Better iframe

clarkwinkelmann

ash3T Xavier I think the <iframe> HTML element needs a closing tag. I see it's using the HTMLElements TextFormatter plugin so I'm pretty sure it automatically includes all the remaining text of the post as its child if the closing tag is missing, just like with bbcode.

ash3T

You are right about this. I have added </iframe> in the end of each <iframe>, the issue went missing.

@Xavier By the way, you may want to update the following part

Xavier How to use:
This extension allows most iframe elements to use in Flarum, you can use any of the following formats in your flarum post to use iframe.

with the new

Xavier <iframe src="URL" style="CSS" scrolling="yes/no" allow="attribute">

Thank you both clarkwinkelmann and Xavier Yay!

Xavier

ash3T You are right, I forgot to write this, it's my mistake. I have changed it, and I'll update a version with all iframe attributes in MDN available.

Xavier

V2.0.0 Update Note:

Abandoned the BBcode method, and use HTMLElements instead.

The usage change to:

<iframe src="URL"></iframe>

Also, attributes like "style", for inline css are allowed, thus, you can use any of the following attributes, just the same as writing in HTML, a full attributes used example would look like this:

<iframe src="URL" style="CSS" scrolling="yes/no" allow="attribute"></iframe>

Todo list: Make all <iframe> attributes in MDN available. && Rewrite readme.md.

Xavier

V2.0.1 Update Note:

Allowed all <iframe> attributes. The detailed usage can refer to https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe .

To update, run

composer update aurorum/flarum-better-iframe
php flarum migrate
php flarum cache:clear

clarkwinkelmann

I don't think srcdoc should be allowed. It seems like it has full access to the window.parent object so it can be used to hijack the session of anyone who loads the post.

<iframe srcdoc="<script>alert('CSRF Token: ' + (window.parent.app.session?.csrfToken || 'not accessible'))</script>"></iframe>

Just in general, the allowfullscreen property without specific white-listed domains is also dangerous because it could be used to open a clone of the website in full screen to trick a user into entering their credentials.

Xavier

clarkwinkelmann I have thought about this problem before, and I also doubt if I should add "Deprecated attributes" in this extension, but at last, I thought, I'll make all of them available, and add a control button in the admin part to let the website administers to determine to allow unsafe attributes, like srcdoc, and the deprecated attributes, or not. However, it seems that I am too busy to make it. I have plenty of exams these two months. Thus, I'll delete the unsafe attributes, like srcdoc, until I have time to make the control button in the admin part, or (hopefully) someone has time to do it, and add a pull request to this project.

Xavier

V2.0.2 Update Note

Remove the attributes srcdoc, and allowfullscreen for security consideration.
Add a safety guide in the composer.json project description to inform the webmasters that the unsafe attribute allow is available, and tell them how to disable it.
Todo List (Pull request for doing this todo list is very welcomed.)
- Add a control button in the admin part to let the website administers to determine to allow unsafe attributes, like srcdoc, and the deprecated attributes, or not.
- Add a safety guide in the admin part.
- Update readme.md

LoneDev

Would be nice to add permission to use this tag, I don't want the whole forum to be able to embed iframes.

Xavier

LoneDev Yeah, it's a good suggestion, I would do that when I'm free.

LoneDev

Thanks.
Can't wait for it, if you have a PayPal I can make a donation to speed up the development.

Xavier

LoneDev Hi, so sorry to reply so late, I was busy taking exams last week, I'll try to add the feature in a week, I'll notice you at that time. I do have a PayPal account, https://www.paypal.com/paypalme/hhilan , you can donate to me if you want.🦊 && Thank you for your suggestion of adding permission.🦊

« Previous Page