1

With kses filtering, WordPress only allows a subset of html tags within a post or page, and one of the tags it strips out is the <iframe> tag (for many good reasons).

I'd like to allow editors to include iframes where the src is from one of our other subdomains, or from a specified whitelist of domains, but still strip out other unknown src's. It is straightforward to bypass kses to allow all <iframe>'s, but is it possible to only allow certain domains?

2
  • What do you think about making it with shortcodes? Take a look at this plugin wordpress.org/plugins/iframe. Find there shortcode process function and add validation for domain with parse_url function. If this solution is good for you, I can help to write the function Aug 23, 2017 at 18:27
  • Thats a great idea! I got caught up looking up wp-kses options and didn't even consider a shortcode. Perfect. Thanks!
    – joetek
    Aug 23, 2017 at 18:55

1 Answer 1

1

I'd register an embed handler with wp_embed_register_handler. This gives you the added benefit of being able to just copy and paste the url into the editor as well as seeing a preview of the iframe.

add_action( 'init', 'se238330_register_embed_handler' );

function se238330_register_embed_handler() {
    wp_embed_register_handler( 
        'joetek',
        '#http://subdomain.yourdomain\.com/(.+)/?#i',
        'wp_embed_handler_joetek'
    );
}

function wp_embed_handler_embed_name( $matches, $attr, $url, $rawattr ) {
    $embed = sprintf(
        '<iframe class="joetek-website" src="http://subdomain.yourdomain.com/%1$s/" width="600" height="400" frameborder="0" scrolling="no"></iframe>',
        esc_attr( $matches[1] )
    );

    return apply_filters( 'embed_joetek', $embed, $matches, $attr, $url, $rawattr );
}

The code above assumes that joetek is the name of your embed :) You'd need to update the regex in the second parameter of wp_embed_register_handler as well as in the callback function to match the pages you want to be able to embed on your website.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.