From 3e069563855c171a4d0da6df00e14068bf083491 Mon Sep 17 00:00:00 2001
From: mricoul <mricoul@beapi.fr>
Date: Mon, 20 Apr 2026 17:09:36 +0200
Subject: [PATCH 1/5] fix(blueprint): allow iframe tags in playground content

Adds a must-use plugin to the blueprint that filters `wp_kses_allowed_html` to permit iframes. This ensures the demo page content isn't stripped of its iframe elements by WordPress's security filters.
---
 .wordpress-org/blueprints/blueprint.json | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.wordpress-org/blueprints/blueprint.json b/.wordpress-org/blueprints/blueprint.json
index 3bc0ca6..2686492 100644
--- a/.wordpress-org/blueprints/blueprint.json
+++ b/.wordpress-org/blueprints/blueprint.json
@@ -24,6 +24,10 @@
 			"username": "admin",
 			"password": "password"
 		},
+		{
+			"step": "runPHP",
+			"code": "<?php\nrequire_once 'wordpress/wp-load.php';\n$dir = WP_CONTENT_DIR . '/mu-plugins';\nif ( ! is_dir( $dir ) ) {\n\twp_mkdir_p( $dir );\n}\n$file = $dir . '/blockparty-modal-playground-iframe-kses.php';\n$lines = array(\n\t'<?php',\n\t'add_filter( \\'wp_kses_allowed_html\\', function( $tags, $context ) {',\n\t'\tif ( \\'post\\' !== $context ) {',\n\t'\t\treturn $tags;',\n\t'\t}',\n\t'\t$tags[\\'iframe\\'] = array(',\n\t'\t\t\\'src\\' => true,',\n\t'\t\t\\'class\\' => true,',\n\t'\t\t\\'style\\' => true,',\n\t'\t\t\\'id\\' => true,',\n\t'\t\t\\'title\\' => true,',\n\t'\t);',\n\t'\treturn $tags;',\n\t'}, 10, 2 );',\n);\nfile_put_contents( $file, implode( \"\\n\", $lines ) . \"\\n\" );\necho file_exists( $file ) ? 'mu-plugin installed' : 'mu-plugin failed';\n?>"
+		},
 		{
 			"step": "runPHP",
 			"code": "<?php require_once 'wordpress/wp-load.php'; $page_content = '<!-- wp:blockparty/iframe {\"title\":\"Johannes Gutenberg — Wikipédia\",\"url\":\"https://en.wikipedia.org/wiki/Johannes_Gutenberg\",\"align\":\"wide\"} -->\n<div class=\"wp-block-blockparty-iframe alignwide\"><iframe title=\"Johannes Gutenberg — Wikipédia\" src=\"https://en.wikipedia.org/wiki/Johannes_Gutenberg\" loading=\"eager\"></iframe></div>\n<!-- /wp:blockparty/iframe -->'; $page_id = wp_insert_post( array( 'post_title' => 'Blockparty Iframe', 'post_name' => 'blockparty-iframe-demo', 'post_content' => $page_content, 'post_status' => 'publish', 'post_type' => 'page' ) ); echo 'Page created with ID: ' . $page_id; ?>"

From 4ac12068a35386c687dd73c221ba19aff5ad6392 Mon Sep 17 00:00:00 2001
From: mricoul <mricoul@beapi.fr>
Date: Mon, 20 Apr 2026 17:11:31 +0200
Subject: [PATCH 2/5] fix(blueprint): rename kses mu-plugin file

Renames the must-use plugin file responsible for filtering allowed HTML tags in the Playground environment. While the filename now mentions SVG, the current implementation continues to permit iframe tags to ensure demo content renders correctly.
---
 .wordpress-org/blueprints/blueprint.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.wordpress-org/blueprints/blueprint.json b/.wordpress-org/blueprints/blueprint.json
index 2686492..95c879e 100644
--- a/.wordpress-org/blueprints/blueprint.json
+++ b/.wordpress-org/blueprints/blueprint.json
@@ -26,7 +26,7 @@
 		},
 		{
 			"step": "runPHP",
-			"code": "<?php\nrequire_once 'wordpress/wp-load.php';\n$dir = WP_CONTENT_DIR . '/mu-plugins';\nif ( ! is_dir( $dir ) ) {\n\twp_mkdir_p( $dir );\n}\n$file = $dir . '/blockparty-modal-playground-iframe-kses.php';\n$lines = array(\n\t'<?php',\n\t'add_filter( \\'wp_kses_allowed_html\\', function( $tags, $context ) {',\n\t'\tif ( \\'post\\' !== $context ) {',\n\t'\t\treturn $tags;',\n\t'\t}',\n\t'\t$tags[\\'iframe\\'] = array(',\n\t'\t\t\\'src\\' => true,',\n\t'\t\t\\'class\\' => true,',\n\t'\t\t\\'style\\' => true,',\n\t'\t\t\\'id\\' => true,',\n\t'\t\t\\'title\\' => true,',\n\t'\t);',\n\t'\treturn $tags;',\n\t'}, 10, 2 );',\n);\nfile_put_contents( $file, implode( \"\\n\", $lines ) . \"\\n\" );\necho file_exists( $file ) ? 'mu-plugin installed' : 'mu-plugin failed';\n?>"
+			"code": "<?php\nrequire_once 'wordpress/wp-load.php';\n$dir = WP_CONTENT_DIR . '/mu-plugins';\nif ( ! is_dir( $dir ) ) {\n\twp_mkdir_p( $dir );\n}\n$file = $dir . '/blockparty-iframe-playground-svg-kses.php';\n$lines = array(\n\t'<?php',\n\t'add_filter( \\'wp_kses_allowed_html\\', function( $tags, $context ) {',\n\t'\tif ( \\'post\\' !== $context ) {',\n\t'\t\treturn $tags;',\n\t'\t}',\n\t'\t$tags[\\'iframe\\'] = array(',\n\t'\t\t\\'src\\' => true,',\n\t'\t\t\\'class\\' => true,',\n\t'\t\t\\'style\\' => true,',\n\t'\t\t\\'id\\' => true,',\n\t'\t\t\\'title\\' => true,',\n\t'\t);',\n\t'\treturn $tags;',\n\t'}, 10, 2 );',\n);\nfile_put_contents( $file, implode( \"\\n\", $lines ) . \"\\n\" );\necho file_exists( $file ) ? 'mu-plugin installed' : 'mu-plugin failed';\n?>"
 		},
 		{
 			"step": "runPHP",

From c35d462bf8d7c0ef6ed3ef1ade5e855a898f5169 Mon Sep 17 00:00:00 2001
From: mricoul <mricoul@beapi.fr>
Date: Mon, 20 Apr 2026 17:17:46 +0200
Subject: [PATCH 3/5] fix(blueprint): allow loading attribute on iframes

Updates the KSES mu-plugin to permit the 'loading' attribute on iframe tags. This ensures that lazy-loading attributes on iframes are not stripped by WordPress security filters in the Playground environment.
---
 .wordpress-org/blueprints/blueprint.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.wordpress-org/blueprints/blueprint.json b/.wordpress-org/blueprints/blueprint.json
index 95c879e..93a06c4 100644
--- a/.wordpress-org/blueprints/blueprint.json
+++ b/.wordpress-org/blueprints/blueprint.json
@@ -26,7 +26,7 @@
 		},
 		{
 			"step": "runPHP",
-			"code": "<?php\nrequire_once 'wordpress/wp-load.php';\n$dir = WP_CONTENT_DIR . '/mu-plugins';\nif ( ! is_dir( $dir ) ) {\n\twp_mkdir_p( $dir );\n}\n$file = $dir . '/blockparty-iframe-playground-svg-kses.php';\n$lines = array(\n\t'<?php',\n\t'add_filter( \\'wp_kses_allowed_html\\', function( $tags, $context ) {',\n\t'\tif ( \\'post\\' !== $context ) {',\n\t'\t\treturn $tags;',\n\t'\t}',\n\t'\t$tags[\\'iframe\\'] = array(',\n\t'\t\t\\'src\\' => true,',\n\t'\t\t\\'class\\' => true,',\n\t'\t\t\\'style\\' => true,',\n\t'\t\t\\'id\\' => true,',\n\t'\t\t\\'title\\' => true,',\n\t'\t);',\n\t'\treturn $tags;',\n\t'}, 10, 2 );',\n);\nfile_put_contents( $file, implode( \"\\n\", $lines ) . \"\\n\" );\necho file_exists( $file ) ? 'mu-plugin installed' : 'mu-plugin failed';\n?>"
+			"code": "<?php\nrequire_once 'wordpress/wp-load.php';\n$dir = WP_CONTENT_DIR . '/mu-plugins';\nif ( ! is_dir( $dir ) ) {\n\twp_mkdir_p( $dir );\n}\n$file = $dir . '/blockparty-iframe-playground-svg-kses.php';\n$lines = array(\n\t'<?php',\n\t'add_filter( \\'wp_kses_allowed_html\\', function( $tags, $context ) {',\n\t'\tif ( \\'post\\' !== $context ) {',\n\t'\t\treturn $tags;',\n\t'\t}',\n\t'\t$tags[\\'iframe\\'] = array(',\n\t'\t\t\\'src\\' => true,',\n\t'\t\t\\'class\\' => true,',\n\t'\t\t\\'style\\' => true,',\n\t'\t\t\\'id\\' => true,','loading\\' => true,',\n\t'\t\t\\'id\\' => true,',\n\t'\t\t\\'title\\' => true,',\n\t'\t);',\n\t'\treturn $tags;',\n\t'}, 10, 2 );',\n);\nfile_put_contents( $file, implode( \"\\n\", $lines ) . \"\\n\" );\necho file_exists( $file ) ? 'mu-plugin installed' : 'mu-plugin failed';\n?>"
 		},
 		{
 			"step": "runPHP",

From 7f8f79c705207fc0a5db3ea2cb1bc382ae00c16b Mon Sep 17 00:00:00 2001
From: mricoul <mricoul@beapi.fr>
Date: Mon, 20 Apr 2026 17:36:17 +0200
Subject: [PATCH 4/5] refactor(blueprint): simplify kses mu-plugin generation

Replaces the array-based string construction with a nowdoc to improve readability and maintainability. This also cleans up the allowed iframe attributes list, removing a duplicate "id" entry and fixing the string formatting for the "loading" attribute.
---
 .wordpress-org/blueprints/blueprint.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.wordpress-org/blueprints/blueprint.json b/.wordpress-org/blueprints/blueprint.json
index 93a06c4..a4c159f 100644
--- a/.wordpress-org/blueprints/blueprint.json
+++ b/.wordpress-org/blueprints/blueprint.json
@@ -26,7 +26,7 @@
 		},
 		{
 			"step": "runPHP",
-			"code": "<?php\nrequire_once 'wordpress/wp-load.php';\n$dir = WP_CONTENT_DIR . '/mu-plugins';\nif ( ! is_dir( $dir ) ) {\n\twp_mkdir_p( $dir );\n}\n$file = $dir . '/blockparty-iframe-playground-svg-kses.php';\n$lines = array(\n\t'<?php',\n\t'add_filter( \\'wp_kses_allowed_html\\', function( $tags, $context ) {',\n\t'\tif ( \\'post\\' !== $context ) {',\n\t'\t\treturn $tags;',\n\t'\t}',\n\t'\t$tags[\\'iframe\\'] = array(',\n\t'\t\t\\'src\\' => true,',\n\t'\t\t\\'class\\' => true,',\n\t'\t\t\\'style\\' => true,',\n\t'\t\t\\'id\\' => true,','loading\\' => true,',\n\t'\t\t\\'id\\' => true,',\n\t'\t\t\\'title\\' => true,',\n\t'\t);',\n\t'\treturn $tags;',\n\t'}, 10, 2 );',\n);\nfile_put_contents( $file, implode( \"\\n\", $lines ) . \"\\n\" );\necho file_exists( $file ) ? 'mu-plugin installed' : 'mu-plugin failed';\n?>"
+			"code": "<?php\nrequire_once 'wordpress/wp-load.php';\n$dir = WP_CONTENT_DIR . '/mu-plugins';\nif ( ! is_dir( $dir ) ) {\n\twp_mkdir_p( $dir );\n}\n$file = $dir . '/blockparty-iframe-playground-svg-kses.php';\n$mu_plugin = <<<'BLOCKPARTY_IFRAME_MU'\n<?php\nadd_filter( 'wp_kses_allowed_html', function( $tags, $context ) {\n\tif ( 'post' !== $context ) {\n\t\treturn $tags;\n\t}\n\t$tags['iframe'] = array(\n\t\t'src' => true,\n\t\t'class' => true,\n\t\t'style' => true,\n\t\t'id' => true,\n\t\t'loading' => true,\n\t\t'title' => true,\n\t);\n\treturn $tags;\n}, 10, 2 );\nBLOCKPARTY_IFRAME_MU;\nfile_put_contents( $file, $mu_plugin . \"\\n\" );\necho file_exists( $file ) ? 'mu-plugin installed' : 'mu-plugin failed';\n?>"
 		},
 		{
 			"step": "runPHP",

From 78a5d347dae227679fe6edf499352b42713f4592 Mon Sep 17 00:00:00 2001
From: mricoul <mricoul@beapi.fr>
Date: Mon, 20 Apr 2026 17:39:43 +0200
Subject: [PATCH 5/5] fix(blueprint): rename kses mu-plugin file to remove svg
 reference

Renames the must-use plugin file from `blockparty-iframe-playground-svg-kses.php` to `blockparty-iframe-playground-kses.php`. This corrects a naming inconsistency as the plugin currently handles iframe permissions rather than SVG tags.
---
 .wordpress-org/blueprints/blueprint.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.wordpress-org/blueprints/blueprint.json b/.wordpress-org/blueprints/blueprint.json
index a4c159f..0f5d71f 100644
--- a/.wordpress-org/blueprints/blueprint.json
+++ b/.wordpress-org/blueprints/blueprint.json
@@ -26,7 +26,7 @@
 		},
 		{
 			"step": "runPHP",
-			"code": "<?php\nrequire_once 'wordpress/wp-load.php';\n$dir = WP_CONTENT_DIR . '/mu-plugins';\nif ( ! is_dir( $dir ) ) {\n\twp_mkdir_p( $dir );\n}\n$file = $dir . '/blockparty-iframe-playground-svg-kses.php';\n$mu_plugin = <<<'BLOCKPARTY_IFRAME_MU'\n<?php\nadd_filter( 'wp_kses_allowed_html', function( $tags, $context ) {\n\tif ( 'post' !== $context ) {\n\t\treturn $tags;\n\t}\n\t$tags['iframe'] = array(\n\t\t'src' => true,\n\t\t'class' => true,\n\t\t'style' => true,\n\t\t'id' => true,\n\t\t'loading' => true,\n\t\t'title' => true,\n\t);\n\treturn $tags;\n}, 10, 2 );\nBLOCKPARTY_IFRAME_MU;\nfile_put_contents( $file, $mu_plugin . \"\\n\" );\necho file_exists( $file ) ? 'mu-plugin installed' : 'mu-plugin failed';\n?>"
+			"code": "<?php\nrequire_once 'wordpress/wp-load.php';\n$dir = WP_CONTENT_DIR . '/mu-plugins';\nif ( ! is_dir( $dir ) ) {\n\twp_mkdir_p( $dir );\n}\n$file = $dir . '/blockparty-iframe-playground-kses.php';\n$mu_plugin = <<<'BLOCKPARTY_IFRAME_MU'\n<?php\nadd_filter( 'wp_kses_allowed_html', function( $tags, $context ) {\n\tif ( 'post' !== $context ) {\n\t\treturn $tags;\n\t}\n\t$tags['iframe'] = array(\n\t\t'src' => true,\n\t\t'class' => true,\n\t\t'style' => true,\n\t\t'id' => true,\n\t\t'loading' => true,\n\t\t'title' => true,\n\t);\n\treturn $tags;\n}, 10, 2 );\nBLOCKPARTY_IFRAME_MU;\nfile_put_contents( $file, $mu_plugin . \"\\n\" );\necho file_exists( $file ) ? 'mu-plugin installed' : 'mu-plugin failed';\n?>"
 		},
 		{
 			"step": "runPHP",