Allow editor to use IFRAME code only but disable javascript code?

Hi @zearth,

Can you provide more context please ? If you are talking about embed block, it only take a valid url as argument. Are you talking about the script inside the iframe generated by embed block ? If it that you will have to add filter on embed block to add an attribute sandbox to the iframe

I want our editors to be able to embed <iframe> code only in the post editor. We don’t want them to post some javascript codes like <script>codes</script>. In this way the content being push to the frontend will allow them only to use iframe and no javascript embed codes in the editor content.

I found alternative solution, here is my temp solution to prevent javascript code insert from non administrator.

function filterjs( $data, $postarr, $unsanitized_postarr){

global $current_user;

$roleko = $current_user->roles[0];

if($roleko == 'administrator') {

} else {

$postcontent = $data['post_content'];

$postcontent = str_replace('<script','&lt;script',$postcontent );

$postcontent = str_replace('</script>','&lt;/script&gt;',$postcontent );

$data['post_content'] = ?$postcontent ;

}

return $data;

}

add_filter( 'wp_insert_post_data', 'filterjs',10,3);