| @@ -24,10 +24,12 @@ | ||
| 24 | 24 | */ |
| 25 | 25 | public static function store($request) |
| 26 | 26 | { |
| 27 | 27 | $value = $request->get_param('siteProfile'); |
| 28 | - \update_option('extendify_site_profile', Sanitizer::sanitizeUnknown($value)); | |
| 28 | + // sanitize_text_field() on the raw JSON entity-encodes from the first "<" | |
| 29 | + // to the end, corrupting it. Decode first so we sanitize fields, not JSON. | |
| 29 | 30 | $siteProfile = is_string($value) ? json_decode($value, true) : $value; |
| 31 | + \update_option('extendify_site_profile', Sanitizer::sanitizeUnknown($siteProfile)); | |
| 30 | 32 | return new \WP_REST_Response($siteProfile); |
| 31 | 33 | } |
| 32 | 34 | |
| 33 | 35 | /** |
