Hi George

Regarding the image:

• After further troubleshooting, this is our findings:
  • The image can be seen by all users with correct permissions that access the program directly (I.E not through their required learning page) Example of page URL: https://...server.com/totara/program/view.php?id=1 Example of Image URL: https://...server.com/pluginfile.php/295/totara_program/summary/0/goo.jpg
  • However if a user access the program through the required learning page Example pf page URL: https://...server.com/totara/program/required.php the image url is corrupted, and looks like this: https://...server.com/totara/program/https://totara.community/pluginfile.php/26528/mod_forum/post/70514/goo.jpg
  • We also tested hot-linking images, it seems that hot-linking images works but is obviously not something we want to do.

Regarding embedding of video:

• Is the program functionality not something that Totara developed? and therefore could this stripping out of code not be disabled? I may not understand the full security implications of it, so forgive me if there is legitimate reason for stripping out that code, but I don't see how the program page is any less secure than a course page where embedding is not stripped out. Is there something I am missing?
• Is there a work around to this which does not involve adding the video file to the server and having it run from there?

Hi George,

In my previous reply where i provided the example of the image URL, the image url was converted by this forum into a different URL therefore i ahve attached it as a image.

Its the "@@pluginfile@@" in the URL thats causing the issue I believe.