CODEWITHSUNDEEP
pythonhtmldjangosecurityembedded-video
Continuation
Continuation

Reputation: 13050

Python/Django: How to render user-submitted videos code fragments as embedded videos?

I want to enable users to submit video links in a post/comment and render it as embedded videos.

For example, youtube supplies code for embedding videos, something like:

<iframe width="420" height="345" src="http://www.youtube.com/embed/Rr6PWlOgPrs" frameborder="0" allowfullscreen></iframe>

If a user puts the above code fragment in a comment, how do I render it correctly?

Django auto-escapes all HTML tags, so by default the above code wouldn't work. But if I disable auto-escaping then I'd open a ton of security risks.

What's the best way of handling this?

Upvotes: 3

Views: 1127

Answers (3)

Tom Tich&#253;
Tom Tich&#253;

Reputation: 1065

Give a try to django-embed-video. It is quite simple.

Upvotes: 1

Uku Loskit
Uku Loskit

Reputation: 42040

The user should never be able to insert HTML directly. Look into django-oembed. This way the user will only have to paste in the URL and oembed will match it and switch the matched urls automatically with object embed code.

Upvotes: 3

Brian Neal
Brian Neal

Reputation: 32389

What I do on my site is have users submit a link to the YouTube video. No embed stuff, just the link. Then I use the oEmbed API to ask YouTube for the embed HTML code for the given link. If you trust YouTube, you can then use the HTML they give you without escaping it.

I've been doing this for 6 months now, it works really great.

Upvotes: 1

Related Questions