Hey @brianteeman , not sure if this answers your question, but the idea for the sandbox_iframes parameter was: when we go to TinyMCE 7 it should still stay at "true", so all entries get sandboxed by default (and the plugin parameter we added to disable it could be removed) but additionally the current domain should be allowed via: sandbox-iframes-exclusions.
Also an extra field should be added, where people can add more domains to allow them.

One concern is, how to prevent, that people open the joomla installation with another domain and add iframes for this domain (as it's then allowed automatically).

Thanks, that answers most of it I think. Will add the exclusion field

@brianteeman @bembelimen according to their docs you shouldn't expose the switch to turn on/off the sandboxing as an empty array is doing exactly that: To enable [sandboxing](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox) on all iframes, set this option to an empty array [].

In sort the sandbox_iframes_exclusions should be an array with default value the value of tinymce (is given in the link above):

[
  'youtube.com',
  'youtu.be',
  'vimeo.com',
  'player.vimeo.com',
  'dailymotion.com',
  'embed.music.apple.com',
  'open.spotify.com',
  'giphy.com',
  'dai.ly',
  'codepen.io'
]

yes I know. I am still working on it (or will be tonight when care duties end) or you can submit a pr to this draft branch ;)

@bembelimen I think I got it correct now

Should it be only the domain name without http?

Should it be only the domain name without http?

??

These are listed without http. Should the additional values be host names or domain names (without http)?

[
  'youtube.com',
  'youtu.be',
  'vimeo.com',
  'player.vimeo.com',
  'dailymotion.com',
  'embed.music.apple.com',
  'open.spotify.com',
  'giphy.com',
  'dai.ly',
  'codepen.io'
]

These are listed without http. Should the additional values be host names or domain names (without http)?

[
  'youtube.com',
  'youtu.be',
  'vimeo.com',
  'player.vimeo.com',
  'dailymotion.com',
  'embed.music.apple.com',
  'open.spotify.com',
  'giphy.com',
  'dai.ly',
  'codepen.io'
]

The current domain and this list of common domains are excluded by default.

Yes, I understand. but when adding new ones to the exclusions list, there is a hint https:// so maybe it can be interpreted to prefix it with https://.

I understand you now. Thanks for your perseverance I will look into it in the morning

Note to self
Review the skins and themes https://www.tiny.cloud/docs/tinymce/latest/customize-ui/

I rebase this for now to 5.3 (actually 6.0 should be the target), since it's late in the cycle and actually it might be a b/c break if tinymce follows semver. If maintainers/production has finally discussed this a rebase to 5.2 is possible.
So please don't update the branch to 5.3 code

@HLeithner I specifically asked which version to make this for and was told #43110 (comment) - please make up your minds