Mixcloud object embed code is not accepted

[Kristina Hoeppner]

via http://twitter.com/captain_jen/statuses/65464212100612097

I tested on demo (1.3) and master.dev with the following embed code from the site:
---
<div><object width="300" height="300"><param name="movie" value="http://www.mixcloud.com/media/swf/player/mixcloudLoader.swf?v=106"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><param name="flashVars" value="feed=http://www.mixcloud.com/api/1/cloudcast/moguai/punx-up-the-volume-episode-28.json&embed_uuid=3b9f1321-4fd3-4ecf-b934-d434de8ddd1f&embed_type=widget_standard"></param><embed src="http://www.mixcloud.com/media/swf/player/mixcloudLoader.swf?v=106" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" flashvars="feed=http://www.mixcloud.com/api/1/cloudcast/moguai/punx-up-the-volume-episode-28.json&embed_uuid=3b9f1321-4fd3-4ecf-b934-d434de8ddd1f&embed_type=widget_standard" width="300" height="300"></embed></object><div style="clear:both; height:3px;"></div><p style="display:block; font-size:12px; font-family:Helvetica, Arial, sans-serif; margin:0; padding: 3px 4px 3px 4px; color:#999;"><a href="http://www.mixcloud.com/moguai/punx-up-the-volume-episode-28/?utm_source=widget&amp;utm_medium=web&amp;utm_campaign=base_links&amp;utm_term=cloudcast_link" target="_blank" style="color:#02a0c7; font-weight:bold;">Punx Up The Volume - Episode 28</a> by <a href="http://www.mixcloud.com/moguai/?utm_source=widget&amp;utm_medium=web&amp;utm_campaign=base_links&amp;utm_term=profile_link" target="_blank" style="color:#02a0c7; font-weight:bold;">Moguai</a> on <a href="http://www.mixcloud.com/?utm_source=widget&amp;utm_medium=web&amp;utm_campaign=base_links&amp;utm_term=homepage_link" target="_blank" style="color:#02a0c7; font-weight:bold;"> Mixcloud</a></p><div style="clear:both; height:3px;"></div></div>
---

The object is embedded. It does spin, but it does not load anything.

[Darryl Hamilton (lordp)]

I think HTMLPurifier is changing some of the needed attributes (allowScriptAccess and/or allowNetworking) to 'safe' values, and this is blocking the code from working.

[François Marier (fmarier)]

Ideally, we should report this upstream and get it fixed there.

[Kristina Hoeppner (kris-hoeppner)]

Since this was reported, Mixcloud switched to iframe embed code which can be added easily to the "Allowed iframe sources" on a site on demand.