embedding of iframes

[Michael Goebel]

Administrators and creators of ning networks are able to embed iFrames into their profile pages and standalone pages in their networks but standard members cannot.

We have wanted to be able to create a new member role that gives that ability for that member to emded iFrames and have tried allowing them control over PAGES, but they are still unable to embed. The embedded code still comes up blank.\

My question is: What features do we need to enable for this role so that members can successfully embed iFrame content ?

[Phil McCluskey]

Hi Michael,

If you've given someone a role that lets them moderate Pages, and they're unable to embed an iframe into a page, then that's a bug that we should fix. Dropping us a note about it via the help center will get it recorded. There isn't a moderator role that would give someone the ability to embed an iframe in their profile page though. Can you tell me a little more about the use case for this ability on your network?

Thanks,
Phil 

[Michael Goebel]

Certainly Phil - and thankyou for your kind attention in this matter.

A number of our members use an iFrame widget for their businesses and other presentations. This is a purely iFrame-based widget, examples of which can be seen here:

On a page: http://mountzion144.ning.com/page/ov-one-vibration-the-story-of

On a profile: http://mountzion144.ning.com/profile/PamelaAHeyen

For your convenience, here is the iFrame code used in the page example:

<iframe width="475" height="356" src="http://www.automatedbusinesscard.com/OV/1.html"></iframe>

It is also possibly worthy of mention that this coding is identical to that of the new style YouTube video embed code. In our testing, we tried adding this code as a video to see if it would be accepted but with no luck. It seems that certain iFrame source URLs are blocked.

The ideal situation for us and quite a number of other sites that use this particular widget is for creators or admin to be able to set a member role that allows display of these on both profile pages and standalone pages (if only one, then profile pages). Alternatively, if it could be embedded in the form of a video, that would also resolve the issue. Having all three would be wonderful, but our particular order of preference is:

1st: Profile pages, 2nd: Standalone pages, 3rd: As video embeds

With the growing popularity of iFrame-based widgets due to their small code footprint and lack of impact on site resources, we are very much hoping this matter can be resolved as:

1. Our only recourse at the moment is to grant all widget users full administrator privileges and this is somewhat of a security risk.

2. It would solve the problem for the many other embeddable widgets of this form

We have submitted a support ticket (case #00558579 ) to the following effect:

Admin members are able to embed iframe code in their text boxes and stand-alone pages, but standard members cannot. What feature do we need to enable in ROLES to allow a standard member to do this ?

Looking forward very much to your reply!

Sincerely,

Michael

[Phil McCluskey]

Thanks for the reply Michael,

I believe that members who are given a moderation role over pages should have this ability, so that's likely what we would tackle first. It might be feasible to create a similar role for modifying profile pages, but the chances of us letting ordinary members add iframes to their pages is very slim. This is because it's a significant security risk. Allowing a member to add iframes to their profiles would let someone do things like redirect visitors from their profile page to any other site, or include some html that looked like a network or facebook / sign in and steal member credentials.

[Michael Goebel]

Indeed yes, I agree that all members should have a role approved by admin before being able to embed iFrames. I look forward very much to the result.

[Patrick Chappelle]

Even as I typed my response, I knew you would say allowing members put use iframes was a security risk, Phil. I just wish the widgets my artists use (SoundCloud, etc.) worked on profile pages so artists can sell their music, or that our music players had more practical use.

[Michael Goebel]

Well, let us both pray Phil can make this happen with the roles modification!

[Patrick Chappelle]

Indeed. Cheers, Michael.

[Patrick Chappelle]

Having a site that caters to bands and musicians, I'm sure many of our members would love to be able to add iframes to their profiles.