Issue #3438618 by larowlan, longwave, alexpott, martijn de wit, askibinski,...

Issue #3438618 by larowlan, longwave, alexpott, martijn de wit, askibinski, seanb: Allow opting out of oembed discovery

core/modules/media/config/install/media.settings.yml

@@ -2,3 +2,4 @@ icon_base_uri: 'public://media-icons/generic'
 iframe_domain: ~
 oembed_providers_url: 'https://oembed.com/providers.json'
 standalone_url: false
+oembed_discovery: false

core/modules/media/config/schema/media.schema.yml

@@ -15,6 +15,9 @@ media.settings:
     standalone_url:
       type: boolean
       label: 'Allow media items to be viewed standalone at /media/{id}'
+    oembed_discovery:
+      type: boolean
+      label: 'Allow oEmbed discovery'
 
 media.type.*:
   type: config_entity

core/modules/media/media.post_update.php

@@ -27,3 +27,10 @@ function media_removed_post_updates(): array {
 function media_post_update_media_author_views_filter_update(): void {
   // Empty update function to clear the Views data cache.
 }
+
+/**
+ * Set the oembed_discovery setting.
+ */
+function media_post_update_set_oembed_discovery(): void {
+  \Drupal::configFactory()->getEditable('media.settings')->set('oembed_discovery', TRUE)->save(TRUE);
+}

core/modules/media/media.services.yml

@@ -9,7 +9,7 @@ services:
     parent: default_plugin_manager
   media.oembed.url_resolver:
     class: Drupal\media\OEmbed\UrlResolver
-    arguments: ['@media.oembed.provider_repository', '@media.oembed.resource_fetcher', '@http_client', '@module_handler', '@cache.default']
+    arguments: ['@media.oembed.provider_repository', '@media.oembed.resource_fetcher', '@http_client', '@module_handler', '@cache.default', '@config.factory']
   Drupal\media\OEmbed\UrlResolverInterface: '@media.oembed.url_resolver'
   media.oembed.provider_repository:
     class: Drupal\media\OEmbed\ProviderRepository

core/modules/media/src/OEmbed/UrlResolver.php

@@ -5,6 +5,7 @@
 use Drupal\Component\Utility\Html;
 use Drupal\Component\Utility\UrlHelper;
 use Drupal\Core\Cache\CacheBackendInterface;
+use Drupal\Core\Config\ConfigFactoryInterface;
 use Drupal\Core\Extension\ModuleHandlerInterface;
 use GuzzleHttp\ClientInterface;
 use Psr\Http\Client\ClientExceptionInterface;
@@ -63,24 +64,24 @@ class UrlResolver implements UrlResolverInterface {
 
   /**
    * Constructs a UrlResolver object.
-   *
-   * @param \Drupal\media\OEmbed\ProviderRepositoryInterface $providers
-   *   The oEmbed provider repository service.
-   * @param \Drupal\media\OEmbed\ResourceFetcherInterface $resource_fetcher
-   *   The OEmbed resource fetcher service.
-   * @param \GuzzleHttp\ClientInterface $http_client
-   *   The HTTP client.
-   * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler
-   *   The module handler service.
-   * @param \Drupal\Core\Cache\CacheBackendInterface $cache_backend
-   *   The cache backend.
    */
-  public function __construct(ProviderRepositoryInterface $providers, ResourceFetcherInterface $resource_fetcher, ClientInterface $http_client, ModuleHandlerInterface $module_handler, CacheBackendInterface $cache_backend) {
+  public function __construct(
+    ProviderRepositoryInterface $providers,
+    ResourceFetcherInterface $resource_fetcher,
+    ClientInterface $http_client,
+    ModuleHandlerInterface $module_handler,
+    CacheBackendInterface $cache_backend,
+    protected ?ConfigFactoryInterface $configFactory = NULL,
+  ) {
     $this->providers = $providers;
     $this->resourceFetcher = $resource_fetcher;
     $this->httpClient = $http_client;
     $this->moduleHandler = $module_handler;
     $this->cacheBackend = $cache_backend;
+    if ($configFactory === NULL) {
+      $this->configFactory = \Drupal::configFactory();
+      @trigger_error('Calling ' . __METHOD__ . ' without the $configFactory argument is deprecated in drupal:11.1.0 and will be required in drupal:12.0.0. See https://www.drupal.org/node/3481570', E_USER_DEPRECATED);
+    }
   }
 
   /**
@@ -136,9 +137,12 @@ public function getProviderByUrl($url) {
       }
     }
 
-    $resource_url = $this->discoverResourceUrl($url);
-    if ($resource_url) {
-      return $this->resourceFetcher->fetchResource($resource_url)->getProvider();
+    if ($this->configFactory->get('media.settings')->get('oembed_discovery')) {
+      $resource_url = $this->discoverResourceUrl($url);
+      if ($resource_url) {
+        return $this->resourceFetcher->fetchResource($resource_url)
+          ->getProvider();
+      }
     }
 
     throw new ResourceException('No matching provider found.', $url);

core/modules/media/tests/src/Functional/Update/MediaSettingsUpdateTest.php

+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\media\Functional\Update;
+
+use Drupal\FunctionalTests\Update\UpdatePathTestBase;
+
+/**
+ * @covers \media_post_update_set_oembed_discovery
+ * @group media
+ */
+class MediaSettingsUpdateTest extends UpdatePathTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setDatabaseDumpFiles(): void {
+    $this->databaseDumpFiles = [
+      __DIR__ . '/../../../fixtures/update/11.0-x-minimal-media.php.gz',
+    ];
+  }
+
+  /**
+   * Tests update path for media oembed discovery setting.
+   */
+  public function testRunUpdates(): void {
+    self::assertNull(\Drupal::config('media.settings')->get('oembed_discovery'));
+    $this->runUpdates();
+    self::assertTrue(\Drupal::config('media.settings')->get('oembed_discovery'));
+  }
+
+}

core/modules/media/tests/src/Functional/UrlResolverTest.php

@@ -4,6 +4,7 @@
 
 namespace Drupal\Tests\media\Functional;
 
+use Drupal\media\OEmbed\ResourceException;
 use Drupal\Tests\media\Traits\OEmbedTestTrait;
 
 // cspell:ignore dailymotion
@@ -115,6 +116,11 @@ public static function providerUrlDiscovery() {
         'video_dailymotion.html',
         'https://www.dailymotion.com/services/oembed?url=video_dailymotion.html',
       ],
+      'Discovery disabled' => [
+        'video_dailymotion.html',
+        'https://www.dailymotion.com/services/oembed?url=video_dailymotion.html',
+        FALSE,
+      ],
     ];
   }
 
@@ -125,6 +131,8 @@ public static function providerUrlDiscovery() {
    *   The asset URL to resolve.
    * @param string $resource_url
    *   The expected oEmbed resource URL of the asset.
+   * @param bool $discovery_enabled
+   *   Whether to enable oEmbed resource discovery.
    *
    * @covers ::discoverResourceUrl
    * @covers ::getProviderByUrl
@@ -132,7 +140,11 @@ public static function providerUrlDiscovery() {
    *
    * @dataProvider providerUrlDiscovery
    */
-  public function testUrlDiscovery($url, $resource_url): void {
+  public function testUrlDiscovery($url, $resource_url, bool $discovery_enabled = TRUE): void {
+    \Drupal::configFactory()->getEditable('media.settings')->set('oembed_discovery', $discovery_enabled)->save();
+    if (!$discovery_enabled) {
+      $this->expectException(ResourceException::class);
+    }
     $this->assertSame(
       $this->container->get('media.oembed.url_resolver')->getResourceUrl($url),
       $resource_url