Releases - YellowComet/PeerTubeEmbed - Codeberg.org

This release's main feature is running the URL generated for the iframe through HtmlArmor::getHtml() (basically a wrapper for htmlspecialchars()) before being put on the iframe.

I've not managed to get XSS yet, though I've been able to mangle the iframe tag by taking advantage of this. Regardless, it is a matter of time before someone finds a way to do it. You're encouraged to upgrade.

This release adds the missing closing tag. Without it, all content after the embed was included inside the embed, making the rest of the article appear missing.

This was caused by a lack of more thorough testing, I will be more careful in the future.

Other than that, there have been changes to the CONTRIBUTING.md file to clarify that contributions to this repo are under the GPL-2.0-or-later. The license notice at README.md has also been changed.

The URL at extension.json (the one shown at Special:Version) has also been changed to this extension's page at mediawiki.org.

(Correction February 12th, 2023: The changes clarifying the license of PRs were done to CONTRIBUTING.md, not CHANGELOG.md)

This release fixes fullscreen functionality, and sets up i18n.

This release's most important change is the change from printf to sprintf, which avoids including the lenght of the string in the output.

On the documentation side of things, README.md has also seen some changes. Notably, it recommends downloading the release from the releases tab instead of cloning with Git. CHANGELOG.md has seen some minor changes related to Markdown formatting.

This release fixes an error when checking the URL components.

In 1.0.0, it would throw a PHP warning on URLs like https://tilvids.com when checking if the required components (specifically, whether /w/ is in the path) were there. This release fixes it.

Updating is recommended.

Initial release of the extension.