Circumventing iframes ??

Hi Guys,

Hope you enjoyed Christmas.

I've got more of a conceptual question for the team/CBers with this new post. I've been working around the tagging, cataloging, indexing limitations for video, audio files etc. as it currently stands, but my concern or interest is:

• In CB Blogs, how did you manage to enable embedding of videos without removing iframes" restriction?

As you know, normally you remove the iframe restriction from tinymce but I don't see where that's happened.

• If you're overriding the code to eliminate iframe restriction, wouldn't that pose a security breach?

• Please explain how you're accomplishing this and the threat level posed by the allowing of iframes.

Magic

You need to whitelist iframes within CB > Configuration > User Profile by adding it to "Exclude Tags from Filtering". iframe renders the contents of 1 site inside of your side. That's the security issue. What site is displayed is dependent on the URL. Could be a porn site, a virus site, etc.. I don't recommend allowing iframes. If you want video sharing use CB Gallery or a Video fieldtype. I'm unsure how an iframe usage is going to provide the features you're wanting though.

Thanks Kyle,

Very helpful.

I figured as much on the security issue but on something this serious did not want to make any assumptions. (never could see how the video file itself could cause any damage but the content on the other hand, another story)

So no, I don't want to allow I frames, I just wanted to be sure the restriction wasn't somehow being overridden as the video tab allows video linking on the user profile page. But the linking and embedding work a little differently, so I guess that's how it's done.

Also checking out a couple of workarounds on the other, will let you know how it goes.

Magic