I can't understand cross domain policy!
If someone use:
Code
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,29,0" width="801" height="420"><param name="movie"
value="http://domain.com/krpano.swf?pano=http://domain.com/pano.xml" />
<param name="quality" value="high" /><param name="menu" value="false" />
<embed src="http://domain.com/krpano.swf?pano=http://domain.com/pano.xml"
quality="high" menu="false" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" width="801" height="420"></embed></object><br>
he can embed everything from everywhere.
Example: http://www.foto-bg.com/crossdomain.htm
I didn't allow this domain to use my content, but it uses it.