Changeset 3735366

Timestamp:

10/08/2026 06:52:12 PM (2 weeks ago)

Author:

videowhisper

Message:

Fix public HTML5 Videochat visitor sessions

Location:

videowhisper-live-streaming-integration/trunk

Files:

• inc/h5videochat.php (modified) (4 diffs)
• readme.txt (modified) (1 diff)
• videowhisper_streaming.php (modified) (1 diff)

videowhisper-live-streaming-integration/trunk/inc/h5videochat.php

@@ -638 +638 @@
 
             static function videowhisper_h5vls_app( $atts ) {
+            // Each page render contains a newly generated session credential.
+            // Shared page caches must not replay that configuration to another visitor.
+            if ( ! defined( 'DONOTCACHEPAGE' ) ) {
+                define( 'DONOTCACHEPAGE', true );
+            }
+            nocache_headers();
+
             // Shortcode: HTML5 Videochat
             $stream  = '';
@@ -859 +866 @@
             }
     
-            $ajaxurl   = admin_url() . 'admin-ajax.php?action=h5vls_app'; //wp ajax server
+            $ajaxurl   = self::h5vls_ajax_url(); // public WordPress AJAX endpoint
             $serverURL2 = plugins_url('videowhisper-live-streaming-integration/server/') ; //fast server
             
@@ -1070 +1077 @@
 //app functions
 
+                static function h5vls_ajax_url() {
+                        // admin_url() can point to a protected backend subdirectory when the
+                        // public site and the WordPress admin installation use different URLs.
+                        return add_query_arg( 'action', 'h5vls_app', home_url( '/wp-admin/admin-ajax.php' ) );
+                }
+
                 // ! user sessions vw_vmls_sessions
                 static function sessionKey( $session, $broadcaster = false ) {
@@ -1719 +1732 @@
                     'actionFullscreen' => true,
                     'actionFullpage'   => false,
-                    'serverURL'        => $ajaxurl = admin_url() . 'admin-ajax.php?action=h5vls_app', //for uploads
+                    'serverURL'        => self::h5vls_ajax_url(), //for uploads
                             'nonce'            => wp_create_nonce( 'h5vls_app_' . $sessionID ),
                     'serverURL2'           => plugins_url('videowhisper-live-streaming-integration/server/'), //fast server for translations

videowhisper-live-streaming-integration/trunk/readme.txt

@@ -199 +199 @@
 
 == Changelog ==
+
+= 7.3.6 =
+* Security: Prevent page caches from reusing per-session HTML5 Videochat configuration.
+
+= 7.3.5 =
+* Fix: Use the public WordPress AJAX URL for HTML5 Videochat sessions, including anonymous viewers on sites with a separate admin directory.
 
 = 7.3.4 =

videowhisper-live-streaming-integration/trunk/videowhisper_streaming.php

@@ -4 +4 @@
 Plugin URI: https://broadcastlivevideo.com/
 Description: <strong>Broadcast Live Video / HTML5 Live Streaming : WebRTC, HLS, RTSP, RTMP</strong> solution powers a turnkey live streaming channels site including web based webcam broadcasting app and player with chat, support for external apps, 24/7 RTSP ip cameras, WebRTC, video playlist scheduler, video archiving VOD, mobile live streaming support including chat, membership and access control, pay per view channels and tips/gifts for broadcasters. <a href='https://consult.videowhisper.com/?topic=Live-Streaming'>Contact Support</a> | <a href='admin.php?page=live-streaming&tab=setup'>Setup</a>
-Version: 7.3.4
+Version: 7.3.6
 Author: VideoWhisper.com
 Author URI: https://videowhisper.com/