[wp-trac] [WordPress Trac] #18719: YouTube Embedding Fails for https:// URLs

[WordPress Trac]

#18719: YouTube Embedding Fails for https:// URLs
--------------------------+------------------------------
 Reporter:  MacMacken     |       Owner:
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  Embeds        |     Version:  3.2.1
 Severity:  minor         |  Resolution:
 Keywords:                |
--------------------------+------------------------------

Comment (by Otto42):

 In theory, simply adding these lines to class-oembed.php would do the
 trick:
 {{{
 '#https?://(www\.)?youtube.com/watch.*#i'         => array(
 'http://www.youtube.com/oembed',            true  ),
 'https?://youtu.be/*'                             => array(
 'http://www.youtube.com/oembed',            false ),
 }}}

 But there are two problems:

 1. The wp_remote_get in the _fetch_with_format function doesn't disable
 the sslverify option. So unless you have fully updated Certificate
 Authority lists in your PHP install (which no realistic PHP install has),
 then the SSL GET call will fail here. Adding with 'sslverify'=>0 as the
 arg array to this call will bypass this problem, but more code might be
 needed to check that an SSL transport is available before making the call.

 2. YouTube still doesn't return https src's in the iframes even when you
 use SSL throughout the request. So the resulting iframe will be http,
 potentially breaking the "secure" page in some browsers, if the page this
 is being embedded on is https as well.

 So the patch is easy, however it's pointless to even bother with until
 YouTube fixes issue 2 and returns HTTPS src's in their oembed results.

 When the iframe in the data returned from this link has an https src, then
 this patch can be made and be meaningful:

 https://www.youtube.com/oembed?url=https%3A//www.youtube.com/watch%3Fv%3DoHg5SJYRHA0&format=json

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/18719#comment:10>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software