Re: [libreoffice-website] CSP issue is back on the WordPress blog instance

On Thu, 23 Jan 2020 at 18:33:21 +0100, William Gathoye (LibreOffice) wrote:
> That extension isn't even loading due to CSP, here is the URL
> filtered:
> https://fr.blog.documentfoundation.org/wp-admin/admin.php?page=youtube-ep-wizard&random=303&;

Ack, it was block frames from sameorigin.  Does it work now?  Don't
think that's what blocking the video though.

> As soon as I try to specify <iframe> tags inside the article edit area
> (text mode), WordPress is getting rid of these tags, same applies with
> "standard" [embed] shortcodes, like if that extension was tweaking the
> WordPress "save" event. It is working nicely on a vanilla WordPress I
> have though.

Seems like the extension only triggers on URLs matching these regular
expressions:

    
@^\s*https?://(?:www\.)?(?:(?:youtube.com/(?:(?:watch)|(?:embed)|(?:playlist))(?:/live_stream){0,1}/{0,1}\?)|(?:youtu.be/))([^\s"]+)\s*$@i
    @^[\r\t 
]*https?://(?:www\.)?(?:(?:youtube.com/(?:(?:watch)|(?:embed)|(?:playlist))(?:/live_stream){0,1}/{0,1}\?)|(?:youtu.be/))([^\s"]+)[\r\t
 ]*$@im
    
@https?://(?:www\.)?(?:(?:youtube.com/(?:(?:watch)|(?:embed)|(?:playlist))(?:/live_stream){0,1}/{0,1}\?)|(?:youtu.be/))([^\[\s"]+)@i

so -nocookies won't match.  Dunno what's Mike/Italo's workflow, but
AFAICT one needs to visit

    /wp-admin/admin.php?page=youtube-my-preferences#jumpprivacy

and tick the “Privacy/GDPR - Show Consent Message” and “No Cookies”
boxes.  Afterwards both https://www.youtube.com/watch?v=deadbeef and
[embedyt]https://www.youtube.com/watch?v=deadbeef[/embedyt] (or
anything matching the above URLs) will be transformed to use
https://www.youtube-nocookie.com .

Seems like a per-site configuration options, tweaked it on the French
blog too.  It's IMHO unfortunate that the plugins don't have these on by
default.

-- 
Guilhem.

-- 
To unsubscribe e-mail to: website+unsubscribe@global.libreoffice.org
Problems? https://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: https://wiki.documentfoundation.org/Netiquette
List archive: https://listarchives.libreoffice.org/global/website/
Privacy Policy: https://www.documentfoundation.org/privacy