Steps to reproduce:

• Access as a non-admin user
• Go to your Dashboard
• Add a "Text (html)" block with an iframe pointing to a Youtube video (using its embed code for example)
• Open the Dashboard using the mobile app

Expected:

• The video is played

The problem is that get_content_for_external() for block_html is using the content_is_trusted() method that checks the current page using the global $SCRIPT

The previous is not going to work for web services as $SCRIPT won't indicate my/index.php, instead, it will return the Web Service rest endpoint.

To solve this issue, we will have to effectively calculate for which page get_content_for_external is being called or add additional parameters in the method signature to force format_text options.