v1.2.0

Repoint the self-updater to CHIROBASIX-LLC/cbx-plugins-allow-iframes and fix the stale lowercase-org owner. Install this build before the repo is renamed so updates keep flowing. No functional change to iframe handling.

v1.1.0 — Restore stripped iframes for non-admin users

Fixes the case where the WP REST user is role `author` rather than `administrator`. The v1.0.0 cap grant only applied to admins, so authors still had iframes stripped by kses.

What's new

Layer 3 — `rest_after_insert_podcast` restoration

After WP's REST API finishes processing a podcast create/update, this hook compares what's actually in postmeta against what the client originally sent. If a trusted iframe was stripped, it's restored via direct `update_post_meta()` — bypasses kses, ACF filters, and any other sanitization layer entirely.

This is the reliable fix for the common case (most practice WP users are role `author`, not admin).

XSS protection unchanged

The trusted-host allow-list still applies. An iframe pointing at `evil.example.com` would fail the host check in Layer 3 and stay stripped. Allowed hosts:

• `player.rss.com`, `rss.com`
• `www.youtube.com`, `youtube.com`, `youtu.be`
• `player.vimeo.com`, `vimeo.com`
• `open.spotify.com`, `embed.podcasts.apple.com`

Layer summary

1. `map_meta_cap` grant — admins get `unfiltered_html` back (unchanged from v1.0.0)
2. `wp_kses_allowed_html` — context=post iframe whitelist (unchanged)
3. NEW: `rest_after_insert_podcast` — direct postmeta restore for stripped trusted iframes
4. `acf/update_value/name=embed_code` — trusted-host enforcement on every save (refactored to share Layer 3's helpers)

v1.0.0 — Initial release

First release. Grants the `unfiltered_html` capability to administrators on WP Engine sites and enforces a trusted-host whitelist for `<iframe>` tags saved into the podcast `embed_code` ACF field.

What this fixes

When the Copilot publishes a podcast episode it POSTs to `/wp-json/wp/v2/podcast` with an `acf.embed_code` value containing an `<iframe>` to RSS.com's player. WordPress's `wp_kses_post()` filter strips the iframe (returning an empty string) unless the authenticated user has the `unfiltered_html` capability — and WP Engine disables that capability by default for every role. Result: the podcast post is created successfully but the player never renders on the live page. Confirmed on cityview-chiropractic and alter-chiropractic.

What this plugin does

1. Re-grants `unfiltered_html` to anyone with `manage_options` (Administrators) via `map_meta_cap`, overriding WP Engine's default deny.
2. Whitelists `<iframe>` for kses as a belt-and-suspenders backstop.
3. Restricts iframe `src` on `embed_code` to a small trusted-host list (RSS.com, YouTube, Vimeo, Spotify, Apple Podcasts) via `acf/update_value/name=embed_code` so XSS protection isn't fully disabled.
4. Includes a GitHub self-updater — once seeded on a site, future versions roll out automatically without SSH.