-
Improvement
-
Resolution: Fixed
-
Minor
-
3.6, 3.7
-
MOODLE_36_STABLE, MOODLE_37_STABLE
-
MOODLE_37_STABLE
-
MDL-64281-master -
There are several cases where we need to embed (via iframes) the Moodle site on the app:
- Vimeo restricted videos (so the Referer of the request to Vimeo servers come from the site)
- When using custom embedded menu items
- When someone using the h5p module embed an activity
etc...
Right now, the only way to make those frames to work on the app is having the allowframeembedding setting enabled, but this may be risky on some situations and some admins don't enable it so the mobile experience is very poor.
To solve this, we must allow frame embedding for requests coming from the app. There is an easy way to do this, we can use the UserAgent header in the original request (as part of the UserAgent the word MoodleMobile is always present).
This should be super safe, because the UserAgent header is not writable via Javascript (can be changed only using a Chrome extension or using your own browser)