0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-12 05:37:26 +08:00
discourse/lib/onebox
Régis Hanol 4886c597d2
FIX: Respect blocked_onebox_domains for Twitter/X and handle empty oneboxes (#38868)
Two issues with Twitter/X oneboxes:

1. Adding `x.com` or `twitter.com` to `blocked_onebox_domains` had no
effect. In `FinalDestination#resolve`, domains in the `ignore_redirects`
list (which includes x.com, twitter.com, youtube.com, etc.) trigger an
early return with `:resolved` status before `blocked_domain?` is ever
checked. This made it impossible to block oneboxes for any of these
domains. The fix adds the blocked domain check before the
`ignore_redirects` shortcut in `resolve()`.

2. When X/Twitter returns no useful Open Graph metadata (which is the
current real-world behavior without API credentials), the onebox
rendered an empty shell — an `<aside>` with blank title, empty tweet
div, and no timestamp. `TwitterStatusOnebox` had no field validation
unlike other engines (e.g. `AmazonOnebox`). The fix adds a
`verified_data` method that requires `title` and `tweet` to be present,
returning empty HTML when they're missing. This causes Discourse to fall
back to a plain link instead of rendering a broken onebox.

https://meta.discourse.org/t/397516
2026-03-25 15:10:35 +01:00
..
engine FIX: Respect blocked_onebox_domains for Twitter/X and handle empty oneboxes (#38868) 2026-03-25 15:10:35 +01:00
mixins FEATURE: Add Reddit OAuth support for onebox (#38040) 2026-02-25 10:44:32 -03:00
templates FEATURE: Include PR number in the GitHub PR oneboxes (#37409) 2026-01-30 11:17:57 -08:00
domain_checker.rb DEV: Fix various rubocop lints (#24749) 2023-12-06 23:25:00 +01:00
engine.rb SECURITY: Restrict allowed URL patterns 2025-02-04 13:32:34 -03:00
file_type_finder.rb
helpers.rb FIX: Support Dropbox /scl/ URL format in video and image oneboxes (#38394) 2026-03-11 10:37:57 +01:00
json_ld.rb DEV: Replace custom Onebox blank implementation with ActiveSupport (#23827) 2023-10-07 19:54:26 +02:00
layout.rb DEV: Replace custom Onebox symbolize_keys implementation with ActiveSupport (#23828) 2023-10-09 09:32:09 +02:00
layout_support.rb
matcher.rb
movie.rb
normalizer.rb FIX: Don't escape HTML entities twice in oneboxes (#37141) 2026-01-16 11:40:18 +01:00
oembed.rb DEV: Replace custom Onebox symbolize_keys implementation with ActiveSupport (#23828) 2023-10-09 09:32:09 +02:00
open_graph.rb DEV: Replace custom Onebox blank implementation with ActiveSupport (#23827) 2023-10-07 19:54:26 +02:00
preview.rb DEV: Remove logical OR assignment of constants (#29201) 2024-10-16 10:09:07 +08:00
sanitize_config.rb DEV: Bump rubocop_discourse (#29608) 2024-11-06 06:27:49 +08:00
status_check.rb
template_support.rb
view.rb