Player.js: Private and domain limited video from Pro account plays in api demo

[bortraws]

Expected Behavior
Private and domain locked video should not play in api demo page.

Actual Behavior
Any private and domain embed locked video plays when id pasted in https://player.vimeo.com/api/demo

Steps to reproduce
Paste any private and domain locked id into the ID field of api demo page

This should be a top priority for a fix

[bdougherty]

We have a fix ready. Since this is a security issue that qualifies for a bounty, I'd encourage you to submit a report to our HackerOne page if you have an account there.

[bortraws]

Thanks,

Will await the fix.

I don't have an acount at HackerOne but will have a look.

[bortraws]

Reported the issue at HackerOne

[ccampbell]

Thanks for the report. This should be resolved now.

[bortraws]

Great, thanks!!

[bortraws]

One more problem unfortunately.

It is fixed. Private and domain locked video's don't play anymore on the new api's demo player page. Unfortunately they now also won't play on our own domain. The player gives the same error on our domain as it does on the api demo player page "_Hey there, to play your video here, change its privacy settings so it can be embedded on: player.vimeo.com_".

Please advise, as this is currently delaying the rollout of some of our new pages for new products.

Thanks in advance for your support!

[ccampbell]

@bortraws can you provide a sample video that is not working so we can take a look?

[bortraws]

@ccampbell

The pages on which we embed the videos are behind an account. I have created a temporary account for you. If you can tell me where to send the details I'll do that right away. Or if I could create a private message that would be okay too.

All our videos worked fine in our implementation of the new Vimeo player API until the security problem in the api player demo page was fixed. We get the exact same error on our pages as on the api player demo page.

I have created a screenshot of each page and the error it gives.

screenshot of vimeo api demo page

screenshot of page on our website

Let me know if you want to have the account and a link to the page or whether this message gives you enough info to continue.

Thanks!

[bortraws]

@ccampbell

By the way, here's a video ID if that's all you wanted 158354911

[ccampbell]

@bortraws can you write to [email protected] and link to this ticket and say you spoke to craig and hopefully they will pass it along.

I tested and domain level privacy is definitely working so I suspect something else might be going on. It's also fishy that it's asking you to allow player.vimeo.com as the domain which means whatever is loading the player thinks the referrer is player.vimeo.com instead of your domain.

[bortraws]

Hi ccampbell,

Thanks for the swift response.

Could it have something to do with SSL (https)? Our site has aan SSL certificate.

I will send an e-mail to [email protected] and mention your name. What's the exact ticket number though? I only have the number of this issue (#41). Is that it?

Thanks Craig

[bortraws]

I sent an e-mail with a link to this issue nr. #41.

Thanks!

[ccampbell]

Hi @bortraws. I have looked into this and it is a bug we have to fix on our end. Right now when making a loadVideo call we lose the referrer of the parent page so it ends up being player.vimeo.com. This used to work cause player.vimeo.com was whitelisted. Therefore as a result of fixing the security issue you reported to us, this use case no longer works 😞

Unfortunately I can't provide a specific timeline to you for a fix, but we will try to get to it soon. In the meantime, as a workaround you can either

• Remove the domain restrictions on these videos (probably not an option for you since you have a login in front)
• Use the player.js API to create a new Vimeo.Player object and swap the player div out on your page
• Manually reset the iframe source to the next video URL, but that won't entirely work due to #7. I believe you could reattach a Vimeo.Player object to the new frame

[bortraws]

Hi Craig,

Thanks for the details and sincere message.

Unfortunately then there's nothing left to do for us but wait for the fix. We put some decent time in developing our pages around this new api and its new functions. So not an option of doing something over with the froogaloop api. I'll have a look at the last two workarounds you mentioned. See if those allow us to still release the product in time.

Looking forward to the fix.

Kind regards,
Rob

[ccampbell]

@bortraws, one other workaround is actually adding “player.vimeo.com” as one of the allowed domains for your videos

[bortraws]

Haha, yeah that's an idea.

We're back where we started ;) but at least we can continue the release.

Thanks Craig!

[ccampbell]

@bortraws I just deployed a fix and I believe this should now be working :smile:

[bortraws]

Hi Craig,

Iit is indeed working again and private videos won't play on the api player demo page.

We're very happy.

Thanks for your support!!

[ccampbell]

Glad to hear it!