Security fix — please update
The player's link-blocking protection was accidentally disabled and shipped that way for several releases. Without it, YouTube's in-player buttons (video title, channel watermark, "Watch on YouTube") could take a child out of BrainRotGuard and into a full browser YouTube session, bypassing the whole approval system.
It was switched off to work around what looked like broken playback on a test tablet. The real cause turned out to be a DNS outage, but the protection was never switched back on. It is now restored.
Fixed
- Restored the player
sandboxprotection that blocks YouTube's in-video links (fixes #42 — thanks @bquinn916) - Added
playsinline=1so iOS keeps video inside the app. Without it, iPads hand playback to Apple's native fullscreen player, which renders outside the app and bypasses the pause and end-of-video overlays that normally cover YouTube's suggested videos. This is why the problem was worse on iPad than Android - Fixed a test that had been failing since the service worker cache version was bumped
Please note
- The player fixes are unverified on iOS hardware — there are no Apple devices available for testing, so they are reasoned from documented iOS behaviour rather than observed. If videos stop playing on your iPad, please open an issue immediately
- iPad users: enable Guided Access (Settings > Accessibility > Guided Access) as an OS-level lock on top of this fix. It locks the tablet to a single app and does not depend on this fix being correct
- Playback still requires a signed-in Google session on the tablet to avoid YouTube's "confirm you're not a bot" wall
Upgrade
git pull
docker compose down && docker compose build && docker compose up -d