iFrame Whitelisting

DevOps
1

Hello!

I’m working between two Pressbooks installations. One Pressbooks is running completely up to date Pressbooks, including using the H5P plugin, and is set up for subdomains.

The second Pressbooks is running older Pressbooks, and specifically the managers do not want the H5P plugin turned on. This is set up for directories.

If we wanted to share H5P content through iframes from the Pressbooks with subdomains set up, would we have to whitelist each and every subdomain on the second Pressbooks? Or could we whitelist *.pressbooks.sunycreate.cloud OR does whitelisting pressbooks.sunycreate.cloud also whitelist subdomains?

Just curious. We are in early stages of using pressbooks.sunycreate.cloud and if the H5P iframes might be a challenge, it would be a pretty good reason to me to switch between directory and subdomain installs before we get much farther.

2

Hi @beckej – good question. I don’t think the iFrame Allowlist tool supports wildcards, but I could be mistaken. I think you’d need to add each of the subdomains to the second network’s allowlist, unfortunately. Here’s the relevant code in Pressbooks: https://github.com/pressbooks/pressbooks/blob/d3275b9c903363cf66d1a344d75b2d7069c7f146/inc/interactive/class-content.php#L150-L160 in case you’d like to take a closer look at the matching routine. If you can make the switch easily, it sounds like subdirectory install might be easier for this specific use case.