From 45e0cd564afdae71e9525193250744e88076da71 Mon Sep 17 00:00:00 2001
From: "Lucas Perais (lpe)" <lpe@odoo.com>
Date: Tue, 29 Aug 2017 09:28:31 +0200
Subject: [PATCH] [FIX] web_editor, website_forum: allow to post videos on the
 forum

The commit 8749410b1033ddec1207ce1db42d1889a0d2ea33 corrected the way the iframe was rendered to display a video in v9.0.
In v10 though, the html sanitizer is a bit more severe and cleans data-src attributes, preventing the iframe to have a src

This commit works around that and allows the src of the video to be saved in db

OPW 761424

closes #19125
---
 addons/web_editor/static/src/js/widgets.js                 | 2 +-
 addons/website/static/src/js/website.snippets.animation.js | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/addons/web_editor/static/src/js/widgets.js b/addons/web_editor/static/src/js/widgets.js
index 6e7a6784351..eb34bd152ca 100644
--- a/addons/web_editor/static/src/js/widgets.js
+++ b/addons/web_editor/static/src/js/widgets.js
@@ -915,7 +915,7 @@ var VideoDialog = Widget.extend({
             video_id = this.$("#video_id").val();
         }
         var $iframe = $(
-            '<div class="media_iframe_video" data-src="'+this.$iframe.attr("src")+'">'+
+            '<div class="media_iframe_video" data-oe-expression="'+this.$iframe.attr("src")+'">'+
                 '<div class="css_editable_mode_display">&nbsp;</div>'+
                 '<div class="media_iframe_video_size" contentEditable="false">&nbsp;</div>'+
                 '<iframe src="'+this.$iframe.attr("src")+'" frameborder="0" allowfullscreen="allowfullscreen" contentEditable="false"></iframe>'+
diff --git a/addons/website/static/src/js/website.snippets.animation.js b/addons/website/static/src/js/website.snippets.animation.js
index 08c78e58c7b..306fe1a4cb0 100644
--- a/addons/website/static/src/js/website.snippets.animation.js
+++ b/addons/website/static/src/js/website.snippets.animation.js
@@ -127,7 +127,8 @@ animation.registry.media_video = animation.Class.extend({
             var size = '<div class="media_iframe_video_size">&nbsp;</div>';
             this.$target.html(editor+size);
         }
-        this.$target.html(this.$target.html()+'<iframe src="'+_.escape(this.$target.data("src"))+'" frameborder="0" allowfullscreen="allowfullscreen"></iframe>');
+        // rebuilding the iframe, from https://www.html5rocks.com/en/tutorials/security/sandboxed-iframes/
+        this.$target.html(this.$target.html()+'<iframe sandbox="allow-scripts allow-same-origin" src="'+_.escape(this.$target.data("oe-expression"))+'" frameborder="0" allowfullscreen="allowfullscreen"></iframe>');
     },
 });