I have a field that echos the iframe code entered by users having role “Business Owner”.
These users have limited capabilities and can only save, update posts of a custom post type called “”Business Owner Posts”. My ACF fields are visible in such post types only.
I have noticed that when such users enter the iframe code and try to save it does not get accepted – the field returns empty.
But the same does not happen when it is entered by users having admin privileges.
Now, I understand there are security concerns when it comes to iframes but I am sanitizing the entered iframe with regex to ensure they only come from a certain URL and none other.
So how do I make ACF accept the iframe code as entered by the user type?
