- Minor fixes.

src/BlazyGrid.php

@@ -28,37 +28,42 @@ class BlazyGrid {
     $contents = [];
     foreach ($items as $delta => $item) {
       $attributes = [];
-      $item_settings = $settings;
+      $sets = $settings;
 
       // Support non-Blazy which normally uses item_id.
       if (is_array($item)) {
-        $attributes    = $item['attributes'] ?? [];
-        $item_settings = $item['settings'] ?? $settings;
-        $item_settings = isset($item['#build'])
-          && isset($item['#build']['settings'])
-          ? $item['#build']['settings'] : $item_settings;
-
-        if (isset($item['#build']) && isset($item['#build']['settings'])) {
-          $item['#build']['settings'] += $settings;
+        $attributes = $item['#attributes'] ?? $item['attributes'] ?? [];
+        $sets1 = $item['settings'] ?? [];
+        $sets2 = $item['#build']['settings'] ?? [];
+        $sets = array_merge($sets1, $sets2);
+        $sets += $settings;
+
+        if (isset($item['#build']['settings'])) {
+          $item['#build']['settings'] += $sets;
           $item['#build']['settings']['delta'] = $delta;
         }
 
-        unset($item['settings'], $item['attributes'], $item['item']);
+        unset(
+          $item['#attributes'],
+          $item['attributes'],
+          $item['item'],
+          $item['settings']
+        );
       }
 
-      if (!empty($item_settings['grid_item_class'])) {
-        $attributes['class'][] = $item_settings['grid_item_class'];
+      if (!empty($sets['grid_item_class'])) {
+        $attributes['class'][] = $sets['grid_item_class'];
       }
 
       // Good for Bootstrap .well/ .card class, must cast or BS will reset.
-      $content_classes = empty($item_settings['grid_content_class'])
-        ? [] : (array) $item_settings['grid_content_class'];
+      $content_classes = empty($sets['grid_content_class'])
+        ? [] : (array) $sets['grid_content_class'];
 
       // Supports single formatter field or complex fields such as Views.
       // Views or entity_view may flattened $item into a string.
       $content = is_string($item) ? ['#markup' => $item] : ['content' => $item];
       $content = $is_grid ? Blazy::container($content, [
-        'class' => array_merge(['grid__content'], $content_classes)
+        'class' => array_merge(['grid__content'], $content_classes),
       ]) : $content;
       $classes = $attributes['class'] ?? [];
       $classes = array_merge([$class_item], $classes);
@@ -68,7 +73,9 @@ class BlazyGrid {
       ];
     }
 
-    $settings['count'] = empty($settings['count']) ? count($contents) : $settings['count'];
+    $settings['count'] = empty($settings['count'])
+      ? count($contents) : $settings['count'];
+
     $element = [
       '#theme'      => 'item_list',
       '#items'      => $contents,

src/Plugin/Filter/BlazyFilter.php

@@ -69,7 +69,7 @@ class BlazyFilter {
     $settings['plugin_id'] = 'blazy_filter';
     $settings['_grid'] = $settings['column'] || $settings['grid'];
     $settings['placeholder'] = $this->manager->config('placeholder');
-    $settings['use_data_uri'] = $filter->settings['media_switch'] ?? FALSE;
+    $settings['use_data_uri'] = $filter->settings['use_data_uri'] ?? FALSE;
 
     // At D7, BlazyFilter can only attach globally, prevents blocking.
     // Allows lightboxes to provide its own optionsets.
@@ -241,19 +241,20 @@ class BlazyFilter {
 
     // Checks if we have a valid file entity, not hard-coded image URL.
     if ($src = $node->getAttribute('src')) {
-      // Iframe with data: scheme is a serious kidding, strip it earlier.
-      $src = drupal_strip_dangerous_protocols($src);
-
       // If starts with 2 slashes, it is always external.
       if (strpos($src, '//') === 0) {
         // We need to query stored SRC, https is enforced.
         $src = 'https:' . $src;
       }
 
+      // Image SRC is sanitized downstream, not here.
       if ($node->tagName == 'img') {
         $settings['uri'] = $settings['image_url'] = $src;
       }
       elseif ($node->tagName == 'iframe') {
+        // Iframe with data: scheme is a serious kidding, strip it earlier.
+        $src = drupal_strip_dangerous_protocols($src);
+
         $settings['input_url'] = $src;
         $settings['uri'] = $settings['image_url'] = $this->getVideoThumbnail($src);
         $settings['scheme'] = $this->getHost($src);