This short tutorial explains the some of the security issues involved with loading swfs into the main timeline from an external server over the Internet.
Add a Cross Domain policy on the root directory your server. Use the System.security.allowDomain() function to allow external swf files from a specified folder to access functions and variables in the main application timeline.
The files included in the loadingExternal.zip are as following:
loader.fla & swf : Main application
Swf to be placed on the mobile in the Others dir.
content.fla & swf : External Content File
Swf To be placed on the server.
----------------------------------------------------------------------------------------------
Quick word on Cross Domain Policies
Although it is not necessary for the purpose of
this tutorial, it is a good idea to have a cross - domain policy
located on the root directory of your server. This is a xml file
containing the following code, named as crossdomain.xml:
<!–THIS FILE ALLOWS FLASH TO COMMUNICATE WITH FILES ON YOUR SERVER –>
<!– http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=tn_14213 –>
<cross-domain-policy>
<allow-access-from domain=”*”/>
</cross-domain-policy>
You will find that if your application etc is trying to access data
from an external XML file or data source, with out this the player will
not grant access. As this example does not contain any xml or external
data sources (barring the externally loaded swf), you don’t need to do
this, but i strongly recommend it in case you incorporate XML into your
apps at a later date, and spend hours pulling out your hair because it
won’t load the data .
For more info on this subject, see Allowing cross-domain data loading in the flash CS3 help files.
Allowing Externally loaded SWF’s to access main SWF timeline Variables/functions
Although in effect it is only really one line of code you need to
add, i have created a small application to highlight the impact of it.
The simple loader.swf application is loaded by the user on the
mobile phone. Once opened, the user clicks select/enter to load in the
external content in a empty movieclip on the stage (holder_mc) from the
server using the phones internet connection. The user can then browse
the content on the handset, while still inside the loader application.
If this is done without allowing the domain in the System.security
class, the content.swf will still load into the holder_mc, but it will
not be able to access any variables/functions etc which have be setup
on the main (_root) timeline. This can be very restrictive, obviously,
and stops any dynamic functionality between the 2 movies.
by adding the following line of code into the first timeline frame of the Loader.swf, you solve this problem
System.security.allowDomain(”http://www.yourdomain.com/external/content/folder/”);
this will allow any external swf files loaded in from www.yourdomain.com/external/content/folder/ to access functions and variables in the main loader.swf’s timeline.
To illustrate this, open loader.fla, and look at the code on frame 1 of the actions layer on the main timeline.
line 9 - 14 contains the following:
//–this is the line of code to allow the external swf to access vars/functions/etc from this timeline–//
// swap this for the location of your content.swf file, or leave to use the on located on my server. //
System.security.allowDomain(”http://www.outside-media.co.uk/blog/content/tutorials/”);
//****************************************************************//
With this code in place the app works perfectly.
Try commenting it out (add // in front of it), publishing it, then running it on your mobile to see the effect.
the first thing you’ll notice is that the text along the bottom bar
will still say loading.., as this is changed to “content Loaded” via
script located on the first frame of the actions layer of the
content.swf.
page 2 of the content.swf file now doesn’t show the name and number
variables as they are located within the loader.swf timeline. Job still
shows as this is a local variable loaded within the content.swf
timeline. Also, the simple equation on the 3rd page will not work as
the function that is run is setup on the loader timeline.
You’ll notice the navigation via the left and right keys still works
however, as the on(key.Press<>) events are located locally on the
key catcher button. If you had set up the navigation by using a
KeyListener, you might find problems unless you grant the domain access.
for more detailed info on this topic, see Allowing data access between cross-domain SWF files in the flash CS3 help files.
+