From da63a030f3230dfcce6c8ad328c74984eb2812c8 Mon Sep 17 00:00:00 2001
From: Chocobozzz <me@florianbigard.com>
Date: Tue, 19 Mar 2024 15:29:32 +0100
Subject: [PATCH] Also add "allow-forms" to oembed

---
 packages/tests/src/api/server/services.ts | 6 +++---
 server/core/controllers/services.ts       | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/tests/src/api/server/services.ts b/packages/tests/src/api/server/services.ts
index 349d29a58..cd6cb7d7c 100644
--- a/packages/tests/src/api/server/services.ts
+++ b/packages/tests/src/api/server/services.ts
@@ -74,7 +74,7 @@ describe('Test services', function () {
         const oembedUrl = server.url + basePath + video.uuid + suffix.input
 
         const res = await server.services.getOEmbed({ oembedUrl })
-        const expectedHtml = '<iframe width="560" height="315" sandbox="allow-same-origin allow-scripts allow-popups" ' +
+        const expectedHtml = '<iframe width="560" height="315" sandbox="allow-same-origin allow-scripts allow-popups allow-forms" ' +
           `title="${video.name}" src="http://${server.host}/videos/embed/${video.uuid}${suffix.output}" ` +
           'frameborder="0" allowfullscreen></iframe>'
 
@@ -98,7 +98,7 @@ describe('Test services', function () {
         const oembedUrl = server.url + basePath + playlistUUID + suffix.input
 
         const res = await server.services.getOEmbed({ oembedUrl })
-        const expectedHtml = '<iframe width="560" height="315" sandbox="allow-same-origin allow-scripts allow-popups" ' +
+        const expectedHtml = '<iframe width="560" height="315" sandbox="allow-same-origin allow-scripts allow-popups allow-forms" ' +
           `title="${playlistDisplayName}" src="http://${server.host}/video-playlists/embed/${playlistUUID}${suffix.output}" ` +
           'frameborder="0" allowfullscreen></iframe>'
 
@@ -122,7 +122,7 @@ describe('Test services', function () {
       const maxWidth = 50
 
       const res = await server.services.getOEmbed({ oembedUrl, format, maxHeight, maxWidth })
-      const expectedHtml = '<iframe width="50" height="50" sandbox="allow-same-origin allow-scripts allow-popups" ' +
+      const expectedHtml = '<iframe width="50" height="50" sandbox="allow-same-origin allow-scripts allow-popups allow-forms" ' +
         `title="${video.name}" src="http://${server.host}/videos/embed/${video.uuid}" ` +
         'frameborder="0" allowfullscreen></iframe>'
 
diff --git a/server/core/controllers/services.ts b/server/core/controllers/services.ts
index b59f0f337..e4dd297a5 100644
--- a/server/core/controllers/services.ts
+++ b/server/core/controllers/services.ts
@@ -134,7 +134,7 @@ function buildOEmbed (options: {
     thumbnailUrl = undefined
   }
 
-  const html = `<iframe width="${embedWidth}" height="${embedHeight}" sandbox="allow-same-origin allow-scripts allow-popups" ` +
+  const html = `<iframe width="${embedWidth}" height="${embedHeight}" sandbox="allow-same-origin allow-scripts allow-popups allow-forms" ` +
     `title="${embedTitle}" src="${embedUrl}" frameborder="0" allowfullscreen></iframe>`
 
   const json: any = {