Page MenuHomePhabricator

Extension to embed offsite media via oEmbed (video, photos, rich media)
Open, MediumPublic

Description

Was reminded of oEmbed stuff recently; see bug 25854 for adding an oEmbed provider to MediaWiki.

It would also be useful in some situations to embed oEmbed-able resources from foreign sites. Simplest implementation would probably be as a parser function:

{{#oembed:http://www.flickr.com/photos/brionv/5730494932/in/photostream}}

or to set an embedding size:

{{#oembed:http://www.flickr.com/photos/brionv/5730494932/in/photostream|400x300px}}

Of course there are difficulties with being a safe oEmbed client:

  • embedding foreign HTML without sanitization can be dangerous
  • performing sanitzation may remove the interesting bits, like the video player :P

Hosting the embed content on a foreign iframe can work nicely, but this is hard to generalize.

A basic extension should probably do:

  • provide a domain whitelist control that can be modified by sysops
  • consider allowing photos from any domain? (embedding raw images is safe, but of course is a potential image vandalism vector)
  • provide some fairly generic-ish way for a 'serve embed data from alternate domain' setup

This will be easier to do if future oEmbed versions add native iframe URL support to the return data.

See Also:

  • T27854 becoming an oEmbed provider

Details

Reference
bz29242

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 11:37 PM
bzimport set Reference to bz29242.
bzimport added a subscriber: Unknown Object (MLST).

A toolbar button helper might also be nice; drag or paste a URL and let it drop the {{#oembed:}} into your edit window.

Did a little stubbing at https://www.mediawiki.org/wiki/Extension:OEmbedConsumer -- experimental version on github currently is XSS-unsafe, uses the tag syntax, doesn't support flickr (no discovery), doesn't cache, etc. :)

Note that there's a proposed successor protocol to oembed: http://iframely.com/oembed2