# WhiteList Iframe from facebook not show

**URL:** https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260
**Category:** Support
**Created:** [7월 15, 2017, 5:16오후 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260 "2017-07-15T17:16:55Z")
**Posts on this page:** 12
**Page:** 1

<div class="post-metadata">

### Author: ![Bank\_Live](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bank_live/32/75893_2.png) [@Bank\_Live](https://meta.discourse.org/u/Bank_Live)
#### Post date: [7월 15, 2017, 5:16오후 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/1 "2017-07-15T17:16:56Z")

</div>

Normal. I use plugin [GitHub - evil-shrike/discourse-whitelist-iframe: Discourse plugin to add urls to Discourse.Markdown.\_validIframes · GitHub](https://github.com/evil-shrike/discourse-whitelist-iframe.git)  
I insert  
`<iframe src="https://www.facebook.com/plugins/video.php?href=https%3A%2F%2Fwww.facebook.com%2Fseen.everything%2Fvideos%2F1221002978004237%2F&show_text=0&width=400" width="400" height="400" style="border:none;overflow:hidden" scrolling="no" frameborder="0" allowTransparency="true" allowFullScreen="true"></iframe>`

 ![](https://global.discourse-cdn.com/meta/original/3X/3/1/3110f506d14e4dedecdf26faa95568dd5493c586.jpg) 

VDO can work. After last update Version v1.9.0.beta4  
plugin [GitHub - evil-shrike/discourse-whitelist-iframe: Discourse plugin to add urls to Discourse.Markdown.\_validIframes · GitHub](https://github.com/evil-shrike/discourse-whitelist-iframe.git) error “[https://eleceasy.com/assets/plugin-third-party](https://eleceasy.com/assets/plugin-third-party)…”

I try plugin other

```
https://github.com/hiveeyes/discourse-whitelist-iframe.git
https://github.com/looker/discourse-whitelist-iframe.git
https://github.com/evil-shrike/discourse-whitelist-iframe.git
https://github.com/VinkasHQ/discourse-facebook-onebox.git

```

 ![](https://global.discourse-cdn.com/meta/original/3X/0/0/004bfb52820d918bf18e23b19d931c89a1729e71.jpg)

not work.  
How can i fix it. Thank you very much

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [7월 15, 2017, 6:22오후 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/2 "2017-07-15T18:22:28Z")

</div>

That plugin is likely broken; contact the author.

---

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [7월 15, 2017, 7:42오후 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/3 "2017-07-15T19:42:14Z")

</div>

Thanks! I wrote the original version of that plugin. It looks like the problem with the latest version of Discourse is that that `Discourse.dialect_depreciated` is no longer defined. I’ve pushed a fix to my repo that should take care of the problem.

To use it with the facebook URL, you’ll need to clone the repo and add the facebook URL to the list of whitelisted iframes. You can copy how to do that from one of the repos you listed above.

This plugin has been cloned 54 times. Because of problems with updates, I regret having shared it on this forum. It seems there is a demand to be able to use iframes on some forums. Maybe there is a better way that this could be approached.

**Note: this plugin is no longer required. iframes can now be whitelisted through the allowed\_iframes Site Setting. It accepts a list of iframe src domain prefixes that discourse can safely allow in posts.**

---

<div class="post-metadata">

### Author: ![Bank\_Live](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bank_live/32/75893_2.png) [@Bank\_Live](https://meta.discourse.org/u/Bank_Live)
#### Post date: [7월 16, 2017, 3:34오전 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/4 "2017-07-16T03:34:50Z")

</div>

Why i installed plugin

` https://github.com/scossar/whitelist-iframe`

 ![](https://global.discourse-cdn.com/meta/original/3X/3/7/37e72346e6e1e0cbb046976935eafac499bfa414.jpg)

But can not see file plugin on var

 ![](https://global.discourse-cdn.com/meta/original/3X/2/7/27e3003c7d8460f861405ab306a3d883e66585db.jpg)

---

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [7월 16, 2017, 7:34오전 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/5 "2017-07-16T07:34:39Z")

</div>

It looks like it’s installed. Does it work? Try the iframe code from a YouTube video to test it. If you have cloned my repository, it does not include the facebook URL

---

<div class="post-metadata">

### Author: ![Bank\_Live](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/bank_live/32/75893_2.png) [@Bank\_Live](https://meta.discourse.org/u/Bank_Live)
#### Post date: [7월 16, 2017, 10:24오전 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/6 "2017-07-16T10:24:25Z")

</div>

![](https://global.discourse-cdn.com/meta/original/3X/1/f/1f6c38dd05d3c43c82ba8d6f5f67a6e824db0302.png)

I can add

`WhiteListIframe(/^(https?:)?\/\/www\.facebook\.com\/plugins\/.+/i);`

in whiteList-Iframe.js.es6 yes or not?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [9월 1, 2017, 2:34오후 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/7 "2017-09-01T14:34:48Z")

</div>

This API is removed now, use the site settings

[https://github.com/discourse/discourse/commit/e283e6aea002fb533640e68f8ee7447cf0a7c90d](https://github.com/discourse/discourse/commit/e283e6aea002fb533640e68f8ee7447cf0a7c90d)

I am open to allow allowing a proper plugin api, but it can not be done as a global the way the old one was.

As it stands plugins can already hoist out html if they want to so its not particularly interesting to also allow them to whitelist iframes.

---

<div class="post-metadata">

### Author: ![tophee](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tophee/32/73406_2.png) [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [9월 1, 2017, 3:37오후 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/8 "2017-09-01T15:37:12Z")

</div>

> [@sam](#):
>
> This API is removed now, use the site settings

I am currently using the whitelist iframe plugin. Does this mean is will cease to work once I upgrade my discourse and that I will instead find a site setting where I can specify a list source domains that are safe? Does that setting understand regex?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [9월 1, 2017, 3:38오후 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/9 "2017-09-01T15:38:32Z")

</div>

There is a site setting

Does not understand regex only prefix, old API was removed

Why do you need regex?

---

<div class="post-metadata">

### Author: ![tophee](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tophee/32/73406_2.png) [@tophee](https://meta.discourse.org/u/tophee)
#### Post date: [9월 1, 2017, 3:44오후 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/10 "2017-09-01T15:44:27Z")

</div>

> [@sam](#):
>
> only prefix

By that you mean I can specify not only domains but also subdomains?

> [@sam](#):
>
> Why do you need regex?

One of my entries currently looks like this:

```
whiteListIframe(/^(https?:)?\/\/books.google\.(gr|pt|ae|au|com|de|fr|se|ca|co.uk|es|dk|co.za|fi|cz|be|nl|at|cn|com.br|jp|it|is|in|ie|id|mx|tr)\/.+&output=embed.*/i);

```

But I guess it’s possible to achieve this “the long way” without regex, at least if we drop the `embed` part…

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [9월 1, 2017, 4:14오후 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/11 "2017-09-01T16:14:30Z")

</div>

Yeah the long way for now, I am mixed about allowing people regexes in site settings cause it is so easy to muck it up. Not strictly against, just wanted to see some use cases.

> [@tophee](#):
>
> By that you mean I can specify not only domains but also subdomains?
> 
> sam:

I mean you have to be explicit: `https://somesite.com/embed?` will work. You can specify domains or subdomains.

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [6월 8, 2024, 12:44오후 UTC](https://meta.discourse.org/t/whitelist-iframe-from-facebook-not-show/66260/12 "2024-06-08T12:44:13Z")

</div>

이 주제는 2519일 후 자동으로 닫혔습니다. 더 이상 답변을 할 수 없습니다.
