Changeset 3476

Timestamp:

06/19/2016 07:34:19 PM (8 years ago)

Author:

obenland

Message:

Plugin Directory: Whitelist oembed providers for the directory.

Fixes #1769.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php

@@ -39 +39 @@
         add_action( 'template_redirect', array( $this, 'redirect_old_plugin_urls' ) );
         add_filter( 'query_vars', array( $this, 'filter_query_vars' ) );
+
+        // oEmbed whitlisting.
+        add_filter( 'embed_oembed_discover', '__return_false' );
+        add_filter( 'oembed_providers', array( $this, 'oembed_whitelist' ) );
 
         // Shim in postmeta support for data which doesn't yet live in postmeta
@@ -688 +692 @@
             die();
         }
+    }
+
+    /**
+     * Whitelists the oembed providers whitelist.
+     *
+     * Limited to providers that add video support to plugin readme files.
+     *
+     * @param array $providers An array of popular oEmbed providers.
+     * @return array
+     */
+    public function oembed_whitelist( $providers ) {
+        return array_filter( $providers, function ( $provider ) {
+            $whitelist = array(
+                'youtube.com',
+                'vimeo.com',
+                'wordpress.com',
+                'wordpress.tv',
+                'vine.co',
+                'soundcloud.com',
+                'instagram.com',
+                'mixcloud.com',
+                'cloudup.com',
+            );
+
+            foreach ( $whitelist as $url ) {
+                if ( false !== strpos( $provider[0], $url ) ) {
+                    return true;
+                }
+            }
+            return false;
+        } );
     }