I need to allow iframes etc in Forums (yes - I want to do that)

I need to allow iframes etc in Forums (yes - I want to do that)

by Dom F -
Number of replies: 12

Hi yes I've read the blurb "For security reasons, moodle just does not allow you to use iframes everywhere. In general, iframe code is not allowed in Moodle activities to which all class members can contribute, including Assignment submissions, Wiki, Forum, Database, Glossary, and Blog activities. In these activities iframe-embedded video displays in the HTML editor, but will be stripped out when posts or submissions are saved."

but I need and want to do this. But cant find out how. I used to be able to do this in moodle 1.9 and I still need to do it now. I need to override it in security settings.

Also YES - I read this thread and if you follow it all the way you see a LOT of people not getting anywhere with trying to dodge the iframe bullet (whih we cant dodge  - the workarounds are clearly not working for most of those people in that forum)

So can anyone help get iframe working again  (but please I just need technical help not "security politics") 

Many thanks,

Dom

Average of ratings: -
In reply to Dom F

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by Mike Churchward -
Picture of Core developers Picture of Plugin developers Picture of Testers

Go to "Site administration / Security / Site policies / Enable trusted content" and enable that.

I'm on 3.1, but presumably its the same in 2.7.

mike

Average of ratings: -
In reply to Mike Churchward

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by Dom F -

Many thanks Mike but that didnt work. Still stuck.

I made that change (I assume I dont need to flush caches afterwards)

This is what I pasted in HTML...

<iframe src="https://player.vimeo.com/video/126058144?color=ffffff&title=0&byline=0&portrait=0" width="640" height="360" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>

<p><a href="https://vimeo.com/126058144">NEWSMAKING | Meet the Experts</a> from <a href="https://vimeo.com/ukfilmnet">UKfilmNet</a> on <a href="https://vimeo.com">Vimeo</a>.</p>


this is all I saw... (ie Moodle-Mummy strips out naughty iframe content - sigh)


test post
by Alan Abdullah - Thursday, 13 October 2016, 9:51 PM
 

 from UKfilmNet on Vimeo.

8 words

Everything still stripped out.. sad

Average of ratings: -
In reply to Dom F

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by Mike Churchward -
Picture of Core developers Picture of Plugin developers Picture of Testers

Not sure why. Again, I did those exact steps and it worked fine for me. I am using 3.1, but I'm pretty sure those same options were available in 2.7.

Were you logged in as an administrator?

Average of ratings: -
In reply to Mike Churchward

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by Dom F -

Hi Mike

Yes I was.

Im beyond desperate to sort this problem out. I cant fathom why it would be so hard.

If you dont mind I would like to send you a sysadmin to your RL email I have tucked away - that would certainly help you to help me, if I may.

Dom

Average of ratings: -
In reply to Dom F

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by Mike Churchward -
Picture of Core developers Picture of Plugin developers Picture of Testers

I wouldn't be able to do any more than you did in the front end, sorry.

Some other things to confirm:

1. You mentioned using the HTML editor. By that, you meant you used the "<>" button in the editor to put it into the mode where you can directly enter HTML, correct? After you enter it, what happens when you click it again to go into WYSIWYG mode? Does the iframe content show up then (it should)?

2. I did my test in a forum post. What type of activity were you using?

mike

Average of ratings: -
In reply to Mike Churchward

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by Dom F -

Even put BOTH these on... 

Allow EMBED and OBJECT tagsallowobjectembed
Default: No

As a default security measure, normal users are not allowed to embed multimedia (like Flash) within texts using explicit EMBED and OBJECT tags in their HTML (although it can still be done safely using the mediaplugins filter). If you wish to allow these tags then enable this option.

Enable trusted contentenabletrusttext
Default: No

By default Moodle will always thoroughly clean text that comes from users to remove any possible bad scripts, media etc that could be a security risk. The Trusted Content system is a way of giving particular users that you trust the ability to include these advanced features in their content without interference. To enable this system, you need to first enable this setting, and then grant the Trusted Content permission to a specific Moodle role. Texts created or uploaded by such users will be marked as trusted and will not be cleaned before display.

Still strips and guts out the video thats central to students posting their work... Madenning...
Average of ratings: -
In reply to Dom F

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by AL Rachels -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers

Just went back and read previous 3:54 PM post and saw that it is vimeo files you were wanting to display. The particular file in your post, 126058144, is not accessible due to privacy settings. Others work just fine with a vimeo Generico filter in Moodle 2.7. This is with "Enable trusted content" set to the default of No.


Average of ratings: -
In reply to AL Rachels

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by Dom F -

Hi AL

Yes thats something completely different to do with a purposeful setting known as "domain level privacy" - I get the same problem with public videos and youtubes. I will try the generico filter but its such a shame that moodle needs these plugins- I am doubtfull that will work either but will certainly try it of course - thankyou

Dom

Average of ratings: -
In reply to Dom F

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by AL Rachels -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers

Hi Dom,

If I understand correctly, you are using Moodle 2.7. Is that right?  If it is, then just to let you know, the version of Generico filter for Moodle 2.7 doesn't have the youtube or vimeo filters built in like later versions do. You would need to copy and paste them from some where else as the Moodle 2.7 version of Generico also does not have "bundle" capability to easily add/save filter settings for swapping/trading like the newer versions. If you need them let me know and I'll zip them into a text file for you.

Average of ratings: -
In reply to Dom F

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by AL Rachels -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers

You should be able to do iframes quite easily if you have the Generico filter installed. In fact, the youtube Generico filter uses an iframe so you could use it as an example. I have it working without having to, "Enable trusted content" in my Moodle 2.7 dev site.

I also just tested this while logged in with one of my student test accounts. My "student" was able to insert a youtube video into a forum with no problem.

Average of ratings: -
In reply to Dom F

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by Frankie Kam -
Picture of Plugin developers

Hi Dom F

I have Moodle 2.7.2 and an vimeo iframed video plays fine inside my Moodle site's forum.


Here's my code:

<iframe src="https://player.vimeo.com/video/3843184?color=ffffff&amp;title=0&amp;byline=0&amp;portrait=0" width="640" height="360" frameborder="0" webkitallowfullscreen="" mozallowfullscreen="" allowfullscreen=""></iframe>

<p><a href="https://vimeo.com/126058144">NEWSMAKING | Meet the Experts</a> from <a href="https://vimeo.com/ukfilmnet">UKfilmNet</a> on <a href="https://vimeo.com">Vimeo</a>.</p>




I have allowed EMBED and OBJECT tags (ticked!)

I have enabled trusted content (ticked!)



FOOD FOR THOUGHT!!!

I thought the yellow highlighted text is worth investigating. On my system, the "Enabled trusted content" only works if a user has this capability: moodle/site:trustcontent: Trust submitted content AND most importantly, it is set to allow.

You can check this by going to 
Site Administration | Users | Permissions | Capability Overview | <click on a role> | <type the word "trust" inside the Search box> | Click the Get Overview button

For example, the image below shows me that a user with the Manager role has the "Trust submitted content" capability. The blue numbers show you step-by-step what to do.


As you can see at step 8, my Moodle 2.7.2 installation reports that a Manager's content, posted in a forum, CAN and WILL be trusted.

In antother example, the image below shows me that a user with the Student role does NOT have the "Trust submitted content" capability. 


Therefore any content that a student posts in a forum (on my Moodle site) will be not be trusted. Hence a student's iframe tag and code will be stripped away.

So please check the trustedcontent capability of the Manager, Teacher and Student on your Moodle site. What does it show?

Hope this helps
Frankie Kam
Voted most creative Helpful and Hungry Moodler, 2014 and 2015

P.S.,
if this helps you or solves your frustration, please try out the Random-Act-Of-Pizza challenge, which is to order pizza from some outside of your country. You can do this for me (I am half-serious by the way, ahem!) by going online to https://www.dominos.com.my/ and order a pizza on Domino's from the Domino's Outlet in SS2, Petaling Jaya, Selangor, Malaysia.
Send the Pizza to: F r a n k i e   K a m.

My a d d r e s s is: Cambridge English For Life Sdn Bhd, A-1-11, Merchant Square, No 1, Jalan Tropicana Selatan 1, PJU3, 47410 Petaling Jaya, Selangor, Malaysia.

Pizza thin crust with lots of chessy chease would be nice. But then again, I am counting my chickens before they are hatched. As you are an important player in the media and communications world, it is imperative that your sanity be restored for the greater good of man. Therefore, pllease let me know if you are any closer to regaining your sanity with the screenshots and information I have shared above. 


Average of ratings: Useful (4)
In reply to Dom F

Re: I need to allow iframes etc in Forums (yes - I want to do that)

by Dan Jeffries -

Hi

Old thread I know, but just to advise that I am having issues with this too.

Trying to embed H5P from a Wordpress site in to 3.0.4 - just won't work, even if I switch Trusted Content and Object/Embed on.

However, embedding in to 3.3.x DOES work. Very weird.

So maybe something was fixed in 3.1 onwards, as everyone seems to be reporting this is OK.

Dan

Average of ratings: -