Changeset 3476

Timestamp:

06/19/2016 07:34:19 PM (10 years ago)

Author:

obenland

Message:

Plugin Directory: Whitelist oembed providers for the directory.

Fixes #1769.

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php (modified) (2 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/class-plugin-directory.php

@@ -39 +39 @@
                 add_action( 'template_redirect', array( $this, 'redirect_old_plugin_urls' ) );
                 add_filter( 'query_vars', array( $this, 'filter_query_vars' ) );
+
+                // oEmbed whitlisting.
+                add_filter( 'embed_oembed_discover', '__return_false' );
+                add_filter( 'oembed_providers', array( $this, 'oembed_whitelist' ) );
 
                 // Shim in postmeta support for data which doesn't yet live in postmeta
@@ -688 +692 @@
                         die();
                 }
+        }
+
+        /**
+         * Whitelists the oembed providers whitelist.
+         *
+         * Limited to providers that add video support to plugin readme files.
+         *
+         * @param array $providers An array of popular oEmbed providers.
+         * @return array
+         */
+        public function oembed_whitelist( $providers ) {
+                return array_filter( $providers, function ( $provider ) {
+                        $whitelist = array(
+                                'youtube.com',
+                                'vimeo.com',
+                                'wordpress.com',
+                                'wordpress.tv',
+                                'vine.co',
+                                'soundcloud.com',
+                                'instagram.com',
+                                'mixcloud.com',
+                                'cloudup.com',
+                        );
+
+                        foreach ( $whitelist as $url ) {
+                                if ( false !== strpos( $provider[0], $url ) ) {
+                                        return true;
+                                }
+                        }
+                        return false;
+                } );
         }