3 added 280 characters in body
source | link

http://core.trac.wordpress.org/ticket/18719 has a working patch now.

Edit: Plugin code to do similar until patch gets in:

wp_oembed_add_provider('#https://(www\.)?youtube.com/watch.*#i', 'http://youtube.com/oembed?scheme=https', true);
wp_oembed_add_provider('https://youtu.be/*', 'http://youtube.com/oembed?scheme=https', false );

http://core.trac.wordpress.org/ticket/18719 has a working patch now.

http://core.trac.wordpress.org/ticket/18719 has a working patch now.

Edit: Plugin code to do similar until patch gets in:

wp_oembed_add_provider('#https://(www\.)?youtube.com/watch.*#i', 'http://youtube.com/oembed?scheme=https', true);
wp_oembed_add_provider('https://youtu.be/*', 'http://youtube.com/oembed?scheme=https', false );
2 deleted 1767 characters in body
source | link

In theory, simply changing these lines:

'#http://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'http://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),

to these:

'#https?://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'https?://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),

in the class-oembed.php file will do the trick. However, the resulting iframe won't be SSL.

Inhttp://core.trac.wordpress.org/ticket/18719 has a perfect world, this would do the job:

'#http://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'http://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),
'#https://(www\.)?youtube.com/watch.*#i'         => array( 'https://www.youtube.com/oembed',            true  ),
'https://youtu.be/*'                             => array( 'https://www.youtube.com/oembed',            false ),

But there are two problems:

  1. The wp_remote_get in the _fetch_with_format function doesn't disable the sslverify option. So unless you have fully updated Certificate Authority lists in your PHP install (which no realistic PHP install has), then the SSL GET call will fail.

  2. YouTube still doesn't return https src's in the iframes even when you use SSL throughout the request. So the resulting iframe will be http, potentially breaking the "secure" page in some browsers, if the page this is being embedded on is https as well.

Theworking patch in WordPress code to support SSL (and ignore sslverify for oembed calls) is easy, however it's pointless until YouTube returns HTTPS src's in their oembed resultsnow.

In theory, simply changing these lines:

'#http://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'http://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),

to these:

'#https?://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'https?://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),

in the class-oembed.php file will do the trick. However, the resulting iframe won't be SSL.

In a perfect world, this would do the job:

'#http://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'http://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),
'#https://(www\.)?youtube.com/watch.*#i'         => array( 'https://www.youtube.com/oembed',            true  ),
'https://youtu.be/*'                             => array( 'https://www.youtube.com/oembed',            false ),

But there are two problems:

  1. The wp_remote_get in the _fetch_with_format function doesn't disable the sslverify option. So unless you have fully updated Certificate Authority lists in your PHP install (which no realistic PHP install has), then the SSL GET call will fail.

  2. YouTube still doesn't return https src's in the iframes even when you use SSL throughout the request. So the resulting iframe will be http, potentially breaking the "secure" page in some browsers, if the page this is being embedded on is https as well.

The patch in WordPress code to support SSL (and ignore sslverify for oembed calls) is easy, however it's pointless until YouTube returns HTTPS src's in their oembed results.

http://core.trac.wordpress.org/ticket/18719 has a working patch now.

1
source | link

In theory, simply changing these lines:

'#http://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'http://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),

to these:

'#https?://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'https?://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),

in the class-oembed.php file will do the trick. However, the resulting iframe won't be SSL.

In a perfect world, this would do the job:

'#http://(www\.)?youtube.com/watch.*#i'         => array( 'http://www.youtube.com/oembed',            true  ),
'http://youtu.be/*'                             => array( 'http://www.youtube.com/oembed',            false ),
'#https://(www\.)?youtube.com/watch.*#i'         => array( 'https://www.youtube.com/oembed',            true  ),
'https://youtu.be/*'                             => array( 'https://www.youtube.com/oembed',            false ),

But there are two problems:

  1. The wp_remote_get in the _fetch_with_format function doesn't disable the sslverify option. So unless you have fully updated Certificate Authority lists in your PHP install (which no realistic PHP install has), then the SSL GET call will fail.

  2. YouTube still doesn't return https src's in the iframes even when you use SSL throughout the request. So the resulting iframe will be http, potentially breaking the "secure" page in some browsers, if the page this is being embedded on is https as well.

The patch in WordPress code to support SSL (and ignore sslverify for oembed calls) is easy, however it's pointless until YouTube returns HTTPS src's in their oembed results.