lzb/unfiltered_block_meta_keys

Lists the block meta keys only a user with unfiltered_html may write.

WordPress lets XML-RPC and the custom fields box write post meta straight past the block builder REST endpoint, where these fields are normally checked. Lazy Blocks closes that path with an add_post_metadata and update_post_metadata guard, and this filter is the list the guard works from.

Attributes

The three defaults are the fields that end up on the page as markup or as a script tag. A write to any of them on a lazyblocks post returns false from the guard, which cancels the meta write, unless lzb/allow_unfiltered_html says the current user may save unfiltered HTML.

Posts of other types never reach the check, so adding a key that a plugin also stores on regular posts costs nothing there.

Usage

function my_lzb_unfiltered_block_meta_keys( $keys ) {
  // Block CSS is written into a <style> tag, so give it the same guard
  // the HTML and script fields have.
  $keys[] = 'lazyblocks_style_block';
  $keys[] = 'lazyblocks_style_editor';
 
  return $keys;
}
 
add_filter( 'lzb/unfiltered_block_meta_keys', 'my_lzb_unfiltered_block_meta_keys' );

Adding a key narrows who can write it. Removing one of the three defaults reopens the direct meta path for that field to any user who can edit a block, which is what the guard exists to prevent. The filter runs on every add_post_meta() and update_post_meta() call on the site, so keep the handler free of database queries.