def GET_mediaembed(self, liveupdate, embed_index): if c.errors or request.host != g.media_domain: # don't serve up untrusted content except on our # specifically untrusted domain abort(404) try: media_object = liveupdate.media_objects[embed_index] except IndexError: abort(404) embed = get_live_media_embed(media_object) if not embed: abort(404) content = embed.content c.allow_framing = True args = { "body": content, "unknown_dimensions": not (embed.width and embed.height), "js_context": { "liveupdate_id": unicode(liveupdate._id), # UUID serializing "embed_index": embed_index, } } return pages.LiveUpdateMediaEmbedBody(**args).render()