lzb/allow_unfiltered_html
Decides which users may save raw block markup and view scripts, and run PHP in the block builder preview.
On multisite WordPress gives the unfiltered_html capability to super admins only, so a site administrator opens the block builder and finds the HTML and Script fields silently refusing to save. This filter is the single switch behind that behaviour.
A handler that returns a constant truthy value hands arbitrary PHP execution and unfiltered meta writes to every logged-in user, subscribers included. Always keep a capability or role check in the return value.
Attributes
| Name | Type | Description |
|---|---|---|
$allow_unfiltered_html | Boolean | current_user_can( 'unfiltered_html' ) for the current user |
Four places read the result:
| Where | What a false result does |
|---|---|
guard_unfiltered_block_meta() | blocks direct add_post_meta() and update_post_meta() writes to the keys from lzb/unfiltered_block_meta_keys |
save_meta_boxes() | skips saving lazyblocks_code_editor_html, lazyblocks_code_frontend_html and lazyblocks_script_view |
save_meta_boxes() | runs every other block field through wp_kses_post_deep() |
| block render | returns WP_Error( 'lazy_block_cannot_execute_php' ) instead of evaluating the PHP output method, in the block builder preview only |
The render gate applies only while the block builder preview endpoint is running. A block already saved renders its PHP for every visitor no matter who is looking at the page.
Usage
function my_lzb_allow_unfiltered_html( $allowed ) {
if ( $allowed ) {
return $allowed;
}
// Multisite reserves `unfiltered_html` for super admins. Give block code
// editing back to the administrators of this one site.
return is_multisite()
&& current_user_can( 'manage_options' )
&& current_user_can( 'edit_lazyblocks' );
}
add_filter( 'lzb/allow_unfiltered_html', 'my_lzb_allow_unfiltered_html' );The default is current_user_can( 'unfiltered_html' ), which is true for administrators on a single site and for super admins on multisite. Returning false for everyone leaves the block builder usable, with the HTML, PHP and Script fields dropped on save.