iFrames Stripped During Update to Version 5


#1

All our Youtube videos and other embedded iFrame content was removed after our Unizin site was updated over the weekend. The process appears to have created new versions of affected chapters. iFrames appear in the revision history, and can theoretically be restored, but is there anything that can be done other than manual update/restoration at this point?


#2

Hi @shiflet.16 (cc @SteelWagstaff) , this looks like an issue that arose from a core Pressbooks upgrade routine interacting with WordPress’ handling of <iframe> elements.

For security reasons, <iframe> elements are stripped from a post whenever it is saved by a user without the unfiltered_html capability. See discussion of this here. Many users use plugins like this one to embed iframe elements without risk of them being stripped out (WordPress is so strict about this that if a user with the author or editor role edits an existing post with an <iframe> it will be removed).

When upgrading from Pressbooks 4.x to Pressbooks 5.x, some chapter statuses need to be updated. The code that does this doesn’t change the content, just the post status, but if an iframe is in the chapter content, WordPress will strip it out when the chapter is saved with the new status during the upgrade routine.

I don’t think there’s a safe way to automate the restoration the the missing iframe elements, so the best bet is restoring from revisions. However, we’ll be releasing Pressbooks 5.1 next week which explicitly allows all users with permissions to edit content to add and save posts with <iframe> elements from approved sources in them as part of our new interactive content support feature. This should prevent any further data loss of this kind, and we’re open to adding more sources to that list as needed. You can also safely embed YouTube videos and many other sources supported by the OEmbed protocol simply by pasting the URL into the content editor, which makes the use of <iframe> elements unnecessary for many use cases.

Sorry about this issue, and I hope this information is helpful!


#3

Thanks Ned—yes, annoying but also helpful. We’ll send a message to our users shortly with more information about how to get around this. We prefer to use oEmbed whenever possible, but there are some iFrame elements which don’t yet support it, or users that aren’t aware of oEmbed as an option.


#4

Generally speaking I think the best bet is to avoid directly embedding <iframe> elements wherever possible. So a plugin like the one I linked (which seems to be widely used in education contexts) might be worth looking at as a stopgap. Also, OEmbed is great.


#5

UPDATE: I am working on a fix for the Pressbooks 4.x to Pressbooks 5.x upgrade routine that should address the iframe removal. This will be rolled into Pressbooks 5.0.1 which I plan to release tomorrow. In the meantime, I would suggest rolling back to Pressbooks 4.5.1 and snapshots prior to the upgrade to recover the lost data, and then upgrading again once the patch is available. Sorry again for the inconvenience.