User waffleslop is trying to embed a video from Vooplayer on a Discourse topic using an iframe, but it’s not working despite whitelisting the iframe domain. codinghorror points out that whitelisting only applies to iframes, not scripts.
Johani explains that the script needs to be whitelisted by adding it to the content_security_policy_script_src site setting. However, this solution doesn’t work for waffleslop, who has also created a plugin to whitelist certain tags.
Johani advises against using the plugin as it removes important abuse prevention measures and suggests using a different video service like YouTube or Vimeo, which are supported out of the box in Discourse.
waffleslop asks if a fallback code provided by Vooplayer can be used, and riking responds that it should work with the iframe embed whitelist.
I would like a video to display on a Discourse Topic based on the following embed code. Note that I have whitelisted the iframe domain in Settings: (https://cmox.cdn.vooplayer.com/).
If you’d like to learn more about Content Security Policy and how it affects Discourse customizations, please have a look here
Also note that the src attribute in your Iframe code is empty so it doesn’t really load anything. Make sure the src attribute is set to the src of the Iframe you’re trying to load.
Joe, I should have been able to find this answer without bugging y’all. Is there a bigger document on how to use Discourse that I can check in the future? Otherwise, I’m just searching Meta. And with all the great how-tos I’ve seen, I bet the Discourse team has built a bigger doc.
Can you point me in the right direction?
Also, I’m super grateful for all y’all do. Meta is such a killer community and the codebase seems so solid.
The code I have is as follows: Discourse.Markdown.whiteListTag("div", "style", /[a-z]+/); Discourse.Markdown.whiteListTag("div", "class", /[a-z]+/); Discourse.Markdown.whiteListTag("iframe", "class", /[a-z]+/); Discourse.Markdown.whiteListTag("iframe", "style", /[a-z]+/);
However when I try to embed the video, this is what happens:
This is a big no no. By adding this you’re removing some of the very important abuse prevention measures that Discourse has. We strip these things for a reason.
Long story short, I’ve looked at vooplayer embeds and you’re in for a bit of work. There’s going to be a lot of friction because the way vooplayer handles their iframes is not ideal in the context of a single page application.
I would strongly recommend that you use another service like Youtube or Vimeo if you can as these are supported out of the box in Discourse.
If you’re set on using vooplayer, then the scope of the help you need exceeds what we can provide and I would recommend a topic in the Marketplace category.
