Contrib.social

Media library allows adding videos from providers other than Youtube/Vimeo using Media embed

Open on Drupal.org →
Created on 8 March 2020, over 4 years ago
Updated 17 May 2024, about 1 month ago

Problem/motivation

When adding a remote video using the media library, it specifies you can only add from YouTube or Vimeo (this is consistent with the Remote Video media type included with the Standard profile). However, videos from other providers can be added anyway (e.g. Dailymotion). The media library is not validating the media type's allowed providers, even though this is normally validated at the data layer when creating a remote video via the /media/add UI.

The problem here is that Drupal\media_library\Form\OEmbedForm does not do all of the same validation that's implemented in the Media module's more robust OEmbedResource validation constraint.

Proposed resolution

After having discussed with the committers (see #45), let's fix this generically by in Drupal\media_library\Form\AddFormBase. During validateForm(), a temporary media entity should be created and validated using the entity's validate() method, and any errors that the source field raises should bubble up to the form.

Remaining steps

  • Implement the solution.
  • Put it on the boat to commitland.

API changes

AddFormBase and/or OEmbedForm (which are Media Library extension points) might receive a new protected method or two, and/or deprecate existing ones.

UI changes

Media items being added in the media library will receive stricter validation. This isn't really a UI change, but it could change previous behavior if, for example, any sites were relying on the loose validation being done by OEmbedForm.

Since we're going to fix this generically, it might potentially change the behavior of all media sources that use AddFormBase to integrate with the media library (which is probably all of them, truth be told). However, @catch and @larowlan felt that the benefits outweighed the risks.

Data model changes

None.

Release Note

TBD

🐛 Bug report
Status

Needs work

Version

11.0 🔥

Component
Media  →

Last updated about 17 hours ago

Created by

🇳🇿New Zealand edmonkey

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Comment about 1 month ago →
    🇺🇸United States justcaldwell

    I'm a bit concerned that the focus on video in the issue summary doesn't make it clear that the problem is broader. Based our our recent experience, it appears any oEmbed-based Media entity will accept ANY valid oEmbed resource URL when the entity is created via the Media Library oEmbed form. This includes oEmbed providers that have not been enabled/allowed for the site.

    Our site has two oEmbed-based Media entities. The "standard" Remote Video (YouTube/Vimeo), and a Remote Audio entity that allows SoundCloud and Spotify providers via the oEmbed Providers → module. I recently noticed that a user was somehow able to create a Remote Audio entity using a Vimeo video URL.

    When I attempted to replicate via the Remote Audio media add form, I got the expected "Vimeo provider is not allowed." That led me to Media Library (embeds), where I was able to create a Remote Audio entity using a video provider URL with no validation errors.

    So I tried creating a Remote Video entity using a SoundCloud URL — yep, that works in Media Library, too.

    Then I started experimenting with various providers from the oEmbed providers list. ISSUU, SlideShare, TikTok — they all worked using either the Remote Audio or Remote Video entity. None of those providers are enabled for any entity on our site.

  • Comment about 1 month ago →
    🇺🇸United States justcaldwell

    I just reproduced the basic behavior described in #63 on a fresh install of Drupal 10.2.6., specifically:

    • Enable Media and Media Library
    • Add a 'Remote Video' Media entity (Media source set to 'Remote video', YouTube and Vimeo providers enabled).
    • Add Media Library embeds to the Basic HTML text format
    • Create a Basic Page node and use the Media Library to create embeds from any oEmbed source.

    On the upside, a patch based on MR 459 still applies to 10.2.6 (with a fair amount of fuzz) and seems to introduce validation of allowed providers.

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024