HTMLPurifier iframe Vimeo and Youtube video
How can I use HTMLPurifier to filter xss but al开发者_如何学运维so to allow iframe Vimeo and Youtube video?
require_once 'htmlpurifier/library/HTMLPurifier.auto.php';
$config = HTMLPurifier_Config::createDefault();
$config->set('HTML.Trusted', true);
$config->set('Filter.YouTube', true);
$config->set('HTML.DefinitionID', '1');
$config->set('HTML.SafeObject', 'true');
$config->set('Output.FlashCompat', 'true');
$config->set('HTML.FlashAllowFullScreen', 'true');
$purifier = new HTMLPurifier($config);
$temp = $purifier->purify($temp);
HTMLPurifier version 4.4.0 has new configuration directives to allow YouTube and Vimeo iframes:
//allow iframes from trusted sources
$cfg->set('HTML.SafeIframe', true);
$cfg->set('URI.SafeIframeRegexp', '%^(https?:)?//(www\.youtube(?:-nocookie)?\.com/embed/|player\.vimeo\.com/video/)%'); //allow YouTube and Vimeo
- http://htmlpurifier.org/live/configdoc/plain.html#HTML.SafeIframe
- http://htmlpurifier.org/live/configdoc/plain.html#URI.SafeIframeRegexp
For anyone who is struggling (how to enable iframe and allowfullscreen)
$config = \HTMLPurifier_Config::createDefault();
$config->set('HTML.SafeIframe', true);
$config->set('URI.SafeIframeRegexp', '%^(https?:)?//(www\.youtube(?:-nocookie)?\.com/embed/|player\.vimeo\.com/video/)%'); //allow YouTube and Vimeo
// This line is important allow iframe in allowed elements or it will not work
$config->set('HTML.AllowedElements', array('iframe'));// <-- IMPORTANT
$config->set('HTML.AllowedAttributes','iframe@src,iframe@allowfullscreen');
$def = $config->getHTMLDefinition(true);
$def->addAttribute('iframe', 'allowfullscreen', 'Bool');
$purifier = new \HTMLPurifier($config);
$purifiedHtml = $purifier->purify($html);
I just read this blog entry, and successfully created and used the custom filter. I made some changes to the code and added Vimeo support:
/**
* Based on: http://sachachua.com/blog/2011/08/drupal-html-purifier-embedding-iframes-youtube/
* Iframe filter that does some primitive whitelisting in a somewhat recognizable and tweakable way
*/
class HTMLPurifier_Filter_MyIframe extends HTMLPurifier_Filter
{
public $name = 'MyIframe';
/**
*
* @param string $html
* @param HTMLPurifier_Config $config
* @param HTMLPurifier_Context $context
* @return string
*/
public function preFilter($html, HTMLPurifier_Config $config, HTMLPurifier_Context $context)
{
$html = preg_replace('#<iframe#i', '<img class="MyIframe"', $html);
$html = preg_replace('#</iframe>#i', '</img>', $html);
return $html;
}
/**
*
* @param string $html
* @param HTMLPurifier_Config $config
* @param HTMLPurifier_Context $context
* @return string
*/
public function postFilter($html, HTMLPurifier_Config $config, HTMLPurifier_Context $context)
{
$post_regex = '#<img class="MyIframe"([^>]+?)>#';
return preg_replace_callback($post_regex, array($this, 'postFilterCallback'), $html);
}
/**
*
* @param array $matches
* @return string
*/
protected function postFilterCallback($matches)
{
// Domain Whitelist
$youTubeMatch = preg_match('#src="https?://www.youtube(-nocookie)?.com/#i', $matches[1]);
$vimeoMatch = preg_match('#src="http://player.vimeo.com/#i', $matches[1]);
if ($youTubeMatch || $vimeoMatch) {
$extra = ' frameborder="0"';
if ($youTubeMatch) {
$extra .= ' allowfullscreen';
} elseif ($vimeoMatch) {
$extra .= ' webkitAllowFullScreen mozallowfullscreen allowFullScreen';
}
return '<iframe ' . $matches[1] . $extra . '></iframe>';
} else {
return '';
}
}
}
Adding the filter to your HTML Purifier config
$config->set('Filter.Custom', array(new HTMLPurifier_Filter_MyIframe()));
This much should do the trick
$text = "<iframe width='560' height='315' src='//www.youtube.com/embed/RGLI7QBUitE?autoplay=1' frameborder='0' allowfullscreen></iframe>";
require_once 'htmlpurifier/library/HTMLPurifier.auto.php';
$config = HTMLPurifier_Config::createDefault();
$config->set('HTML.Trusted', true);
$config->set('Filter.YouTube', true);
echo $purifier->purify($text);
Based on reverbnation's answer, I realized that for some reason the line
$def->addAttribute('iframe', 'allowfullscreen', 'Bool');
did not work correctly and instead of
allowfullscreen="allowfullscreen"
HTMLPurifier was outputting
allowfullscreen=""
Although the documentation says that Bool - Boolean attribute, with only one valid value: the name of the attribute
, I tried to use Enum
instead:
$def->addAttribute('iframe', 'allowfullscreen', 'Enum#allowfullscreen');
The third parameter means that allowfullscreen
attribute will have only correct value -- allowfullscreen
, everything else will be ignored. This way we have the same behaviour as with Bool
. Luckily, it worked for me.
Perhaps this solution will help someone.
Get rid of the %HTML.Trusted, %Filter.YouTube and %HTML.DefinitionID. They're probably interacting poorly with SafeObject/FlashCompat.
Using drupal 7.19 and the htmlpurifier module you can configure the following setting without needing to write this code.
See http://drupal.org/node/711728#comment-5600344
Also do not forget to set
URI.DisableExternalResources: false
if you've set it to true
before.
精彩评论