2013-11-25, 11:46 AM
Pages: 1 2
2013-11-25, 11:52 AM
(2013-11-25, 11:37 AM)Destroy666 Wrote: [ -> ]Well, yes, I don't recommend it though. Users will be able to add any flash then, not only youtube.
Also, I forgot, need to change this line:
just like the other one.<param name="movie" value="http://www.youtube.com/v/{$user['ytb']}"></param>
Good point. Completely slipped my mind.
@OP: So as it now, in order to allow a complete url, due to security issues, the plugin would have to be rewritten or include additions which would check if the string contains http://www.youtube.com and if not, deny the user ability to add that value.
For further explanation, as Destroy666 brought up a good point. As long as http://www.youtube.com/v/ is included, users can only include objects from the youtube.com domain. If you allow them to use youtube.com/v/id, it would open security issues because someone could just as easily put their own website in and include any object from their site.
Pages: 1 2