Flash and Server Permissions (warning, long!!)

[arjalai]

I am currently working on a flash news feed for the Alumni Association website, and I am having trouble with loading the rss file from the Black Board server due to the Flash security sandbox.

After a little bit of research, I thought that all I would need to do was tell Flash to find the server's cross-domain policy file, which would hopefully say that any website on *.unl.edu would have access to the files. Apparently, flash automatically searches the root for cross domain policy files, and did not find one. so then I dug a little and found documentation for loading a policy file from a specific area on the server:
http://livedocs.adobe.com/flash/9.0/mai ... 05403.html

And so I, or rather the guy in charge of me, called Paul Erickson, and he walked us through enabling our Content Collection area, where I loaded a crossdomain policy file in xml form(under threat of merciless beatings), as outlined by this website:

http://www.moock.org/asdg/technotes/cro ... licyFiles/

(puke green background notwithstanding, the site seems pretty solid)

And so, the cross domain xml file was loaded to:
http://blackboard.unl.edu/bbcswebdav/us ... domain.xml

Then, after that, i specified in my flash file that i wanted the file from there to be loaded, which would give me access to the rss file and....hooold on..... that did not work....

Quoting from Adobe LiveDocs:
System.security.loadPolicyFile("http://foo.com/sub/dir/pf.xml");

This causes Flash Player to retrieve a policy file from the specified URL. Any permissions granted by the policy file at that location will apply to all content at the same level or lower in the virtual directory hierarchy of the server. The following code continues the previous example:

loadVariables("http://foo.com/sub/dir/vars.txt") // allowed
loadVariables("http://foo.com/elsewhere/vars3.txt") // not allowed

Uhm, the pertinent part of this quote is in bold above. Essentially the RSS file itself is located at:
http://blackboard.unl.edu/webapps/lobj- ... /index.rss
while the policy file is located at:
http://blackboard.unl.edu/bbcswebdav/us ... domain.xml

I cannot simply copy the rss file to the cbunck2 directory, as then i would have to do that EVERY time the feed is updated. Not an option. I do not have PHP or PERL(my very own personal favorite crutches) to play with on this particular server, and my knowledge of Javascript is insufficient to handle a job like this(im not even sure how i would do it). I cant add any scripts to the Blackboard server to automate the process(obviously) and I am not sure about how to go about getting a cross domain policy file on to the Blackboard root(which would make all the security professionals VERY nervous).

Essentially, I am lost. All I need to do is get an RSS file from the Blackboard server, parse it into a Flash file, and make the pretty words display. Why I am struggling with it still eludes me, but I can offer a Venti double extra shot Caramel Macchiato with soy milk mixed with 150mg pure liquid caffeine to anyone who can help me out. That, or a poodle

[alvin_woon]

the crossdomain.xml file will have to reside in the root folder.

the other way to grab feed without using server-side scripting language is the Google's Ajax Feed. http://code.google.com/apis/ajaxfeeds/

It uses javascript and bypass the Same-origin security issues you have had.

[arjalai]

Thanks Alvin, that was a perfect solution to my dilemma!!
The Google API neatly sidesteps any nasty server permissions as long as the RSS file is public. In case anyone else finds themselves with a problem like this(ie. needing a feed from secure server) I guess it would be a good idea to post a "how i did it" thingy:

go to The Google ajax feed sitehttp://code.google.com/apis/ajaxfeeds/
sign up for a API key. You get a ridiculously long key, so make sure you save that somewhere
Just use the example file as a jump off point, but before loading the xml, you might want to modify the way the feed is read in. For example, if you don't specify how many entries you want to pull in by using the setNumEntries method, it usually only ends up pulling the four most recent.

Thats all the problems i actually had with the feed API. Once i figured that out, everything turned out peachy! Except for the part where I actually had to go read about the tetchiness of security with respect to Javascript and Flash