Embedded YouTube Links not working

[ade41515]

Hi Thorsten,

i used currenly the version 3.1.8 on PHP8.0.

When I create a content via the editor and want to embed a Video as Iframe from YouTube under "Insert meda -> embed", the source code is not displayed in the editor (not even under Source Code). How can I do embed YouTube videos ?

thanks,

Sven

[Thorsten]

Hi,

we deactivated iframes due to security reasons:

https://github.com/thorsten/phpMyFAQ/bl ... #L179-L180

You can remove these lines and it will work, but on your own risk.

bye
Thorsten

[SPMedia]

Hi,

we deactivated iframes due to security reasons:

https://github.com/thorsten/phpMyFAQ/bl ... #L179-L180

You can remove these lines and it will work, but on your own risk.

bye
Thorsten

It appears these lines were removed from footer.php as of 3.2, and I am having trouble embedding a video in 3.2.1 which was my cause for registration here.

The ability to embed an iframe is no less disabled, it would appear, but it is unclear where this disability is implemented.

[Thorsten]

Hi,

TinyMCE v6 removed that option. How do you want to embed the video, maybe it's caused from something else.

bye
Thorsten

[SPMedia]

Hi,

TinyMCE v6 removed that option. How do you want to embed the video, maybe it's caused from something else.

bye
Thorsten

I first attempted to do it with the editor's function for that purpose. I enter the video URL in the dialog box that pops up, and, within the editor, I see the video.




When I then go out to the FAQ, the video does not load. It loads a box the size of the video as set in the interface, but it acts like the video URL is a dead link.



Viewing the page source, I see no link to my video.

Code: Select all

<p>Though it may be obvious, you&#039;ll want to play this in full screen to comprehend everything in it. </p>
<p><video width="300" height="150" controls="controls">
<source/></video></p></article>
<p class="d-print-none">You can <a href="#" data-bs-toggle="modal" data-bs-target="#pmf-modal-add-comment">comment on this FAQ</a></p>
<div id="pmf-comment-add-success"></div>
<div class="d-print-none" id="comments"></div>

Seeing this, I attempted to add the video with an iframe, and by inserting the HTML code to embed the video myself, all to no avail.

I found this thread looking for answers after that.

[Thorsten]

Hi,

is this a link to YouTube?

YouTube links should work as we whitelist them: https://github.com/thorsten/phpMyFAQ/bl ... r.php#L257

bye
Thorsten

[SPMedia]

I understand it's not a YouTube link. Uploading the video to YouTube in my case is not an option.

If you would like me to start another thread, I'll happily do that, but this seemed tangentially related since I was looking for the code in footer.php, and I thought I ought not start a new thread when something close existed.

Whatever the case, I am trying to embed a video, and the link to that video, though it appears just fine in the editor, does not appear on the FAQ when published, and since that does not seem to be the behavior one ought to expect of the application, I'd like some help with that.

I understand the footer.php lines are not relevant to the current version. So if you would prefer me to start another thread for this purpose, I'll do that if I don't hear back from you in a day.

[Thorsten]

Hi,

you can add your URL here:

https://github.com/thorsten/phpMyFAQ/bl ... r.php#L258

The method would look like this then:

Code: Select all

    public function cleanUpContent(string $content): string
    {
        $contentLength = Strings::strlen($content);
        $htmlSanitizer = new HtmlSanitizer(
            (new HtmlSanitizerConfig())
                ->withMaxInputLength($contentLength + 1)
                ->allowSafeElements()
                ->allowRelativeLinks()
                ->allowStaticElements()
                ->allowRelativeMedias()
                ->forceHttpsUrls($this->config->get('security.useSslOnly'))
                ->allowElement('iframe', ['title', 'src', 'width', 'height', 'allow', 'allowfullscreen'])
                ->allowMediaSchemes(['https', 'http', 'mailto', 'data'])
                ->allowMediaHosts(
                    [
                        Request::createFromGlobals()->getHost(),
                        'www.youtube.com',
                        'your_url_here.com
                    ]
                )
        );

        return $htmlSanitizer->sanitize($content);
    }

bye
Thorsten