Comment 1 for bug 1513276

So, currently iframe sources are set up at install time by a list in core_postinst().

Except the prezi one, which was added later and is installed via the postinst() method of the externalvideo blocktype.

And the youtube-nocookie.com one was added to the externalvideo blocktype *upgrade*, but not to either installer.

It's not great that these things are scattered everywhere, because it makes it hard for devs to know where to look when they're doing something as simple as adding a new allowed iframe source. Technically speaking, allowed iframe sources are not the domain of *any* specific plugin. They're used by everything that uses TinyMCE, as well as the externalvideo block (and maybe some other places?). I guess we could make them into a dependency of pieforms, or make them into their own module.

But it would be a good (easy) start at least, if we put them all into the externalvideo postinst, or into core_postinst().