From 46c2c32119afc816a2b631ec6d5df0e81fabd4c6 Mon Sep 17 00:00:00 2001
From: Kelly Dwan <ryelle@users.noreply.github.com>
Date: Wed, 11 Sep 2024 17:02:35 -0400
Subject: [PATCH] Add a shortcode for nocookie youtube embeds (#651)

* Add a shortcode for nocookie youtube embeds

* Remove the unused tag parameter
---
 mu-plugins/plugin-tweaks/index.php            |  1 +
 .../plugin-tweaks/youtube-shortcode.php       | 54 +++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 mu-plugins/plugin-tweaks/youtube-shortcode.php

diff --git a/mu-plugins/plugin-tweaks/index.php b/mu-plugins/plugin-tweaks/index.php
index acd96df30..b77aa9295 100644
--- a/mu-plugins/plugin-tweaks/index.php
+++ b/mu-plugins/plugin-tweaks/index.php
@@ -13,3 +13,4 @@
 require_once __DIR__ . '/stream.php';
 require_once __DIR__ . '/incompatible-plugins.php';
 require_once __DIR__ . '/gutenberg.php';
+require_once __DIR__ . '/youtube-shortcode.php';
diff --git a/mu-plugins/plugin-tweaks/youtube-shortcode.php b/mu-plugins/plugin-tweaks/youtube-shortcode.php
new file mode 100644
index 000000000..5db4837bc
--- /dev/null
+++ b/mu-plugins/plugin-tweaks/youtube-shortcode.php
@@ -0,0 +1,54 @@
+<?php
+/**
+ * Add a shortcode for nocookie youtube embeds.
+ *
+ * These are not supported in the core embed block or shortcode.
+ * See https://core.trac.wordpress.org/ticket/44610
+ */
+
+namespace WordPressdotorg\MU_Plugins\Plugin_Tweaks\Youtube_Shortcode;
+
+add_shortcode( 'youtube-nocookie', __NAMESPACE__ . '\render' );
+
+/**
+ * Render the youtube iframe.
+ *
+ * The shortcode content is the URL, checked against a safelist of
+ * `youtube-nocookie` domains. Attributes can be `width`, `height`,
+ * and `title.
+ *
+ * @param array  $attr    Shortcode attributes array, can be empty if the original arguments string cannot be parsed.
+ * @param string $content Content inside shortcode tags.
+ *
+ * @return string HTML code for iframe embed.
+ */
+function render( $attr, $content ) {
+	// Short out early if the content is not a valid URL.
+	// Returns null if content is not a URL at all.
+	$host = wp_parse_url( $content, PHP_URL_HOST );
+	$valid_hosts = [ 'www.youtube-nocookie.com', 'youtube-nocookie.com' ];
+	if ( ! in_array( $host, $valid_hosts, true ) ) {
+		return '';
+	}
+
+	$defaults = array(
+		'width' => '100%',
+		'height' => false,
+		'title' => 'YouTube video player',
+	);
+	$args = shortcode_atts( $defaults, $attr );
+
+	$html_attrs = '';
+	foreach ( $args as $name => $value ) {
+		if ( $value ) {
+			$html_attrs .= $name . '="' . esc_attr( $value ) . '" ';
+		}
+	}
+
+	return sprintf(
+		// `allow` settings copied from youtube-provided embed code.
+		'<iframe style="aspect-ratio: 16/9;" src="%s" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen %s></iframe>',
+		esc_url( $content ),
+		$html_attrs
+	);
+}