Problem/Motivation

Given we already have an ecosystem of providers and the infrastructure to transform user input into tangible embeds, I think a simple integration to allow these embeds to be put amongst content within a WYSIWYG would be useful. This is definitely optional submodule territory.

It should be considered as a compliment to existing solutions such as insert_video, wysiwyg_mediaembed and video_filter (which provide similar functionality) for users who already require video_embed_field installed, have created video_embed_field plugins and who would rather not install multiple overlapping modules.

Proposed resolution

Create an optional sub-module to embed videos.

Remaining tasks

Patch.

User interface changes

Additional module and user interface for WYSIWYG integration.

API changes

None to base module.

Data model changes

None to base module.

CommentFileSizeAuthor
#46 2686171-wysiwyg-integration-46.patch40.72 KBSam152
#46 interdiff.txt799 bytesSam152
#44 2686171-wysiwyg-integration-44.patch40.66 KBSam152
#44 interdiff.txt1.03 KBSam152
#38 2686171-wysiwyg-integration-38.patch40.25 KBSam152
#38 interdiff.txt2.07 KBSam152
#37 2686171-wysiwyg-integration-37.patch38.6 KBSam152
#37 interdiff.txt3.66 KBSam152
#34 2686171-wysiwyg-integration-34.patch38.45 KBSam152
#34 interdiff.txt673 bytesSam152
#30 2686171-wysiwyg-integration-30.patch38.39 KBSam152
#26 2686171-wysiwyg-integration-26.patch35.57 KBSam152
#20 2686171-wysiwyg-integration-20.patch36.65 KBSam152
#19 2686171-wysiwyg-integration-19.patch26.52 KBSam152
#16 2686171-wysiwyg-integration-16.patch24.71 KBSam152
#15 2686171-wysiwyg-integration-15.patch23.23 KBSam152
#9 2686171-wysiwyg-integration-9.patch14.12 KBSam152
#2 2686171-wysiwyg-integration-2.patch10.9 KBSam152
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Sam152 created an issue. See original summary.

Sam152’s picture

Issue summary: View changes
Status: Active » Needs review

Status: Needs review » Needs work

The last submitted patch, 2: 2686171-wysiwyg-integration-2.patch, failed testing.

The last submitted patch, 2: 2686171-wysiwyg-integration-2.patch, failed testing.

The last submitted patch, 2: 2686171-wysiwyg-integration-2.patch, failed testing.

The last submitted patch, 2: 2686171-wysiwyg-integration-2.patch, failed testing.

The last submitted patch, 2: 2686171-wysiwyg-integration-2.patch, failed testing.

Status: Needs review » Needs work

The last submitted patch, 9: 2686171-wysiwyg-integration-9.patch, failed testing.

The last submitted patch, 9: 2686171-wysiwyg-integration-9.patch, failed testing.

The last submitted patch, 9: 2686171-wysiwyg-integration-9.patch, failed testing.

The last submitted patch, 9: 2686171-wysiwyg-integration-9.patch, failed testing.

The last submitted patch, 9: 2686171-wysiwyg-integration-9.patch, failed testing.

Sam152’s picture

Fully functioning prototype. Needs a good security and functionality review + tests.

Sam152’s picture

Sam152’s picture

Left to do:

  • Test for the filter.
  • Test for the dialog form.
Sam152’s picture

Also automatically add the filter when the button is added.

Sam152’s picture

Status: Needs review » Needs work

The last submitted patch, 20: 2686171-wysiwyg-integration-20.patch, failed testing.

The last submitted patch, 20: 2686171-wysiwyg-integration-20.patch, failed testing.

The last submitted patch, 20: 2686171-wysiwyg-integration-20.patch, failed testing.

The last submitted patch, 20: 2686171-wysiwyg-integration-20.patch, failed testing.

The last submitted patch, 20: 2686171-wysiwyg-integration-20.patch, failed testing.

Sam152’s picture

Status: Needs review » Needs work

The last submitted patch, 26: 2686171-wysiwyg-integration-26.patch, failed testing.

The last submitted patch, 26: 2686171-wysiwyg-integration-26.patch, failed testing.

The last submitted patch, 26: 2686171-wysiwyg-integration-26.patch, failed testing.

Sam152’s picture

Status: Needs review » Needs work

The last submitted patch, 30: 2686171-wysiwyg-integration-30.patch, failed testing.

The last submitted patch, 30: 2686171-wysiwyg-integration-30.patch, failed testing.

The last submitted patch, 30: 2686171-wysiwyg-integration-30.patch, failed testing.

Sam152’s picture

Sam152’s picture

benjy’s picture

Status: Needs review » Needs work

Mainly small small stuff and a few questions, looks pretty good.

  1. +++ b/modules/video_embed_wysiwyg/plugin/plugin.js
    @@ -0,0 +1,133 @@
    +        editor.fire('saveSnapshot');
    +        self.modalSave(editor, values);
    +        editor.fire('saveSnapshot');
    

    We fire the same event both before and after save?

  2. +++ b/modules/video_embed_wysiwyg/plugin/plugin.js
    @@ -0,0 +1,133 @@
    +    modalSave: function (editor, values) {
    

    I actually wonder why the event wouldn't be triggered from the modalSave method, in case it was ever saved in another way outside of addCommand.

  3. +++ b/modules/video_embed_wysiwyg/src/Form/VideoEmbedDialog.php
    @@ -0,0 +1,239 @@
    + * Drupal\video_embed_wysiwyg\Form\VideoEmbedDialog.
    

    Missing Contains \ at the start.

  4. +++ b/modules/video_embed_wysiwyg/src/Form/VideoEmbedDialog.php
    @@ -0,0 +1,239 @@
    +      '#default_value' => $this->getUserInput($form_state, 'video_url'),
    ...
    +  protected function getUserInput(FormStateInterface $form_state, $key) {
    +    return isset($form_state->getUserInput()['editor_object'][$key]) ? $form_state->getUserInput()['editor_object'][$key] : '';
    

    Why getUserInput instead of getValue()? From the docs:

    These are raw and unvalidated, so should not be used without a thorough
    * understanding of security implications. In almost all cases, code should
    * use self::getValues() and self::getValue() exclusively.

  5. +++ b/modules/video_embed_wysiwyg/src/Form/VideoEmbedDialog.php
    @@ -0,0 +1,239 @@
    +   * @param array $settings
    +   * @return \Drupal\Core\Field\FormatterInterface
    +   *   The
    

    Missing docs.

  6. +++ b/modules/video_embed_wysiwyg/src/Form/VideoEmbedDialog.php
    @@ -0,0 +1,239 @@
    +      'field_definition' => new FieldConfig(['field_name' => 'mock', 'entity_type' => 'mock', 'bundle' => 'mock']),
    

    Pretty nifty that cores apis allow this really.

  7. +++ b/modules/video_embed_wysiwyg/src/Form/VideoEmbedDialog.php
    @@ -0,0 +1,239 @@
    +    // @todo Render the thumbnail to download it from the remote. Consider
    +    // making the download method public.
    

    Should link to the follow-up.

  8. +++ b/modules/video_embed_wysiwyg/src/Form/VideoEmbedDialog.php
    @@ -0,0 +1,239 @@
    +      'video_url' => $form_state->getValue('video_url'),
    

    Presuming this goes straight to the plugin to retrieve it, does this have the same level of permissions wrapped around it as normal usage?

  9. +++ b/modules/video_embed_wysiwyg/src/Form/VideoEmbedDialog.php
    @@ -0,0 +1,239 @@
    +   * @param \Drupal\Component\Plugin\PluginManagerInterface $formatter_manager
    

    Formatter manager doesn't have its own interface to type-hint against?

  10. +++ b/modules/video_embed_wysiwyg/src/Plugin/Filter/VideoEmbedWysiwyg.php
    @@ -0,0 +1,139 @@
    + *   id = "video_embed_wysiswyg",
    

    there is an extra s in wysiwyg

  11. +++ b/modules/video_embed_wysiwyg/src/Plugin/Filter/VideoEmbedWysiwyg.php
    @@ -0,0 +1,139 @@
    +   *   Settings to validate.
    +   * @return bool
    +   *   If the required settings are present.
    

    Missing newline.

  12. +++ b/modules/video_embed_wysiwyg/src/Tests/EmbedDialogTest.php
    @@ -0,0 +1,134 @@
    +  protected $ajaxAsserts = [];
    +
    +
    

    Double newline.

  13. +++ b/modules/video_embed_wysiwyg/src/Tests/FilterTest.php
    @@ -0,0 +1,117 @@
    +    $this->filter->setFilterConfig('video_embed_wysiswyg', ['status' => 1]);
    

    extra s here as well.

  14. +++ b/modules/video_embed_wysiwyg/video_embed_wysiwyg.routing.yml
    @@ -0,0 +1,9 @@
    +  requirements:
    +    _entity_access: 'filter_format.use'
    

    There are no extra permissions to use your module?

Sam152’s picture

1. Yep, I think this is right from what I've seen. It's like taking a snapshot of the content, for the undo/redo feature.
2. Good point, but the addCommand provides more context (the editor), so unlikely this could happen accidentally. It's only called because we pass it to Drupal.ckeditor.openDialog, not because it's a property on the plugin which is meaningful.
3. Fixed.
4. I had a look into this. Nothing is returned from getValues, I suspect this is to do with modal API. The other core plugins are consistent with this. I'd like to harden this if possible. Do you know if user input is safe to pass to #default_value? I'd suspect so.
5. Done.
6. Not sure if it was intentional. Seems more like abuse to me, lol.
7. Done.
8. Normal usage for the field is defined by the entity that uses the field. I think we're using the same concept here and saying it's defined by the permissions of the text format.
9. Not that I can see.
10. Fixed.
11. Fixed.
12. Fixed.
13. Fixed.
14. It doesn't define any, no.

Sam152’s picture

I've added some additional hardening. Since anon users always had access to plain_text, they could visit /video-embed-wysiwyg/dialog/plain_text to get the form and make submissions which triggered thumbnail downloads, potentially allowing them to cause a lot of network traffic/fill up space.

This check ensures that you must have access to a filter that the admin has specified actually works with VEW.

Status: Needs review » Needs work

The last submitted patch, 38: 2686171-wysiwyg-integration-38.patch, failed testing.

The last submitted patch, 38: 2686171-wysiwyg-integration-38.patch, failed testing.

The last submitted patch, 38: 2686171-wysiwyg-integration-38.patch, failed testing.

The last submitted patch, 38: 2686171-wysiwyg-integration-38.patch, failed testing.

The last submitted patch, 38: 2686171-wysiwyg-integration-38.patch, failed testing.

Sam152’s picture

Sam152’s picture

  • Sam152 committed a20133e on 8.x-1.x
    Issue #2686171 by Sam152, benjy: WYSIWYG Integration
    
Sam152’s picture

Status: Needs review » Fixed

Thanks for the review.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.