862120 - White-list iframes with src that points to youtube.

Status: RESOLVED FIXED

(support.mozilla.org :: Knowledge Base Software, task, P3)

Description

[Ricky Rosario [:rrosario, :r1cky]]

See Bug 854554

We currently don't allow iframes at all. To workaround this, the youtube embedding code is a hack and doesn't work within templates.

We should whitelist iframes and only allow src that points to youtube using callable filters in bleach
http://bleach.readthedocs.org/en/latest/clean.html#callable-filters

I think this is a 1-2 pter. Going with 2pts for now and will adjust to 1pt if it's a quick fix

Comment 1

[Ricky Rosario [:rrosario, :r1cky]]

Moving this to the backlog because it depends on a backlog bug.

Comment 2

[Kadir Topal [:atopal]]

pretty sure this depends on bug 840973 then. Ricky, what's the issue with bug 840973 can we take that in this sprint and this bug in the next?

Comment 3

[Ricky Rosario [:rrosario, :r1cky]]

(In reply to Kadir Topal [:atopal] from comment #2)
> pretty sure this depends on bug 840973 then. Ricky, what's the issue with
> bug 840973 can we take that in this sprint and this bug in the next?

yes, I had added the dependency :)

Comment 4

[Kadir Topal [:atopal]]

Okay, but bug 840973 is currently not assigned to any sprint. Can we assign it to the current one?

Comment 5

[Ricky Rosario [:rrosario, :r1cky]]

Moving to .9 sprint.

Comment 6

[Ricky Rosario [:rrosario, :r1cky]]

In a pull request:
https://github.com/mozilla/kitsune/pull/1326

Comment 7

[Ricky Rosario [:rrosario, :r1cky]]

Landed on master:
https://github.com/mozilla/kitsune/commit/10fb9d72808cfa48720f1355c41ac513911ad89f

Comment 8

[Ricky Rosario [:rrosario, :r1cky]]

Deployed to prod.

youtube videos in templates should now work when using the template in another doc.

Comment 9

[Ricky Rosario [:rrosario, :r1cky]]

Adjusting this to 1pt because it didn't take more than a few hours.