From 01ae799803d1686480e6a9a3e2dfe8688670a362 Mon Sep 17 00:00:00 2001
From: masaton0216 <inoue@opensource-workshop.co.jp>
Date: Wed, 2 Jul 2025 16:46:48 +0900
Subject: [PATCH 1/2] =?UTF-8?q?add:=20WYSIWYG=E3=82=A8=E3=83=87=E3=82=A3?=
 =?UTF-8?q?=E3=82=BF=E3=81=A7=E5=A4=96=E9=83=A8=E3=82=B5=E3=83=BC=E3=83=93?=
 =?UTF-8?q?=E3=82=B9=E3=81=AEiframe=E5=9F=8B=E3=82=81=E8=BE=BC=E3=81=BF?=
 =?UTF-8?q?=E3=82=92=E8=A8=B1=E5=8F=AF=E3=81=99=E3=82=8B=E3=82=BB=E3=82=AD?=
 =?UTF-8?q?=E3=83=A5=E3=83=AA=E3=83=86=E3=82=A3=E8=A8=AD=E5=AE=9A=E3=82=92?=
 =?UTF-8?q?=E8=BF=BD=E5=8A=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 resources/views/plugins/common/wysiwyg.blade.php | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/resources/views/plugins/common/wysiwyg.blade.php b/resources/views/plugins/common/wysiwyg.blade.php
index 55c18e1b8..a66e6c344 100644
--- a/resources/views/plugins/common/wysiwyg.blade.php
+++ b/resources/views/plugins/common/wysiwyg.blade.php
@@ -269,6 +269,21 @@
 </script>
 <script type="text/javascript">
     tinymce.init({
+        // see) https://www.tiny.cloud/docs/tinymce/latest/content-filtering/#sandbox-iframes-exclusions
+        sandbox_iframes: true,
+        // ホワイトリストにはTinyMCEのデフォルト値を設定
+        sandbox_iframes_exclusions: [
+            'youtube.com',
+            'youtu.be',
+            'vimeo.com',
+            'player.vimeo.com',
+            'dailymotion.com',
+            'embed.music.apple.com',
+            'open.spotify.com',
+            'giphy.com',
+            'dai.ly',
+            'codepen.io'
+        ],
         @if(isset($target_class) && $target_class)
             selector : 'textarea.{{$target_class}}',
         @else

From aa5a91899ec29f703d7e5e441de72cefcbb6cc36 Mon Sep 17 00:00:00 2001
From: masaton0216 <inoue@opensource-workshop.co.jp>
Date: Wed, 2 Jul 2025 17:05:16 +0900
Subject: [PATCH 2/2] =?UTF-8?q?add:=20WYSIWYG=E3=82=A8=E3=83=87=E3=82=A3?=
 =?UTF-8?q?=E3=82=BF=20=E5=A4=96=E9=83=A8=E3=82=B5=E3=83=BC=E3=83=93?=
 =?UTF-8?q?=E3=82=B9=E3=81=AEiframe=E5=9F=8B=E3=82=81=E8=BE=BC=E3=81=BF?=
 =?UTF-8?q?=E3=82=92=E8=A8=B1=E5=8F=AF=E3=83=9B=E3=83=AF=E3=82=A4=E3=83=88?=
 =?UTF-8?q?=E3=83=AA=E3=82=B9=E3=83=88=E3=81=ABgoogle.com=E3=82=92?=
 =?UTF-8?q?=E8=BF=BD=E5=8A=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 resources/views/plugins/common/wysiwyg.blade.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/resources/views/plugins/common/wysiwyg.blade.php b/resources/views/plugins/common/wysiwyg.blade.php
index a66e6c344..447e94b9d 100644
--- a/resources/views/plugins/common/wysiwyg.blade.php
+++ b/resources/views/plugins/common/wysiwyg.blade.php
@@ -279,6 +279,7 @@
             'player.vimeo.com',
             'dailymotion.com',
             'embed.music.apple.com',
+            'google.com',
             'open.spotify.com',
             'giphy.com',
             'dai.ly',