diff --git a/inc/config.php b/inc/config.php index c898555b..5cc15a4e 100644 --- a/inc/config.php +++ b/inc/config.php @@ -1191,9 +1191,10 @@ // Custom embedding (YouTube, vimeo, etc.) // It's very important that you match the entire input (with ^ and $) or things will not work correctly. + // Be careful when creating a new embed, because depending on the URL you end up exposing yourself to an XSS. $config['embedding'] = array( array( - '/^https?:\/\/(\w+\.)?youtube\.com\/watch\?v=([a-zA-Z0-9\-_]{10,11})(&.+)?$/i', + '/^https?:\/\/(\w+\.)?youtube\.com\/watch\?v=([a-zA-Z0-9\-_]{10,11})?$/i', '' ), array(