← All changes | app/Shared/Controllers/SiteProfileController.php +3 -1 3.0.6 → 3.2.1 View file →

		@@ -24,10 +24,12 @@
24	24	*/
25	25	public static function store($request)
26	26	{
27	27	$value = $request->get_param('siteProfile');
28		- \update_option('extendify_site_profile', Sanitizer::sanitizeUnknown($value));
	28	+ // sanitize_text_field() on the raw JSON entity-encodes from the first "<"
	29	+ // to the end, corrupting it. Decode first so we sanitize fields, not JSON.
29	30	$siteProfile = is_string($value) ? json_decode($value, true) : $value;
	31	+ \update_option('extendify_site_profile', Sanitizer::sanitizeUnknown($siteProfile));
30	32	return new \WP_REST_Response($siteProfile);
31	33	}
32	34
33	35	/**