As I demostrated here, http://ourl.ca/19304, you can easily manipulate the URL that gets loaded inside the vimeo player (just an iframe). Although you're still limited to the player.vimeo.com domain (you can load any site on that domain) I think here should be some added protections. The same issue with Nico video player, you can load any JS script from the ext.nicovideo.jp domain. While this still is very restricted, it's important to remember that if Vimeo or Nico change something on their website, those stuff might be used to exploit stuff here.

Wow I totally forgot that those tags existed. I believe I added them via custom BBCode, as well as the wikipedia ones. Since they are hardly ever used I guess they could be removed. However, it might be worth it to check if the Wikipedia/etc tags have the same problem as well, because if that's the case, then it's the entire custom BBCode mod that is at fault and it should be reported to its author on SMF.

*cough* We already thought of that. But yea. NO ONE DO THAT.

Believe it or not, it's already been done, except invisible (a certain retired admin who had a knack for embedding stuff)

Anyway, hope there's a fix for this at least it can't just load code from anywhere.

Can they still do that? i thought it was disabled by now

Yeah, I think I was the one who added the vimeo and Niconico tags, you had to do something like http://player.vimeo.com/video/<videoid> where <videoid> is whatever inside the tag. I doubt there will be any security issue by adding the extra options (as Vimeo or whatever will make sure there isn't any security issue in their own player), and you won't be able to hide the player by setting the width/height to 0. Plus I bet it would be kinda a PITA to write something that removes those options.

So I would say to leave this as it is now as nothing harmful would happen other than scaring someone with an autoplay (thing at least 2-3 (former) admins already did).

Can they still do that? i thought it was disabled by now

Admins can. I don't think there's a problem with that, seeing as how the same people could just delete most of Omnimaga if they wanted >.>

I think if a lot of these BBCodes aren't getting used, we don't really have a reason to keep them around. They can make post submission slower and clutter the post editor with extra buttons.

Quote from: Deep Thought on August 06, 2013, 12:59:58 am

[...] and clutter the post editor with extra buttons.

There is already a bunch of bb-code tags which don't appear as buttons in the editor....

Which? [theGame]YOu lost it?[/theGame]