Merge 7d1803ac82 into 407aacfa19

server/modules/rendering/html-mediaplayers/renderer.js

@@ -1,5 +1,26 @@
+const rxYoutube = /^.*(?:(?:youtu\.be\/|v\/|vi\/|u\/\w\/|embed\/)|(?:(?:watch)?\?v(?:i)?=|&v(?:i)?=))([^#&?]*).*/
+const rxVimeo = /^.*(vimeo\.com\/)((channels\/[A-z]+\/)|(groups\/[A-z]+\/videos\/))?([0-9]+)/
+
 module.exports = {
   init($, config) {
-
+    $('oembed').each((i, elm) => {
+      const url = $(elm).attr('url')
+      const ytMatch = url.match(rxYoutube)
+      let src
+      if (ytMatch) {
+        src = `https://www.youtube.com/embed/${ytMatch[1]}`
+      } else {
+        const vmMatch = url.match(rxVimeo)
+        if (vmMatch) {
+          src = `https://player.vimeo.com/video/${vmMatch[5]}`
+        } else {
+          return
+        }
+      }
+      const newElm = $(`<div class="video-responsive">
+        <iframe type="text/html" width="640" height="360" src="${src}" frameborder="0" allowfullscreen></iframe>
+      </div>`)
+      $(elm).parent().replaceWith(newElm)
+    })
   }
 }

server/modules/rendering/html-security/renderer.js

@@ -29,7 +29,7 @@ module.exports = {
 
       if (config.allowIFrames) {
         allowedTags.push('iframe')
-        allowedAttrs.push('allow')
+        allowedAttrs.push('allow', 'frameborder', 'allowfullscreen')
       }
 
       input = DOMPurify.sanitize(input, {