BigBlueButton 2.6.9 released!

[Anton Georgiev]

We are pleased to announce BigBlueButton 2.6.8!

This 2.6 iteration contains several fixes to the client, recording and significant work on the core: security patches, a new option for controlling which features to be disabled in a meeting and fixes to the API. We introduced a new configuration for better control of which segments of a meeting are recorded. Please take a look through the release notes below.

Note that with the newly introduced default (privacy oriented) value of recordFullDurationMedia, media from unrecorded segments will not be stored. That means that if in your deployment you reprocess recordings to add some segment that was not originally included, you will have to overwrite the default value to be able to maintain this capability.

Note that we intend on publishing a security advisory (4.8/10) about one of the fixes on June 20, 2023 or shortly after.

---

Link to installation command / instructions / features: https://docs.bigbluebutton.org/2.6/new

Big THANK YOU to all community members who helped for this release - both through sending pull requests and through reporting bugs or requesting enhancements!

The full release notes are here

https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.6.9

To try out 2.6.9, visit
https://test26.bigbluebutton.org/

Or, better yet, grab a Ubuntu 20.04 64-bit server and install the latest version yourself (it will take only a few minutes):
https://docs.bigbluebutton.org/2.6/new

If you want to report any potential security issues with BigBlueButton, please check https://github.com/bigbluebutton/bigbluebutton/security/policy#reporting-a-vulnerability

As always, we welcome feedback on this latest update.
Anton and team

[Re. Mu.]

hi all.

it seems latest bbb versions have an issue on recording: audio is heavily out of sync. i made a test on bbb demo server, here's the result: https://test26.bigbluebutton.org/playback/video/df72925787e1f1db5f07aeb98fa0f8a78c781b70-1686046275239/

has anyone else noticed that? or is it just me?

regards.

re.mu.

[Anton Georgiev]

I can confirm this on my test (just now) on the same server (both presentation and video formats) -- 

https://test26.bigbluebutton.org/playback/presentation/2.3/b59b2265c47bfe66b81015a37264b27b115dda90-1686068839209

https://test26.bigbluebutton.org/playback/video/b59b2265c47bfe66b81015a37264b27b115dda90-1686068839209/

Looking into what might be causing this. It seems as if there is 2-3s wait before the video flows.

[Anton Georgiev]

Cross referrencing the recording out of sync issue -- I just created an issue for it after trying a few more things.

https://github.com/bigbluebutton/bigbluebutton/issues/18131 If possible, let's keep any further comments about this there.

[Victor Jacobson]

Hello.

Installed 2.6.9 on a fresh server.

Noticed weird behavior of text tool on whiteboard - every new letter (in case its a last letter) is appeared on a new line.

Please check attached video.

четверг, 8 июня 2023 г. в 19:59:14 UTC, Anton Georgiev:

[Karumukilan Subbiah]

Is there a reason why bbb-record is processing the slides in the recordings for playback in SVG format in the latest versions of BBB.

Because of this reason the bbb-playback is getting Cross-Origin Read Blocking (CORB) for the slides if the recordings are served from CDNs like S3, R2, etc. 
Those servers which do not serve recording playback contents with CDNs may not face this issue. 

=========================Scenario============================

For Example:

The playback is served from https://somedomain.com
and the other contents are served from the S3 bucket like this

https://my-bucket.region.amazonaws.com/715f877b8540dc434cc4a5cd212e31d57e03d8d3-1687432336577/cursor.xml
https://my-bucket.region.amazonaws.com/715f877b8540dc434cc4a5cd212e31d57e03d8d3-1687432336577/metadata.xml
https://my-bucket.region.amazonaws.com/715f877b8540dc434cc4a5cd212e31d57e03d8d3-1687432336577/panzooms.xml
https://my-bucket.region.amazonaws.com/715f877b8540dc434cc4a5cd212e31d57e03d8d3-1687432336577/shapes.svg
https://my-bucket.region.amazonaws.com/715f877b8540dc434cc4a5cd212e31d57e03d8d3-1687432336577/tldraw.json
https://my-bucket.region.amazonaws.com/715f877b8540dc434cc4a5cd212e31d57e03d8d3-1687432336577/video/webcams.mp4
.

.

.
All the above files are downloaded and working fine

But the below mentioned slides are not downloading because it get blocked due to CORB.
https://my-bucket.region.amazonaws.com/715f877b8540dc434cc4a5cd212e31d57e03d8d3-1687432336577/presentation/96d102ee35a77aa3849644d3fd39cf3895e73bd4-1687432336628/svgs/slide2.svg

So the slides are left blank with broken images, because it is getting blocked.

======================================================================

In the older versions[2.4] of BBB, the bbb-record publishes the slides in the png format and in the BBB version 2.6.9 the slides are published in the svg format.

And due to this the chrome browser is blocking from reading the slide[x].svg data due to CORB during recording-playback, as we are serving the recording files via S3. (Cross Origin)

Below is the chrome console log:

Cross-Origin Read Blocking (CORB) blocked cross-origin response <URL> with MIME type binary/octet-stream.

Cross-Origin Read Blocking (CORB) blocked cross-origin response https://my-bucket.region.amazonaws.com/715f877b8540dc434cc4a5cd212e31d57e03d8d3-1687409533139/presentation/4fe2208ad5e2c599a0b9d2e47d3e8b18199509a5-1687409621996/svgs/slide9.svg with MIME type binary/octet-stream. See https://www.chromestatus.com/feature/5629709824032768 for more details.

According to the link here 

In rare cases, the CORB warning message may indicate a problem on a website, which may disrupt its behavior when certain responses are blocked. For example, a response served with a "X-Content-Type-Options: nosniff" response header and an incorrect "Content-Type" response header may be blocked. This could, for example, block an actual image which is mislabeled as "Content-Type: text/html" and "nosniff." If this occurs and interferes with a page's behavior, we recommend informing the website and requesting that they correct the "Content-Type" header for the response.

There is a demo here to understand this.

So this is what is happening with bbb-playback. All the svg files likes shapes.svg files are loading. Only the slides[x].svg files are not loading. 

This is beacause the shapes.svg files contains svg content and they are rendered as/or using svg dom elements.

But the slides[x].svg files are rendered as img dom elements. So there is a mismatch in the Content-Type as stated in the documentation. 

And so the X-Content-Type-Options: nosniff  is having no effect which is what stated in the documentation.

So I find here the solution to be any of the below stated two:

1. The bbb-playback source must be modified to render the slides[x].svg as svg dom elements.

2. Or, the bbb-record module must stick to the older method of processing the slides as png files.

I think the second choice is easier and an immediate fix for loading the CORS contents from S3 buckets, etc and to workaround CORB.

Can anybody help me configure BBB v2..6.9 bbb-record module to export the slides as PNG files.

Thanks & Regards

[Anton Georgiev]

Cross referencing the CORB question above to where it was subsequently asked (its own thread -- a good call) https://groups.google.com/g/bigbluebutton-dev/c/W4WewpCWWN4