Hi,

The forums allows any user to post, as such the content posted is un trusted and we use NeatHtml to prevent potentially malicious content posted by the user from being displayed. Videos fall into that category of untrusted content, letting untrusted users post video would be a bad idea. I have never seen a forum where users were allowed to embed video.

This is not a bug but a feature to keep your site secure.

Hope it helps,

Joe

I use a lot of forums and I'm not aware of any of them allowing users to embed videos. stackoverflow doesn't allow it, asp.net forums does not allow it, I really cannot think of a single forum I visit that allows it though I'm sure there are some niche kind of forums out there that might depend on it, but I don't see it as a typical forum feature.

There are security risks anytime you let users embed Flash the same as if you let them embed javascript, just because you can do something does not mean you should. It opens up attack surface for XSS.

Videos in forum posts seems like a niche kind of forum, maybe some forum applications make it possible, but doing it securely is challenging. The safest way to do it is to not use html but instead something like markdown where the html is created server side from the markdown and is constrained by rules. But this makes the editor less friendly and still would require a lot of work to support youtube vimeo and whatever list of things one decides to allow.

Right now the mojoPortal forums are basic and not targeting specialty niche use cases but just providing basic forums.

I will make it so that NeatHtml is not used (which blocks youtube and javascript) if the user is marked as trusted. This will allow moderators, ie users with edit permissions on the page or forums instance to be able to embed video. 

Maybe YAF supports it, and that might also be an option for use with mojoPortal at some point.

Best,

Joe

Only trusted users can use content features like blogs and html content so they allow a lot of things. But strangers can use the forums and should not be allowed to do such things. You should not let strangers have editing power on blogs either.

See "What mojoPortal is NOT Designed for" in the About page.

http://www.mojoportal.com/about.aspx

Best,

Joe

It can be made mostly safe with embed tags and limiting the html but it is tricky to manage allowing it without also letting other things slip through.

The simplest approach is to not use html but some other markup language then have special codes that are replaced by html, including special codes for youtube videos so that only server code can create the embed tag. But then users have to learn whatever lightweight markup you use instead of html, and typically one doers not use a wysiwyg with other markup languages but special editors designed for the markup language. I don't really want to make that change at this time, though maybe someday I will implement it as an option to use markdown in the forums.

Best,

Joe

yes, exactly BB Code or markdown are both viable options and then server side code must transform that into html and embed tags for display.