-
Notifications
You must be signed in to change notification settings - Fork 4.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Block API: Allow block transforms to handle iframes for non-admin users. #19086
Conversation
Could some sort of test be added? |
Added a new test, stripped down the number of filters that are re-run over the pasted content. |
@@ -57,6 +56,28 @@ describe( 'Blocks raw handling', () => { | |||
}, | |||
save: () => null, | |||
} ); | |||
|
|||
registerBlockType( 'test/iframe-handler', { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see that it's been done previously, but why are we adding this block type for every test? Shouldn't we isolate it to the test?
} | ||
|
||
pieceBlock.attributes.content = deepFilterHTML( pieceBlock.attributes.content, iframeFilters, blockContentSchema ); | ||
pieceBlock.attributes.content = removeInvalidHTML( pieceBlock.attributes.content, schema ); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this pathway tested? The tests seem to pass even with the code removed.
@pento This PR makes me wonder if removing the iframe on paste is actually the right behaviour. Wouldn't it be simpler to let the iframe be pasted, regardless if you can post them or not? The paste handler should ideally not be dependent on any user capabilities. If a user cannot use iframes in a post, they should be removed on publish or on rendering the post, which already happens? After all, they could still paste the iframes in HTML mode. How about just removing the filter? |
f46a9d5
to
fe45a15
Compare
Thanks for the review, @ellatrix.
I have no strong feelings either way: I understand why it exists, as if you paste an iframe as an Author, there's no indication that it'll be removed until you either preview/publish, or reload the block editor. But, you're right that the code would be simpler without this check.
I'm not so concerned about this, since HTML mode has always been a "warranty is neither expressed nor implied" scenario. |
I've been thinking a bit more about this...
I therefore propose to always convert iframes to a plain URL from its source attribute.
I'll follow up with a new PR. |
Fixed by #20983. |
Description
Fixes #18389.
In the event that a block has a
raw
transform which turns an iframe into a block, it isn't able to do so for non-admin users, since the iframe is stripped from the content beforehtmlToBlocks()
is run inpasteHandler()
.This PR allows
htmlToBlocks()
to run before stripping any iframes that weren't handled by block transforms.How has this been tested?
Testing in conjunction with #19084 and Automattic/jetpack#13999, Google Calendar iframes are transformed into Google Calendar blocks.
Alternatively, this can be tested with the routine described in #18389.
Checklist: