Videos not showing in mixed photo and video galleries

My guess is that this is happening due to a security configuration on your site. When I look at the Console on your site while trying to play a video, I see messages of this sort:

Refused to load media from 'https://photos.smugmug.com/photos/i-LFChrxH/0/1920/i-LFChrxH-1920.mp4' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'media-src' was not explicitly set, so 'default-src' is used as a fallback.

This comes when you have your site configured to specifically allow downloaded content only from certain sites. It is definitely not a Photonic setting. I can use the same shortcode you have on my site and have it working perfectly.

You might have enabled some feature in a security plugin that is doing this for you. In your setup, you don’t have SmugMug whitelisted for media (as per MDN, the setting applies to audio and video, and not images, which is why your images work fine).

Thank you. Actually last month I wrote to you (see a few posts down) and it was working. I have not changed any settings on the site so am not sure. You mentioned Mozilla but the browser I use is Safari

i have to ask my host. Where do I whitelist the plugin?.

Actually last month I wrote to you (see a few posts down) and it was working. I have not changed any settings on the site so am not sure.

Since Photonic also has not changed (it changed yesterday, but I don’t think you are using the new version yet), this would indicate a change elsewhere on your site, like a new plugin, or an update to your existing plugins or a hosting configuration change.

You mentioned Mozilla but the browser I use is Safari

Just the link I provided is from Mozilla Developer Network (or MDN), which is not related to the Mozilla browser at all. MDN is simply an authoritative source of information.

i have to ask my host. Where do I whitelist the plugin?

It is not a plugin whitelist. Rather, you have to whitelist media from https://photos.smugmug.com. I don’t know how your host has configured it – they are best positioned to answer the question. Ask them to change their “Content Security Policy” (or CSP) to allow media from SmugMug.

• This reply was modified 1 year, 11 months ago by Sayontan Sinha.

It looks like your server has it defined. I am seeing this coming in your HTTP response header:

content-security-policy: upgrade-insecure-requests; default-src 'self'; style-src * 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: matomo.beeches.it *.typekit.net *.twitter.com *.google.com *.gstatic.com *.googleapis.com *.google-analytics.com *.youtube.com *.paypal.com cdn.ckeditor.com cdnjs.cloudflare.com js.stripe.com *.wp.com plausible.io; img-src * data:; font-src * data:; frame-src 'self' *.google.com *.youtube.com *.wp.com *.twitter.com *.soundcloud.com *.youtube-nocookie.com *.paypal.com onedrive.live.com js.stripe.com; connect-src 'self' matomo.beeches.it *.googleapis.com plausible.io;

So, your host seems to have whitelisted some websites, and since they don’t have a media-src declaration, it is picking the default-src declaration, which is disallowing external videos. Your host seems to be allowing scripts from various locations, though.

Problem solved. My host said:

“Should be working now I think, but please check.

“Photonic’s diagnosis was correct. What happened was I removed some old “experimental” security headers beginning with ‘X-‘ that are used to prevent cross-site scripting and “clickjacking” attacks. They’re now deprecated so I replaced them with the modern equivalent which is “content-security-policy”. I did check your sites but missed these pages, sorry. Apologies for any inconvenience”.

Thanks for giving me the clear directions and helping my host pinpoint the issue!!!!!