Forms: Properly support formatting options for labels and required te…

…xt (#40924)

* Forms: remove formatting options from labels

* update `strip_tags` with `wp_kses_post`

* remove extra param in `wp_kses_post`

Committed via a GitHub action: https://github.com/Automattic/jetpack/actions/runs/12824476616

Upstream-Ref: Automattic/jetpack@830ba64

CHANGELOG.md

@@ -23,6 +23,7 @@ This is an alpha version! The changes listed here are not final.
 - Forms: Fix dropdown icon styling.
 - Forms: Fix redirect field styles
 - Forms: fix spacing issue in sidebar settings
+- Forms: Properly support formatting options for labels and required text
 - Upsell nudge: fix click in Safari
 
 ## [0.34.6] - 2025-01-13

dist/blocks/editor.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('jetpack-connection', 'lodash', 'react', 'react-jsx-runtime', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-url'), 'version' => '225ab109b168dbe54a71');
+<?php return array('dependencies' => array('jetpack-connection', 'lodash', 'react', 'react-jsx-runtime', 'wp-api-fetch', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-plugins', 'wp-polyfill', 'wp-primitives', 'wp-url'), 'version' => '4d9251827cfab6618166');

src/contact-form/class-contact-form-field.php

@@ -455,7 +455,7 @@ public function render_label( $type, $id, $label, $required, $required_field_tex
 				class='grunion-field-label{$type_class}" . ( $this->is_error() ? ' form-error' : '' ) . "'"
 				. $extra_attrs_string
 				. '>'
-				. esc_html( $label )
+				. wp_kses_post( $label )
 				. ( $required ? '<span class="grunion-label-required" aria-hidden="true">' . $required_field_text . '</span>' : '' )
 				. "</label>\n";
 	}
@@ -1012,7 +1012,7 @@ public function render_field( $type, $id, $label, $value, $class, $placeholder,
 		 *
 		 * @param string $var Required field text. Default is "(required)".
 		 */
-		$required_field_text = esc_html( apply_filters( 'jetpack_required_field_text', $required_field_text ) );
+		$required_field_text = wp_kses_post( apply_filters( 'jetpack_required_field_text', $required_field_text ) );
 
 		$block_style = 'style="' . $this->block_styles . '"';
 

src/contact-form/class-contact-form-plugin.php

@@ -117,13 +117,13 @@ public static function strip_tags( $data_with_tags ) {
 		if ( is_array( $data_with_tags ) ) {
 			foreach ( $data_with_tags as $index => $value ) {
 				$index = sanitize_text_field( (string) $index );
-				$value = wp_kses( (string) $value, array() );
+				$value = wp_kses_post( (string) $value );
 				$value = str_replace( '&', '&', $value ); // undo damage done by wp_kses_normalize_entities()
 
 				$data_without_tags[ $index ] = $value;
 			}
 		} else {
-			$data_without_tags = wp_kses( (string) $data_with_tags, array() );
+			$data_without_tags = wp_kses_post( (string) $data_with_tags );
 			$data_without_tags = str_replace( '&', '&', $data_without_tags ); // undo damage done by wp_kses_normalize_entities()
 		}