Add video gallery prettyblock

[CySSoO]

Summary

• add everblock_video_gallery with video URL, title and description fields
• render video gallery with modal playback
• style and script support for gallery

Testing

• php -l models/EverblockPrettyBlocks.php
• php -l config/allowed_files.php
• php -l translations/gb.php
• php -l translations/fr.php
• php -l translations/it.php
• php -l translations/nl.php

---

https://chatgpt.com/codex/tasks/task_e_68bacde420c48322964ea6c15106e286

[chatgpt-codex-connector]

Codex Review: Here are some suggestions.

everblock/views/templates/hook/prettyblocks/prettyblock_video_gallery.tpl

Lines 33 to 38 in 1f75f87

	<div class="card {if isset($state.css_class) && $state.css_class}{$state.css_class|escape:'htmlall':'UTF-8'}{/if}">
	<img src="{$state.thumbnail.url|replace:'.webp':'.jpg'}" class="img-fluid cursor-pointer" alt="{$state.title}" title="{$state.title}" loading="lazy" data-block="{$block.id_prettyblocks}" data-video-url="{$state.video_url|escape:'htmlall':'UTF-8'}" data-description="{$state.description|escape:'htmlall':'UTF-8'}" data-bs-toggle="modal" data-bs-target="#videoModal-{$block.id_prettyblocks}">
	{if $state.title || $state.description}
	<div class="card-body">
	{if $state.title}<h5 class="card-title">{$state.title}</h5>{/if}
	{if $state.description}<p class="card-text">{$state.description}</p>{/if}

[P1] Escape user-provided titles in img attributes

The new template injects {$state.title} directly into the alt and title attributes of each thumbnail without escaping. Because these values come from the block configuration, a title containing quotes such as My video" onerror="alert(1) will break the attribute and execute arbitrary HTML/JS when the gallery is rendered. Other attributes in the same tag are already escaped, so these should also be wrapped in |escape:'htmlall':'UTF-8' before outputting.

---

Reply with @codex fix comments to fix any unresolved comments.

About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you open a pull request for review, mark a draft as ready, or comment "@codex review". If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex fix this CI failure" or "@codex address that feedback".