fix: allow anchor target attribute in setting fields description

BracketSpace · Aug 27, 2024 · ed8281a · ed8281a
1 parent aca3bae
commit ed8281a
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 4 deletions.
diff --git a/resources/templates/form/field.php b/resources/templates/form/field.php
@@ -66,7 +66,14 @@
 		?>
 		<?php $description = $field->getDescription(); ?>
 		<?php if (!empty($description)) : ?>
-			<p class="description"><?php echo wp_kses_data($description); ?></p>
+			<p class="description">
+				<?php
+				echo wp_kses(
+					$description,
+					wp_kses_allowed_html('notification/field_description')
+				);
+				?>
+			</p>
 		<?php endif ?>
 		<?php
 		do_action_deprecated(

diff --git a/resources/templates/settings/page.php b/resources/templates/settings/page.php
@@ -171,8 +171,9 @@ class="field-<?php echo esc_attr($field->slug()); ?>"
 										<?php if (!empty($fieldDescription)) : ?>
 											<small class="description">
 											<?php
-											echo wp_kses_data(
-												$fieldDescription
+											echo wp_kses(
+												$fieldDescription,
+												wp_kses_allowed_html('notification/field_description')
 											);
 											?>
 																		</small>

diff --git a/src/Admin/Settings.php b/src/Admin/Settings.php
@@ -682,4 +682,24 @@ public function filterPostTypes($postTypes)
 
 		return $postTypes;
 	}
+
+	/**
+	 * Filters list of allowed HTML tags and attributes for field description.
+	 *
+	 * @filter wp_kses_allowed_html
+	 *
+	 * @param   array<string, array<string, bool>> $tags    List of allowed tags.
+	 * @param   string                             $context Current context.
+	 * @return  array<mixed>
+	 */
+	public function filterAllowedDescriptionHtml(array $tags, string $context): array
+	{
+		if ($context !== 'notification/field_description') {
+			return $tags;
+		}
+
+		$tags['a']['target'] = true;
+
+		return $tags;
+	}
 }
diff --git a/src/Repository/Field/BaseField.php b/src/Repository/Field/BaseField.php
@@ -120,7 +120,7 @@ public function __construct($params = [])
 		if (isset($params['description'])) {
 			$this->description = wp_kses(
 				$params['description'],
-				wp_kses_allowed_html('data')
+				wp_kses_allowed_html('notification/field_description')
 			);
 		}