oEmbed whitelist for Knight Lab tools

[JoeGermuska]

I'm not clear on what considerations go into whitelisting oEmbed providers, but I offer this patch to support oEmbed for Knight Lab's internationally popular free javascript storytelling tools, ​TimelineJS, ​StoryMapJS, and ​JuxtaposeJS.

[JoeGermuska]

oembed whitelist patch

[swissspidy]

Hey there,

Welcome to trac and thanks for the patch!

There's a certain standard for oEmbed providers in core, see ​https://make.wordpress.org/core/handbook/contribute/design-decisions/#whitelisting-oembed-providers for more information. Answers to the questions on that page would be a good starting point.

It looks like oEmbed support for TimelineJS & Co. is quite new as I can't find any documentation about it. Besides that, the ​Knight Lab Timeline plugin has only ~2000 installs as of now.

Please note that as of version 4.4, WordPress has oEmbed auto-discovery turned on and allows <iframe> embeds through it (with some rules regarding security though).

[JoeGermuska]

@swissspidy thanks for that link. I spent a lot of time searching and I had a lot of trouble finding anything like that, but we'll take a look at it.

Auto-discovery is challenging for two of the three tools because, by circumstances of history, the same HTML page uses URL parameters to serve all renderings. We can only support discovery if the agents evaluate javascript on the page. We're evaluating re-engineering that, but aren't ready to commit the energy to that change just yet.

Also, for the one of the three where we render custom HTML for each project and can support auto-discovery, we've actually stumbled into a CORS problems with the security treatment -- the origin is sent as null. That's not your problem, of course, but if anyone reading this has pointers, I'm open to them.

More after I do my homework.

[johnbillion]

I'm closing this as maybelater to aid with issue management. This doesn't mean we won't add support for knightlab.com, just that it's not mature enough at the moment. Discussion can continue while the ticket remains closed.