[Vitorinox]

Summary

Mastodon's oEmbed (/api/oembed, already used by Embed) returns a <blockquote class="mastodon-embed" data-embed-url=".../embed"> plus <script src=".../embed.js">. Sites that strip scripts end up with a "View on Mastodon" link instead of the post.

This adds an opt-in mastodon:iframe setting (default false). When enabled, that html is replaced with:

<iframe src="https://<host>/@user/<id>/embed" class="mastodon-embed" style="max-width: 100%; border: 0" width="400" sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox" allowfullscreen="allowfullscreen" loading="lazy"></iframe>

• Generic: detected from the oEmbed html, so it works on any Mastodon server, not a host list.
• Only used when data-embed-url is https, ends in /embed and is on the same host as the requested post. Otherwise the original html is kept.
• Width comes from oEmbed (400 on current Mastodon). Height is null because Mastodon does not report one.
• Default behaviour is unchanged.

Tests

• Fixtures: fosstodon.org/@AkaSci/117514634840174369, hachyderm.io/@briancmoses/117514657412674435 (default output, blockquote).
• tests/MastodonIframeTest.php: the same recorded responses with and without the setting, plus a cross-host embed URL, a non-https embed URL and non-Mastodon html.
• No existing fixture changed.
• Local: PHPUnit OK (250 tests) on PHP 7.4, 8.1 to 8.5; PHPStan clean. PHP 8.0 could not run locally with the installed PHPUnit; left to CI.

Not confirmed

• mastodon.social could not be reached from the test machine.
• The right iframe height: without embed.js the iframe does not resize, so the README tells users to set a height in CSS.

Note: the CHANGELOG entry is 4.6.0; if #585 (4.5.3) merges first, the compare links may need a rebase.