2012-12-03: Bugfix for handling of Flash content in OpenX

Posted at 2012-12-03 18:15:33 by SHD

Advertising server software OpenX is reasonably user friendly to work with, but also quite insecure and buggy. One of the bugs I came across was that it misidentified Flash banners compiled with Flash version 11.4 as requiring Flash Player 17 (which doesn't exist). Since OpenX checks the version of the Flash plugin against its perceived minimum requirements, this meant that a few ads simply wouldn't display. Here's the fix to the OpenX code.

OpenX / Flash bug

The problem lies in OpenX misinterpreting the version field in the SWF file. Up to and including version 10.1 of the Flash compiler, the 4th byte of the compiled SWF file would be the major version of the compiler. Version 10.2, however, uses the value 0x0B (decimal: 11) and subsequent minor versions have also increased the byte value. OpenX fails to take this into account.

Find the following function in www/admin/lib-swf.inc.php (relative to your OpenX base install directory):


<?php

function phpAds_SWFVersion($buffer)

{

    if (substr($buffer, 0, 3) == swf_tag_identify ||

        substr($buffer, 0, 3) == swf_tag_compressed)

        return ord(substr($buffer, 3, 1));

    else

        return false;

}

?>

And change that to:


<?php

function phpAds_SWFVersion($buffer)

{

    if (substr($buffer, 0, 3) == swf_tag_identify ||

        substr($buffer, 0, 3) == swf_tag_compressed)

    {

        $rv = ord(substr($buffer, 3, 1));

        if ($rv > 10 && $rv < 13) $rv = 10;

        elseif ($rv >= 13 && $rv < 23) $rv = 11;

        elseif ($rv >= 23) $rv -= 11;

        return $rv;

    } else

        return false;

}

?>

That should handle SWF files built by Flash compiler versions 10.2 and later, at least up to ~~11.5~~ 12.0 (the current version of Flash, at the time of writing), but may need updating when Flash 12 13 is released (if that unfortunate event ever occurs). It doesn't differentiate between minor versions, as the OpenX table structure doesn't allow for that. But then, anybody who has an older version of the Flash plugin should have their internet browsing license revoked immediately anyway.

Update (2014-03-03): updated the code to correctly identify content for Flash Player 12, according to values in the Flash Player and Air Feature List.

Update (2015-12-30): updated the code to correctly identify content for Flash Player versions 13 and later.