From 1cf8d88f5dcdac2d36ad880de87257145e1e02a3 Mon Sep 17 00:00:00 2001
From: Nikita Sinelnikov <nsinelnikov.work@gmail.com>
Date: Fri, 13 Jan 2023 00:51:51 +0200
Subject: [PATCH] - added support of the iframes inside textarea with enabled
 the "HTML using" option;

---
 includes/core/class-form.php | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/includes/core/class-form.php b/includes/core/class-form.php
index 99476051..11e3159e 100644
--- a/includes/core/class-form.php
+++ b/includes/core/class-form.php
@@ -645,7 +645,24 @@ if ( ! class_exists( 'um\core\Form' ) ) {
 											break;
 										case 'textarea':
 											if ( ! empty( $field['html'] ) || ( UM()->profile()->get_show_bio_key( $form ) === $k && UM()->options()->get( 'profile_show_html_bio' ) ) ) {
-												$form[ $k ] = wp_kses_post( $form[ $k ] );
+												$allowed_html = UM()->get_allowed_html( 'templates' );
+												if ( empty( $allowed_html['iframe'] ) ) {
+													$allowed_html['iframe'] = array(
+														'allow'           => true,
+														'frameborder'     => true,
+														'loading'         => true,
+														'name'            => true,
+														'referrerpolicy'  => true,
+														'sandbox'         => true,
+														'src'             => true,
+														'srcdoc'          => true,
+														'title'           => true,
+														'width'           => true,
+														'height'          => true,
+														'allowfullscreen' => true,
+													);
+												}
+												$form[ $k ] = wp_kses( $form[ $k ], $allowed_html );
 											} else {
 												$form[ $k ] = sanitize_textarea_field( $form[ $k ] );
 											}