Should embedded youtube videos work in 1.7.5?

Support requests, bug reports, etc. go here. Dedicated servers / VDS hosting only
Aldursil
Bear Rating Disaster
Bear Rating Disaster
Posts: 99
Joined: 18 Mar 2013, 03:11

Should embedded youtube videos work in 1.7.5?

Postby Aldursil » 24 Mar 2013, 20:58

I ask because I used to not see anything previous to 1.7.5. Now where the youtube embedded video should be displayed I see a black box but the video never loads.
Attachments
black_box.png
black_box.png (37.08 KiB) Viewed 7810 times

User avatar
dxbi
Bear Rating Disaster
Bear Rating Disaster
Posts: 62
Joined: 16 Mar 2013, 13:44

Re: Should embedded youtube videos work in 1.7.5?

Postby dxbi » 24 Mar 2013, 21:19

Could be it only works with html5 video. Try youtube.com/html5 and see if it works after turning that on.

User avatar
fox
^ me reading your posts ^
Posts: 5994
Joined: 27 Aug 2005, 22:53
Location: Saint-Petersburg, Russia
Contact:

Re: Should embedded youtube videos work in 1.7.5?

Postby fox » 24 Mar 2013, 21:25

This looks like a chrome problem, somehow it doesn't allow javascript properly in a sandboxed iframe, even though it should. It worked for me in ff.

feader
Bear Rating Master
Bear Rating Master
Posts: 160
Joined: 26 Dec 2012, 20:03

Re: Should embedded youtube videos work in 1.7.5?

Postby feader » 24 Mar 2013, 21:43

Aldursil wrote:I ask because I used to not see anything previous to 1.7.5. Now where the youtube embedded video should be displayed I see a black box but the video never loads.

I use Firefox, and also only get a black box. When I reload the frame and have NoScript on, it shows that it blocks the iframe, but does not play it after it gets allowed. When NoScript is disabled, it always show a black box. The frame can be opened in a new tab, then played.

dxbi wrote:Could be it only works with html5 video. Try youtube.com/html5 and see if it works after turning that on.

Tried that, didn't change anything.
Last edited by feader on 24 Mar 2013, 21:53, edited 1 time in total.

Aldursil
Bear Rating Disaster
Bear Rating Disaster
Posts: 99
Joined: 18 Mar 2013, 03:11

Re: Should embedded youtube videos work in 1.7.5?

Postby Aldursil » 24 Mar 2013, 21:48

Does not show for me in Firefox or Chrome. Weird

User avatar
dxbi
Bear Rating Disaster
Bear Rating Disaster
Posts: 62
Joined: 16 Mar 2013, 13:44

Re: Should embedded youtube videos work in 1.7.5?

Postby dxbi » 24 Mar 2013, 22:33

Iframe-embedded youtube works for me in html5 mode in Chrome (Win8) as well as under Chromium (linux).
If my recollection is correct, a sandboxed iframe should never allow a plugin to run. Maybe you need to be logged in into youtube for it to remember html5 cross-domain?

User avatar
baskin
Bear Rating Trainee
Bear Rating Trainee
Posts: 4
Joined: 24 Mar 2013, 22:38

Re: Should embedded youtube videos work in 1.7.5?

Postby baskin » 24 Mar 2013, 22:40

I have the same problem (black box) with firefox, for example on this page: http://www.geeksaresexy.net/2013/03/24/ ... d-2-video/

User avatar
fox
^ me reading your posts ^
Posts: 5994
Joined: 27 Aug 2005, 22:53
Location: Saint-Petersburg, Russia
Contact:

Re: Should embedded youtube videos work in 1.7.5?

Postby fox » 24 Mar 2013, 22:41

Ah, yeah maybe it was in html5 mode in the feed I tested on. Somehow.

User avatar
dxbi
Bear Rating Disaster
Bear Rating Disaster
Posts: 62
Joined: 16 Mar 2013, 13:44

Re: Should embedded youtube videos work in 1.7.5?

Postby dxbi » 24 Mar 2013, 23:24

Should non-sandboxed iframes be considered from well-known video sites? Could this be implemented using a plugin?

User avatar
fox
^ me reading your posts ^
Posts: 5994
Joined: 27 Aug 2005, 22:53
Location: Saint-Petersburg, Russia
Contact:

Re: Should embedded youtube videos work in 1.7.5?

Postby fox » 24 Mar 2013, 23:25

Yep, whitelist + ON_SANITIZE should do it.

User avatar
dxbi
Bear Rating Disaster
Bear Rating Disaster
Posts: 62
Joined: 16 Mar 2013, 13:44

Re: Should embedded youtube videos work in 1.7.5?

Postby dxbi » 25 Mar 2013, 01:32

It seems obvious how to remove the sandbox attribute. But what do you mean by whitelist? I could set $_SESSION['hasSandbox'] to avoid the iframe being stripped when the client doesn't support it but this feels like a weird hack.

joseph-mx
Bear Rating Disaster
Bear Rating Disaster
Posts: 68
Joined: 19 Oct 2012, 05:19
Location: http://www.mxhub.com/reader/
Contact:

Re: Should embedded youtube videos work in 1.7.5?

Postby joseph-mx » 25 Mar 2013, 06:00

It is a good suggestion but note that proceed with caution. Embed remote stuffs will also open up can of worms(as in possible loophole for hacking later on) .
:)

User avatar
fox
^ me reading your posts ^
Posts: 5994
Joined: 27 Aug 2005, 22:53
Location: Saint-Petersburg, Russia
Contact:

Re: Should embedded youtube videos work in 1.7.5?

Postby fox » 25 Mar 2013, 09:08

Also it's very easy to escape the iframe.

>But what do you mean by whitelist?

Check if the video/script leads to a list of allowed sites and allow accordingly. It's still highly insecure though.

User avatar
Andyt8
Bear Rating Disaster
Bear Rating Disaster
Posts: 83
Joined: 19 Mar 2013, 17:02
Location: Austria
Contact:

Re: Should embedded youtube videos work in 1.7.5?

Postby Andyt8 » 25 Mar 2013, 14:03

Not all Flash Videos and of course HTML5 Videos work for me at 1.7.5.

In Firefox I see only a black box. In IE 10 I see nothing - I mean the script for Video isn't loaded. In Google Reader the Video is playable in both Browsers. For Youtube I use HTML5 for both Browsers.

@fox: do you mean a whitelist in TT-RSS or from Youtube and similar which include the Video? The Video is allowed for all websites.

User avatar
fox
^ me reading your posts ^
Posts: 5994
Joined: 27 Aug 2005, 22:53
Location: Saint-Petersburg, Russia
Contact:

Re: Should embedded youtube videos work in 1.7.5?

Postby fox » 25 Mar 2013, 14:14

>@fox: do you mean a whitelist in TT-RSS or from Youtube and similar which include the Video? The Video is allowed for all websites.

This sounds like potential plugin stuff.


Return to “Support”

Who is online

Users browsing this forum: No registered users and 2 guests