ekzyis
/
stacker.news
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Handle Peertube Embeds (#1223) 

* Handle peertube embeds

* Permit full screen for Rumble and PeerTube

* Use sandbox='allow-scripts' for iframes

* Restore frame-src domains

* Use endsWith

---------

Co-authored-by: ekzyis <ek@stacker.news>
This commit is contained in:
Tom 2024-06-20 17:28:25 +01:00 committed by GitHub
parent 78520b787b
commit 4fe920d12b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 45 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
components/item-full.js
View File

@ -106,8 +106,24 @@ function ItemEmbed ({ item }) {
<div className={styles.videoContainer}>
<iframe
title='Rumble Video'
allowFullScreen=''
allowFullScreen
src={meta?.href}
sandbox='allow-scripts'
/>
</div>
</div>
)
}
if (provider === 'peertube') {
return (
<div className={styles.videoWrapper}>
<div className={styles.videoContainer}>
<iframe
title='PeerTube Video'
allowFullScreen
src={meta?.href}
sandbox='allow-scripts'
/>
</div>
</div>

18
components/text.js
View File

@ -281,8 +281,24 @@ export default memo(function Text ({ rel, imgproxyUrls, children, tab, itemId, o
<div className={styles.videoContainer}>
<iframe
title='Rumble Video'
allowFullScreen=''
allowFullScreen
src={meta?.href}
sandbox='allow-scripts'
/>
</div>
</div>
)
}
if (provider === 'peertube') {
return (
<div style={videoWrapperStyles}>
<div className={styles.videoContainer}>
<iframe
title='PeerTube Video'
allowFullScreen
src={meta?.href}
sandbox='allow-scripts'
/>
</div>
</div>

10
lib/url.js
View File

@ -120,6 +120,16 @@ export function parseEmbedUrl (href) {
}
}
}
if (hostname.endsWith('peertube.tv') || hostname.endsWith('bitcointv.com')) {
return {
provider: 'peertube',
id: null,
meta: {
href: href.replace('/w/', '/videos/embed/')
}
}
}
} catch {
// ignore
}

2
middleware.js
View File

@ -42,7 +42,7 @@ export function middleware (request) {
// unsafe-inline for styles is not ideal but okay if script-src is using nonces
"style-src 'self' a.stacker.news 'unsafe-inline'",
"manifest-src 'self'",
'frame-src www.youtube.com platform.twitter.com rumble.com',
'frame-src www.youtube.com platform.twitter.com rumble.com bitcointv.com peertube.tv',
"connect-src 'self' https: wss:" + devSrc,
// disable dangerous plugins like Flash
"object-src 'none'",