With the help of this thread and this StackOverflow response, I think this is working for me with TinyMCE so far:
In site/ready.php:
$wire->addHookAfter('MarkupHTMLPurifier::initConfig', function(HookEvent $event) {
$config = $event->arguments(0);
$def = $event->arguments(1);
$config->set('HTML.SafeIframe', true);
// Allow YouTube and Vimeo
$config->set('URI.SafeIframeRegexp', '%^(https?:)?//(www\.youtube(?:-nocookie)?\.com/embed/|player\.vimeo\.com/video/)%');
});
Then, in the PW admin for the textarea field > Input tab > Custom Settings JSON:
{
"extended_valid_elements": "video,source,iframe[src|width|height|title|frameborder|allow|referrerpolicy|allowfullscreen]"
}
Note the list of attributes in square brackets after the "iframe". You can use wildcard `[*]` if you want to allow any attribute, though I haven't experimented with that.
Finally, clear the HTMLPurifier cache from Tracy Console as described in that GitHub conversation:
$purifier = new MarkupHTMLPurifier();
$purifier->clearCache();
This is very fresh, I'm still testing it out, but it seems to work. Might still need to add that bit from SO for the `allowfullscreen`:
$def->addAttribute('iframe', 'allowfullscreen', 'Bool');