From 98474d4ff6117de3b05faaf0228b03997f95771c Mon Sep 17 00:00:00 2001
From: CodeDevMLH <145071728+CodeDevMLH@users.noreply.github.com>
Date: Fri, 6 Mar 2026 03:01:34 +0100
Subject: [PATCH] Refactor YouTube player integration to use iframe for
 improved performance and security

---
 .../Web/mediaBarEnhanced.js                   | 46 ++++++++-----------
 1 file changed, 18 insertions(+), 28 deletions(-)

diff --git a/Jellyfin.Plugin.MediaBarEnhanced/Web/mediaBarEnhanced.js b/Jellyfin.Plugin.MediaBarEnhanced/Web/mediaBarEnhanced.js
index 73f57f2..814d54b 100644
--- a/Jellyfin.Plugin.MediaBarEnhanced/Web/mediaBarEnhanced.js
+++ b/Jellyfin.Plugin.MediaBarEnhanced/Web/mediaBarEnhanced.js
@@ -742,17 +742,20 @@ const SlideUtils = {
     }
 
     if (isYoutube && videoId) {
-      const playerDiv = this.createElement('div', { id: 'modal-yt-player' });
-      contentContainer.appendChild(playerDiv);
+      const ytIframe = this.createElement('iframe', {
+        id: 'modal-yt-player',
+        src: `https://www.youtube-nocookie.com/embed/${videoId}?enablejsapi=1&origin=${encodeURIComponent(window.location.origin)}`,
+        allow: 'autoplay; encrypted-media',
+        style: 'width: 100%; height: 100%; border: none;',
+      });
+      ytIframe.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
+
+      contentContainer.appendChild(ytIframe);
       overlay.append(closeButton, contentContainer);
       document.body.appendChild(overlay);
 
       this.loadYouTubeIframeAPI().then(() => {
-        new YT.Player('modal-yt-player', {
-          height: '100%',
-          width: '100%',
-          videoId: videoId,
-          host: 'https://www.youtube-nocookie.com',
+        new YT.Player(ytIframe, {
           playerVars: {
             autoplay: 1,
             controls: 1,
@@ -761,14 +764,6 @@ const SlideUtils = {
             playsinline: 1,
             origin: window.location.origin,
             enablejsapi: 1
-          },
-          events: {
-            'onReady': (event) => {
-              const iframe = event.target.getIframe();
-              if (iframe) {
-                iframe.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
-              }
-            }
           }
         });
       });
@@ -1750,12 +1745,16 @@ const SlideCreator = {
             style: "opacity: 0; transition: opacity 1.2s ease-in-out;" // Start interrupted/transparent
         });
 
-        const ytPlayerDiv = SlideUtils.createElement("div", {
+        // Create an iframe upfront
+        const ytPlayerIframe = SlideUtils.createElement("iframe", {
           id: `youtube-player-${itemId}`,
-          style: "width: 100%; height: 100%;"
+          src: `https://www.youtube-nocookie.com/embed/${videoId}?enablejsapi=1&origin=${encodeURIComponent(window.location.origin)}`,
+          style: "width: 100%; height: 100%; border: none;",
+          allow: "autoplay; encrypted-media",
+          referrerpolicy: "strict-origin-when-cross-origin"
         });
         
-        videoBackdrop.appendChild(ytPlayerDiv);
+        videoBackdrop.appendChild(ytPlayerIframe);
 
         // Initialize YouTube Player
         SlideUtils.loadYouTubeIframeAPI().then(() => {
@@ -1800,19 +1799,10 @@ const SlideCreator = {
               console.info(`SponsorBlock outro detected for video ${videoId}: ending at ${playerVars.end}s`);
             }
 
-            STATE.slideshow.videoPlayers[itemId] = new YT.Player(`youtube-player-${itemId}`, {
-              height: '100%',
-              width: '100%',
-              videoId: videoId,
-              host: 'https://www.youtube-nocookie.com',
+            STATE.slideshow.videoPlayers[itemId] = new YT.Player(ytPlayerIframe, {
               playerVars: playerVars,
               events: {
                 'onReady': (event) => {
-                  const iframe = event.target.getIframe();
-                  if (iframe) {
-                    iframe.setAttribute('referrerpolicy', 'strict-origin-when-cross-origin');
-                  }
-
                   // Store start/end time and videoId for later use
                   event.target._startTime = playerVars.start || 0;
                   event.target._endTime = playerVars.end || undefined;