Should embedded youtube videos work in 1.7.5?

Support requests, bug reports, etc. go here. Dedicated servers / VDS hosting only

Should embedded youtube videos work in 1.7.5?

Postby Aldursil » 24 Mar 2013, 16:58

I ask because I used to not see anything previous to 1.7.5. Now where the youtube embedded video should be displayed I see a black box but the video never loads.
Attachments
black_box.png
black_box.png (37.08 KiB) Viewed 3423 times
Aldursil
Bear Rating Disaster
Bear Rating Disaster
 
Posts: 82
Joined: 17 Mar 2013, 23:11

Re: Should embedded youtube videos work in 1.7.5?

Postby dxbi » 24 Mar 2013, 17:19

Could be it only works with html5 video. Try youtube.com/html5 and see if it works after turning that on.
User avatar
dxbi
Bear Rating Disaster
Bear Rating Disaster
 
Posts: 60
Joined: 16 Mar 2013, 09:44

Re: Should embedded youtube videos work in 1.7.5?

Postby fox » 24 Mar 2013, 17:25

This looks like a chrome problem, somehow it doesn't allow javascript properly in a sandboxed iframe, even though it should. It worked for me in ff.
User avatar
fox
Ho-ho-ho
 
Posts: 4597
Joined: 27 Aug 2005, 18:53
Location: Saint-Petersburg, Russia

Re: Should embedded youtube videos work in 1.7.5?

Postby feader » 24 Mar 2013, 17:43

Aldursil wrote:I ask because I used to not see anything previous to 1.7.5. Now where the youtube embedded video should be displayed I see a black box but the video never loads.

I use Firefox, and also only get a black box. When I reload the frame and have NoScript on, it shows that it blocks the iframe, but does not play it after it gets allowed. When NoScript is disabled, it always show a black box. The frame can be opened in a new tab, then played.

dxbi wrote:Could be it only works with html5 video. Try youtube.com/html5 and see if it works after turning that on.

Tried that, didn't change anything.
Last edited by feader on 24 Mar 2013, 17:53, edited 1 time in total.
feader
Bear Rating Master
Bear Rating Master
 
Posts: 156
Joined: 26 Dec 2012, 16:03

Re: Should embedded youtube videos work in 1.7.5?

Postby Aldursil » 24 Mar 2013, 17:48

Does not show for me in Firefox or Chrome. Weird
Aldursil
Bear Rating Disaster
Bear Rating Disaster
 
Posts: 82
Joined: 17 Mar 2013, 23:11

Re: Should embedded youtube videos work in 1.7.5?

Postby dxbi » 24 Mar 2013, 18:33

Iframe-embedded youtube works for me in html5 mode in Chrome (Win8) as well as under Chromium (linux).
If my recollection is correct, a sandboxed iframe should never allow a plugin to run. Maybe you need to be logged in into youtube for it to remember html5 cross-domain?
User avatar
dxbi
Bear Rating Disaster
Bear Rating Disaster
 
Posts: 60
Joined: 16 Mar 2013, 09:44

Re: Should embedded youtube videos work in 1.7.5?

Postby baskin » 24 Mar 2013, 18:40

I have the same problem (black box) with firefox, for example on this page: http://www.geeksaresexy.net/2013/03/24/ ... d-2-video/
User avatar
baskin
Bear Rating Trainee
Bear Rating Trainee
 
Posts: 1
Joined: 24 Mar 2013, 18:38

Re: Should embedded youtube videos work in 1.7.5?

Postby fox » 24 Mar 2013, 18:41

Ah, yeah maybe it was in html5 mode in the feed I tested on. Somehow.
User avatar
fox
Ho-ho-ho
 
Posts: 4597
Joined: 27 Aug 2005, 18:53
Location: Saint-Petersburg, Russia

Re: Should embedded youtube videos work in 1.7.5?

Postby dxbi » 24 Mar 2013, 19:24

Should non-sandboxed iframes be considered from well-known video sites? Could this be implemented using a plugin?
User avatar
dxbi
Bear Rating Disaster
Bear Rating Disaster
 
Posts: 60
Joined: 16 Mar 2013, 09:44

Re: Should embedded youtube videos work in 1.7.5?

Postby fox » 24 Mar 2013, 19:25

Yep, whitelist + ON_SANITIZE should do it.
User avatar
fox
Ho-ho-ho
 
Posts: 4597
Joined: 27 Aug 2005, 18:53
Location: Saint-Petersburg, Russia

Re: Should embedded youtube videos work in 1.7.5?

Postby dxbi » 24 Mar 2013, 21:32

It seems obvious how to remove the sandbox attribute. But what do you mean by whitelist? I could set $_SESSION['hasSandbox'] to avoid the iframe being stripped when the client doesn't support it but this feels like a weird hack.
User avatar
dxbi
Bear Rating Disaster
Bear Rating Disaster
 
Posts: 60
Joined: 16 Mar 2013, 09:44

Re: Should embedded youtube videos work in 1.7.5?

Postby joseph-mx » 25 Mar 2013, 02:00

It is a good suggestion but note that proceed with caution. Embed remote stuffs will also open up can of worms(as in possible loophole for hacking later on) .
:)
joseph-mx
Bear Rating Disaster
Bear Rating Disaster
 
Posts: 68
Joined: 19 Oct 2012, 01:19
Location: http://www.mxhub.com/reader/

Re: Should embedded youtube videos work in 1.7.5?

Postby fox » 25 Mar 2013, 05:08

Also it's very easy to escape the iframe.

>But what do you mean by whitelist?

Check if the video/script leads to a list of allowed sites and allow accordingly. It's still highly insecure though.
User avatar
fox
Ho-ho-ho
 
Posts: 4597
Joined: 27 Aug 2005, 18:53
Location: Saint-Petersburg, Russia

Re: Should embedded youtube videos work in 1.7.5?

Postby Andyt8 » 25 Mar 2013, 10:03

Not all Flash Videos and of course HTML5 Videos work for me at 1.7.5.

In Firefox I see only a black box. In IE 10 I see nothing - I mean the script for Video isn't loaded. In Google Reader the Video is playable in both Browsers. For Youtube I use HTML5 for both Browsers.

@fox: do you mean a whitelist in TT-RSS or from Youtube and similar which include the Video? The Video is allowed for all websites.
User avatar
Andyt8
Bear Rating Disaster
Bear Rating Disaster
 
Posts: 74
Joined: 19 Mar 2013, 13:02
Location: Austria

Re: Should embedded youtube videos work in 1.7.5?

Postby fox » 25 Mar 2013, 10:14

>@fox: do you mean a whitelist in TT-RSS or from Youtube and similar which include the Video? The Video is allowed for all websites.

This sounds like potential plugin stuff.
User avatar
fox
Ho-ho-ho
 
Posts: 4597
Joined: 27 Aug 2005, 18:53
Location: Saint-Petersburg, Russia

Next

Return to Support

Who is online

Users browsing this forum: Yahoo [Bot] and 1 guest