The discussion revolves around allowing <audio> and <video> tags in Discourse. riking initially suggested whitelisting these tags, but codinghorror disagreed, recommending oneboxing instead.
However, matt_mcneil pointed out that oneboxing doesn’t meet their needs for self-hosting private video content. They want to use Discourse’s authorization/group-based access controls and replicate the onebox functionality for self-hosted video.
The conversation revealed that self-hosted video files are not embedded correctly, even if they are uploaded to the same Discourse instance/domain. mcwumbly and thangngoc89 tested the links and found that they work when hosted on an external site, but not on the same site.
matt_mcneil suspected a same-site restriction, which codinghorror later confirmed as an issue. techAPJ has since fixed the problem, enabling video oneboxing for locally uploaded .mp4 files and also allowing it to work with audio files.
Notable fixes:
techAPJ fixed the issue with self-hosted video files not embedding correctly.
The fix also enables oneboxing for locally uploaded audio files.
Related issues:
Restricting download access based on group permissions for uploaded files is not currently possible in Discourse.
Sorry to revive this old topic; I couldn’t find any answers to my question in newer topics.
Re: using Oneboxing as a solution, my goal is to be able to self-host some private video content (mp4). (One of the goals is to be able to use Discourse’s authorization/group-based access controls).
I think something as simple as this would normally work for me:
Thanks for the reply. I’m not sure I understand your proposed solution though. I’d just like to be able to embed a HTML 5 video player (for content that’s already been uploaded to the same Discourse instance/domain) in an ordinary Discourse topic or post. Creating an hosting a separate HTML file to accomplish this seems like a bit too much work. Any other ideas? eg a graceful way to expand the whitelist of allowable HTML tags to include VIDEO?
Hi Jeff, thanks much for the reply! Unfortunately, your solution doesn’t seem to work for videos self-hosted as uploads on our Discourse site. As you can see below, the robot video mp4 from techslides.com works fine but the same video when hosted on our site community.cfmhome.org renders only as a bare link. (Even though clicking on that bare link will immediately download the file). Is there some setting I have configured incorrectly?
@mcwumbly Yes, I too was wondering if there might be a same-site restriction? Can you confirm if this is intentional @codinghorror or @sam?
As a side note, this points to one of my goals, which was to have some files which could only be downloaded if the user had access to a particular group. I’ve seen the Site Setting about disallowing anon users from downloading site assets, but I’m guessing that there’s no current way for Discourse to know which category a file was uploaded to and then restrict download access based on group permissions. This question probably deserves a separate topic however…
@thangngoc89, yes, we’re on the latest verison (1.2.0.beta3)
Yup. Uploads are named by SHA hash, so if someone downloads a file and uploads it somewhere else, it has the exact same filename (and file, but that was a given).
I’m experiencing this issue too; where videos (in my case .mov files) will embed if they are hosted externally, but will not if they are on the same server.
A related issue I have is that videos emailed-in are only recognised as downloadable files / attachments, and a download / attachment link is added to the post body instead of a video embed.
