Remove support for [iframe] BBCode

- It was a huge gaping security hole, and now HTML Purify will remove the src attribute of all non-allowed sources anyway.

diff --git a/doc/BBCode.md b/doc/BBCode.md
index 47e45b7aca8a6c7dbc76b02b6d9e26e301c62e72..753bc69425bf669ee73b611604cd7cbb3ae60a25 100644 (file)
--- a/doc/BBCode.md
+++ b/doc/BBCode.md
@@ -502,10 +502,6 @@ You can embed video, audio and more in a message.
   <td>[embed]URL[/embed]</td>
   <td>Embed OEmbed rich content.</td>
 </tr>
-<tr>
-  <td>[iframe]URL[/iframe]</td>
-  <td>General embed, iframe size is limited by the theme size for video players.</td>
-</tr>
 <tr>
   <td>[url]*url*[/url]</td>
   <td>If *url* supports oembed or opengraph specifications the embedded object will be shown (eg, documents from scribd).

diff --git a/doc/de/BBCode.md b/doc/de/BBCode.md
index 5786e227558aec527387dd4f34d71d1898b918fe..ded52cdb7848e502cfcabda88b3894f4ca9ad31e 100644 (file)
--- a/doc/de/BBCode.md
+++ b/doc/de/BBCode.md
@@ -482,10 +482,6 @@ Du kannst Videos, Musikdateien und weitere Dinge in Beiträgen einbinden.
   <td>[embed]URL[/embed]</td>
   <td>OEmbed rich content einbetten.</td>
 </tr>
-<tr>
-  <td>[iframe]URL[/iframe]</td>
-  <td>General embed, iframe size is limited by the theme size for video players.</td>
-</tr>
 <tr>
   <td>[url]*url*[/url]</td>
   <td>Wenn *url* die OEmbed- oder Opengraph-Spezifikationen unterst&uuml;tzt, wird das Objekt eingebettet (z.B. Dokumente von scribd).

diff --git a/src/Content/Text/BBCode.php b/src/Content/Text/BBCode.php
index 73503cece8a8e54e972eaaf200d7c12acfaa910e..e41511f5a37f7be446e0bba1f14b7a84c9c367c7 100644 (file)
--- a/src/Content/Text/BBCode.php
+++ b/src/Content/Text/BBCode.php
@@ -1622,11 +1622,8 @@ class BBCode
                                                '<a href="$1" target="_blank" rel="noopener noreferrer">$1</a>', $text);
                                }
 
-                               if ($try_oembed) {
-                                       $text = preg_replace("/\[iframe\](.*?)\[\/iframe\]/ism", '<iframe src="$1" width="' . $a->videowidth . '" height="' . $a->videoheight . '"><a href="$1">$1</a></iframe>', $text);
-                               } else {
-                                       $text = preg_replace("/\[iframe\](.*?)\[\/iframe\]/ism", '<a href="$1">$1</a>', $text);
-                               }
+                               // Backward compatibility, [iframe] support has been removed in version 2020.12
+                               $text = preg_replace("/\[iframe\](.*?)\[\/iframe\]/ism", '<a href="$1">$1</a>', $text);
 
                                // Youtube extensions
                                if ($try_oembed) {

diff --git a/src/Content/Text/HTML.php b/src/Content/Text/HTML.php
index e8d0943ca477e1ab49f81cba247ee51dce843acb..6f2d7c79053ad66b52c13e6cf82ec3d51c8bc67d 100644 (file)
--- a/src/Content/Text/HTML.php
+++ b/src/Content/Text/HTML.php
@@ -290,7 +290,8 @@ class HTML
 
                        self::tagToBBCode($doc, 'video', ['src' => '/(.+)/'], '[video]$1', '[/video]', true);
                        self::tagToBBCode($doc, 'audio', ['src' => '/(.+)/'], '[audio]$1', '[/audio]', true);
-                       self::tagToBBCode($doc, 'iframe', ['src' => '/(.+)/'], '[iframe]$1', '[/iframe]', true);
+                       // Backward compatibility, [iframe] support has been removed in version 2020.12
+                       self::tagToBBCode($doc, 'iframe', ['src' => '/(.+)/'], '[url]$1', '[/url]', true);
 
                        self::tagToBBCode($doc, 'key', [], '[code]', '[/code]');
                        self::tagToBBCode($doc, 'code', [], '[code]', '[/code]');
@@ -630,6 +631,7 @@ class HTML
                        self::tagToBBCode($doc, 'img', ['src' => '/(.+)/'], ' ', ' ');
                }
 
+               // Backward compatibility, [iframe] support has been removed in version 2020.12
                self::tagToBBCode($doc, 'iframe', ['src' => '/(.+)/'], ' $1 ', '');
 
                $message = $doc->saveHTML();