Check whether commands are coming from moderator.

conference.js

     listMembersIds () {
         return room.getParticipants().map(p => p.getId());
     },
+    /**
+     * Checks whether the participant identified by id is a moderator.
+     * @id id to search for participant
+     * @return {boolean} whether the participant is moderator
+     */
+    isParticipantModerator (id) {
+        let user = room.getParticipantById(id);
+        return user && user.isModerator();
+    },
     /**
      * Check if SIP is supported.
      * @returns {boolean}
             console.log('USER %s LEFT', id, user);
             APP.API.notifyUserLeft(id);
             APP.UI.removeUser(id, user.getDisplayName());
-            APP.UI.stopSharedVideo({from: id});
+            APP.UI.stopSharedVideo(id);
         });
 
 
                 room.sendCommandOnce(Commands.SHARED_VIDEO, {
                     value: url,
                     attributes: {
-                        from: APP.conference.localId,
                         state: state,
                         time: time,
                         volume: volume
                 room.sendCommand(Commands.SHARED_VIDEO, {
                     value: url,
                     attributes: {
-                        from: APP.conference.localId,
                         state: state,
                         time: time,
                         volume: volume
             }
         });
         room.addCommandListener(
-            Commands.SHARED_VIDEO, ({value, attributes}) => {
+            Commands.SHARED_VIDEO, ({value, attributes}, id) => {
+
+                // if we are not the moderator or
+                // the command is coming from a user which is not the moderator
+                if (!(this.isLocalId(id) && room.isModerator())
+                    && !this.isParticipantModerator(id))
+                {
+                    console.warn('Received shared video command ' +
+                        'not from moderator');
+                    return;
+                }
+
                 if (attributes.state === 'stop') {
-                    APP.UI.stopSharedVideo(attributes);
+                    APP.UI.stopSharedVideo(id, attributes);
                 } else if (attributes.state === 'start') {
-                    APP.UI.showSharedVideo(value, attributes);
+                    APP.UI.showSharedVideo(id, value, attributes);
                 } else if (attributes.state === 'playing'
                     || attributes.state === 'pause') {
-                    APP.UI.updateSharedVideo(value, attributes);
+                    APP.UI.updateSharedVideo(id, value, attributes);
                 }
             });
     }

modules/FollowMe.js

         if (this._conference.isLocalId(id))
             return;
 
-        // TODO Don't obey commands issued by non-moderators.
+        if (!this._conference.isParticipantModerator(id))
+        {
+            console.warn('Received follow-me command ' +
+                'not from moderator');
+            return;
+        }
 
         // Applies the received/remote command to the user experience/interface
         // of the local participant.

modules/UI/UI.js

 };
 
 /**
-* Show shared video.
-* @param {string} url video url
-* @param {string} attributes
+ * Show shared video.
+ * @param {string} id the id of the sender of the command
+ * @param {string} url video url
+ * @param {string} attributes
 */
-UI.showSharedVideo = function (url, attributes) {
+UI.showSharedVideo = function (id, url, attributes) {
     if (sharedVideoManager)
-        sharedVideoManager.showSharedVideo(url, attributes);
+        sharedVideoManager.showSharedVideo(id, url, attributes);
 };
 
 /**
  * Update shared video.
+ * @param {string} id the id of the sender of the command
  * @param {string} url video url
  * @param {string} attributes
  */
-UI.updateSharedVideo = function (url, attributes) {
+UI.updateSharedVideo = function (id, url, attributes) {
     if (sharedVideoManager)
-        sharedVideoManager.updateSharedVideo(url, attributes);
+        sharedVideoManager.updateSharedVideo(id, url, attributes);
 };
 
 /**
  * Stop showing shared video.
+ * @param {string} id the id of the sender of the command
  * @param {string} attributes
  */
-UI.stopSharedVideo = function (attributes) {
+UI.stopSharedVideo = function (id, attributes) {
     if (sharedVideoManager)
-        sharedVideoManager.stopSharedVideo(attributes);
+        sharedVideoManager.stopSharedVideo(id, attributes);
 };
 
 module.exports = UI;

modules/UI/shared_video/SharedVideo.js

     /**
      * Shows the player component and starts the checking function
      * that will be sending updates, if we are the one shared the video
+     * @param id the id of the sender of the command
      * @param url the video url
      * @param attributes
      */
-    showSharedVideo (url, attributes) {
+    showSharedVideo (id, url, attributes) {
         if (this.isSharedVideoShown)
             return;
 
         this.url = url;
 
         // the owner of the video
-        this.from = attributes.from;
+        this.from = id;
 
         // This code loads the IFrame Player API code asynchronously.
         var tag = document.createElement('script');
     /**
      * Updates video, if its not playing and needs starting or
      * if its playing and needs to be paysed
+     * @param id the id of the sender of the command
      * @param url the video url
      * @param attributes
      */
-    updateSharedVideo (url, attributes) {
+    updateSharedVideo (id, url, attributes) {
         // if we are sending the event ignore
         if(APP.conference.isLocalId(this.from)) {
             return;
         if (attributes.state == 'playing') {
 
             if(!this.isSharedVideoShown) {
-                this.showSharedVideo(url, attributes);
+                this.showSharedVideo(id, url, attributes);
                 return;
             }
 
             else {
                 // if not shown show it, passing attributes so it can
                 // be shown paused
-                this.showSharedVideo(url, attributes);
+                this.showSharedVideo(id, url, attributes);
             }
         }
     }
 
     /**
      * Stop shared video if it is currently showed. If the user started the
-     * shared video is the one in the attributes.from (called when user
+     * shared video is the one in the id (called when user
      * left and we want to remove video if the user sharing it left).
+     * @param id the id of the sender of the command
      * @param attributes
      */
-    stopSharedVideo (attributes) {
+    stopSharedVideo (id, attributes) {
         if (!this.isSharedVideoShown)
             return;
 
-        if(this.from !== attributes.from)
+        if(this.from !== id)
             return;
 
         if(this.intervalId) {