Confirmed Unlisted Vimeo videos lose their private hash when embedded

[Chris D]

Affected version

2.3.13

Since 2.2.12, embedding an unlisted Vimeo video (https://vimeo.com/<id>/<hash>) renders a player URL without its ?h=<hash> parameter, so the video doesn't play.

XF\BbCode\Helper\Vimeo::htmlCallback() decides whether each part of the media key is a start time with preg_match('/[0-9]+/', $info), which isn't anchored. A private hash almost always contains a digit, so it's taken as the start time: the iframe gets #t=<hash>s and no ?h=. This was introduced when XF-207861 changed the pattern from /[0-9]+[hms]/.

The media key is stored correctly, so anchoring the patterns (/^\d+$/ for the start time, /^[0-9a-f]+$/ for the hash) fixes existing posts too.

Separately, the Vimeo URL patterns don't match the ?share=copy links from Vimeo's Share button, www.vimeo.com, player.vimeo.com/video/<id>, or channel and showcase URLs.