Revise iframe filtering to at least allow youtube.com embed URLs

RESOLVED FIXED

Status

developer.mozilla.org
General
P1
normal
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: lorchard, Unassigned)

Tracking

Details

(Whiteboard: [specification][type:change])

(Reporter)

Description

5 years ago
What feature should be changed? Please provide the URL of the feature if possible.
==================================================================================
When rendering wiki documents, we strip out the src attribute for <iframe>s where the URL host doesn't match the live samples hosts we've configured in the Constance setting KUMA_CODE_SAMPLE_HOSTS

This needs to be expanded to allow other hosts like youtube.com, in order to support video embeds

What problems would this solve?
===============================
Greater flexibility in iframe src filtering will enable iframe-based embedding from more services like YouTube (or even github)

Who would use this?
===================
Wiki authors

What would users see?
=====================
Video embeds, maybe more

What would users do? What would happen as a result?
===================================================
Wiki authors would use the CKEditor plugin implemented for bug 861996 to embed videos

Is there anything else we should know?
======================================
A quick fix to this is to just allow youtube.com (or whatever the embedding host is) to enable video embeds.

A better fix would be to switch to allowing regexes in the  Constance config, in order to be more flexible in picking what kinds of URLs to allow in <iframe>s. This could open up more embedding possibilities based on iframes
(Reporter)

Updated

5 years ago
Blocks: 861996
(Reporter)

Comment 1

5 years ago
Oh yeah, and maybe pick a different name for the constance setting than "KUMA_CODE_SAMPLE_HOST" to reflect the expanded purpose of the setting. Maybe "KUMA_WIKI_IFRAME_ALLOWED_HOSTS"
Priority: -- → P1
(Reporter)

Comment 2

5 years ago
FWIW, I pushed bug 861996 to staging, and tried to see if adding "www.youtube.com" to KUMA_CODE_SAMPLE_HOSTS would indeed enable YouTube embeds. 

It didn't, and I'm not sure why. Figuring that out will also be part of this bug :/
Priority: P1 → --
(Reporter)

Updated

5 years ago
Priority: -- → P1

Comment 3

5 years ago
Commits pushed to master at https://github.com/mozilla/kuma

https://github.com/mozilla/kuma/commit/7296c8672196bf72200b3ff15f182140c168006d
Fix bug 867686 - Allow YouTube embedding, change var name

https://github.com/mozilla/kuma/commit/d9811fb146066934fb7a66448711069e432ab9f5
Merge pull request #1136 from darkwing/youtube-867686

Fix bug 867686 - Allow YouTube embedding

Updated

5 years ago
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.