[TikiWiki-commits] [Git][tikiwiki/tiki][24.x] [BP][FIX] Plugin Youtube - use http_header_referrer_policy_value for iframe referrerpolicy

Domeshow Emmanuel pushed to branch 24.x at Tiki Wiki CMS Groupware / Tiki


Commits:
fdde28ff by Domeshow Emmanuel at 2026-06-20T00:45:36+03:00
[BP][FIX] Plugin Youtube - use http_header_referrer_policy_value for iframe referrerpolicy
---
* [FIX] Plugin Youtube - close caret error markup and align 24.x test expectation

* [FIX] Plugin Youtube - use http_header_referrer_policy_value for iframe referrerpolicy

See merge request tikiwiki/tiki!10555

(cherry picked from commit 2819299486a46ff48e4255a41910bb76699e017d)

See merge request tikiwiki/tiki!10560

- - - - -


2 changed files:

- lib/test/wiki-plugins/YoutubeTest.php
- lib/wiki-plugins/wikiplugin_youtube.php


Changes:

=====================================
lib/test/wiki-plugins/YoutubeTest.php
=====================================
@@ -10,25 +10,35 @@ require_once(__DIR__ . '/../../wiki-plugins/wikiplugin_youtube.php');
 
 class WikiPlugin_YoutubeTest extends PHPUnit\Framework\TestCase
 {
-    /**
-     * @dataProvider provider
-     * @param $data
-     * @param $expectedOutput
-     * @param array $params
-     */
-    public function testWikiPluginCode($data, $expectedOutput, $params = []): void
+    protected function setUp(): void
     {
-        $this->assertEquals($expectedOutput, wikiplugin_youtube($data, $params));
+        global $prefs;
+
+        $prefs['http_header_referrer_policy_value'] = 'strict-origin-when-cross-origin';
     }
 
-    public function provider(): array
+    public function testWikiPluginCodeWithDefaultReferrerPolicy(): void
     {
-        return [
-            ['', '^Plugin YouTube error: the movie parameter is empty.'],
-            ['', '~np~<iframe src="//www.youtube.com/embed/bPHuY7QL568?" frameborder="0" width="425" height="350" allowfullscreen=""></iframe>~/np~', ['movie' => 'http://www.youtube.com/watch?v=bPHuY7QL568']],
-            ['', '~np~<iframe src="//www.youtube.com/embed/deby_Yb1-ac?" frameborder="0" width="425" height="350" allowfullscreen=""></iframe>~/np~', ['movie' => 'https://www.youtube.com/watch?v=deby_Yb1-ac']],
-            ['', '~np~<iframe src="//www.youtube.com/embed/deby_Yb1-ac?" frameborder="0" width="425" height="350" allowfullscreen=""></iframe>~/np~', ['movie' => 'https://youtu.be/deby_Yb1-ac']],
-            ['', '~np~<iframe src="//www.youtube-nocookie.com/embed/deby_Yb1-ac?" frameborder="0" width="425" height="350" allowfullscreen=""></iframe>~/np~', ['movie' => 'https://youtu.be/deby_Yb1-ac', 'privacyEnhanced' => 'y']],
-        ];
+        global $prefs;
+
+        $referrerPolicy = $prefs['http_header_referrer_policy_value'];
+
+        $this->assertEquals('^Plugin YouTube error: the movie parameter is empty.^', wikiplugin_youtube('', []));
+        $this->assertEquals(
+            '~np~<iframe src="//www.youtube.com/embed/bPHuY7QL568?" frameborder="0" width="425" height="350" allowfullscreen="" referrerpolicy="' . $referrerPolicy . '"></iframe>~/np~',
+            wikiplugin_youtube('', ['movie' => 'http://www.youtube.com/watch?v=bPHuY7QL568'])
+        );
+        $this->assertEquals(
+            '~np~<iframe src="//www.youtube.com/embed/deby_Yb1-ac?" frameborder="0" width="425" height="350" allowfullscreen="" referrerpolicy="' . $referrerPolicy . '"></iframe>~/np~',
+            wikiplugin_youtube('', ['movie' => 'https://www.youtube.com/watch?v=deby_Yb1-ac'])
+        );
+        $this->assertEquals(
+            '~np~<iframe src="//www.youtube.com/embed/deby_Yb1-ac?" frameborder="0" width="425" height="350" allowfullscreen="" referrerpolicy="' . $referrerPolicy . '"></iframe>~/np~',
+            wikiplugin_youtube('', ['movie' => 'https://youtu.be/deby_Yb1-ac'])
+        );
+        $this->assertEquals(
+            '~np~<iframe src="//www.youtube-nocookie.com/embed/deby_Yb1-ac?" frameborder="0" width="425" height="350" allowfullscreen="" referrerpolicy="' . $referrerPolicy . '"></iframe>~/np~',
+            wikiplugin_youtube('', ['movie' => 'https://youtu.be/deby_Yb1-ac', 'privacyEnhanced' => 'y'])
+        );
     }
 }


=====================================
lib/wiki-plugins/wikiplugin_youtube.php
=====================================
@@ -132,7 +132,7 @@ function wikiplugin_youtube_info()
 
 function wikiplugin_youtube($data, $params)
 {
-    global $tikilib;
+    global $tikilib, $prefs;
 
      $plugininfo = wikiplugin_youtube_info();
     foreach ($plugininfo['params'] as $key => $param) {
@@ -141,11 +141,9 @@ function wikiplugin_youtube($data, $params)
     $params = array_merge($default, $params);
 
     if (empty($params['movie'])) {
-        return '^' . tra('Plugin YouTube error: the movie parameter is empty.');
+        return '^' . tra('Plugin YouTube error: the movie parameter is empty.') . '^';
     }
 
-    $scheme = $tikilib->httpScheme();
-
     $sYoutubeId  = getYoutubeId($params['movie']);
     if (empty($sYoutubeId)) {
         Feedback::error(tra('Invalid YouTube URL provided'));
@@ -186,8 +184,10 @@ function wikiplugin_youtube($data, $params)
         $params['movie'] .= '&color2=0x' . $params['background'];
     }
 
+    // Keep iframe referrer policy aligned with site preference.
+    $iframeReferrerPolicy = $prefs['http_header_referrer_policy_value'] ?? '';
 
-    $iframe = ('<iframe src="' . $params['movie'] . '" frameborder="0" width="' . $params['width'] . '" height="' . $params['height'] . '" allowfullscreen="' . $params['allowFullScreen'] . '"></iframe>');
+    $iframe = ('<iframe src="' . $params['movie'] . '" frameborder="0" width="' . $params['width'] . '" height="' . $params['height'] . '" allowfullscreen="' . $params['allowFullScreen'] . '" referrerpolicy="' . $iframeReferrerPolicy . '"></iframe>');
 
     return '~np~' . $iframe . '~/np~';
 }



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/fdde28ffc69cae05566478f086cd5aa3513eb08e

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/fdde28ffc69cae05566478f086cd5aa3513eb08e
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs