equation on the 3rd page will not work as the function that is run is setup on the loader timeline.

You’ll notice the navigation via the left and right keys still works however, as the on(key.Press<>) events are located locally on the key catcher button. If you had set up the navigation by using a KeyListener, you might find problems unless you grant the domain access.

for more detailed info on this topic, see Allowing data access between cross-domain SWF files in the flash CS3 help files.

Matt

+
This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Permissions beyond the scope of this license, pertaining to the examples of code included within this work are available at Adobe.

Report abuse

Related recipes