Welcome! » Log In » Create A New Profile

Flash embeding problem

Posted by Claus 
Colin Snover
Re: Flash embeding problem
October 22, 2010 08:22PM

So, what’s the current state of this issue? What is needed to get it fixed?

Re: Flash embeding problem
October 22, 2010 10:34PM

I'm not sure either. You tell me.

Colin Snover
Re: Flash embeding problem
November 09, 2010 05:10PM

Oh good, the forum is working again. :)

You said, “I'm willing to put this in on an accelerated timeframe if you're willing to do the testing legwork. :-)”. As far as I am aware the testing legwork that you requested has been completed—the proposed output works across all browsers on all platforms that support Flash. So…patch HTML Purifier to generate conforming output, or if you want someone else to send you a patch, request one? :)

Re: Flash embeding problem
November 10, 2010 12:37AM

Has anybody confirmed that the output block I posted from CKEditor converts properly?

thanks

Re: Flash embeding problem
January 22, 2011 08:12AM

I've finally dug into this and conducted my own tests. I've decided that we're going to go with the original suggestion, which breaks preloader animations but is substantially easier to implement. The relevant commits are in my local branch.

David JM Emmett
Re: Flash embeding problem
March 21, 2011 09:40AM

Sorry to bump this, but what's the (currently) recommended config options for allowing the likes of YouTube embeds?

The options:

$config->set('HTML.Trusted',false);
$config->set('Output.FlashCompat',true);
$config->set('HTML.SafeObject',true);
$config->set('HTML.SafeEmbed',false);
$config->set('Core.Encoding','ISO-8859-1');

cause the input: (Newlines added for clarity)

<object width="640" height="390">
<param name="movie" value="http://www.youtube.com/v/oC7hN_Ihd9s?fs=1&amp;hl=en_GB"></param>
<param name="allowFullScreen" value="true"></param>
<param name="allowscriptaccess" value="always"></param>
<embed src="http://www.youtube.com/v/oC7hN_Ihd9s?fs=1&amp;hl=en_GB" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="390"></embed>
</object>

to become: (Newlines added for clarity)

<object width="640" height="390" type="application/x-shockwave-flash" data="http://www.youtube.com/v/oC7hN_Ihd9s?fs=1&amp;hl=en_GB">
<param value="never" name="allowScriptAccess" />
<param value="internal" name="allowNetworking" />
<param value="http://www.youtube.com/v/oC7hN_Ihd9s?fs=1&amp;hl=en_GB" name="movie" />
<param value="false" name="allowFullScreen" />
<!--[if IE]><embed width="640" height="390" src="http://www.youtube.com/v/oC7hN_Ihd9s?fs=1&amp;hl=en_GB" allowScriptAccess="never" allowNetworking="internal" allowFullScreen="false" /><![endif]-->
</object>

Note that "allowScriptAccess"/"allowNetworking"/"allowFullScreen" are modified and the "embed" tag is wrapped in conditionals.

Re: Flash embeding problem
March 22, 2011 06:44AM

Sorry to bump this, but what's the (currently) recommended config options for allowing the likes of YouTube embeds?

The options:

$config->set('HTML.Trusted',false);
$config->set('Output.FlashCompat',true);
$config->set('HTML.SafeObject',true);
$config->set('HTML.SafeEmbed',false);
$config->set('Core.Encoding','ISO-8859-1');

cause the input: (Newlines added for clarity)

<object width="640" height="390">
<param name="movie" value="http://www.youtube.com/v/oC7hN_Ihd9s?fs=1&amp;hl=en_GB"></param>
<param name="allowFullScreen" value="true"></param>
<param name="allowscriptaccess" value="always"></param>
<embed src="http://www.youtube.com/v/oC7hN_Ihd9s?fs=1&amp;hl=en_GB" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="390"></embed>
</object>

to become: (Newlines added for clarity)

<object width="640" height="390" type="application/x-shockwave-flash" data="http://www.youtube.com/v/oC7hN_Ihd9s?fs=1&amp;hl=en_GB">
<param value="never" name="allowScriptAccess" />
<param value="internal" name="allowNetworking" />
<param value="http://www.youtube.com/v/oC7hN_Ihd9s?fs=1&amp;hl=en_GB" name="movie" />
<param value="false" name="allowFullScreen" />
<!--[if IE]><embed width="640" height="390" src="http://www.youtube.com/v/oC7hN_Ihd9s?fs=1&amp;hl=en_GB" allowScriptAccess="never" allowNetworking="internal" allowFullScreen="false" /><![endif]-->
</object>

Note that "allowScriptAccess"/"allowNetworking"/"allowFullScreen" are modified and the "embed" tag is wrapped in conditionals.

The embed-tag is wrapped in conditionals because, if I recall correctly, it's an IE-proprietary tag. Browsers other than IE should be happy with <object>, I believe. The other changes are meant for security - though if you really want to allow fullscreen, take a look at the configuration option HTML.FlashAllowFullScreen. I don't think you can alter the others, though.

Different question: Are you experiencing problems? If so, can you be specific which?

Re: Flash embeding problem
March 22, 2011 02:58PM

you also need to add object & embed to the HTML allowed array i think.

also be sure to check which code you are inserting from youtube, because if you use the secure embed tickbox on youtube, then the url is slightly different, so you will need to create youtube filter for the secure embed code aswell.

Sorry, you do not have permission to post/reply in this forum.