Has Cooqy solved MySpace Flash link blocking?
tagged cooqy, fantasyfestivals, flash, myspace, security and workaround
Peter Cashmore at Mashable is reporting that Cooqy has managed to bypass the recent MySpace Flash link blocking fix. Cooqy provides a Flash interface for searching and browsing eBay auctions and it would appear that their MySpace profile carries Flash widgets that (on my PowerBook at least, with Flash Player 9 installed) can successfully open new browser windows.
I’ve taken a quick squizz at the code and it seems that MySpace has not inserted the crucial allowNetworking=internal attribute into Cooqy’s widget embed code. Check it out:
<embed src="http://www.cooqy.com/cooqyMain.lzx?lzt=swf&debug=false&lzr=swf8" quality="high" scale="noscale" salign="lt" width="500" height="600" bgcolor="#ffffff" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" flashvars="server=http://www.cooqy.com&title=<i>Cooqy</i>"/>
So what’s different about Cooqy’s code and why has MySpace interpreted it differently? Well for a start they’re using Open Laszlo to power their site and to serve the widgets, just take a look at the src attribute above. Another thing that’s different is the string they’re inserting with the flashvars attribute.
It’s the flashvars line that seems to be causing getURL() actions to work, even when Flash Player 9 is installed. On closer inspection it seems to be the extra italic tags inserted into the flashvars attribute that causes the MySpace code parser to fail and to not insert that crucial allowNetworking=internal attribute. I’ve posted an example on my own MySpace profile and those extra italic tags do the trick. I too have a Flash widget (sort of) that can open new browser windows.
Try it yourself, does it work?
UPDATE:
MySpace have closed this loophole now 