AdvancedCustomFields / AdvancedCustomFields/acf

Bug: & character is encoded as & also in admin inputs

Open
#595 2 comments 7 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
945
Forks
197
PR merge metrics
No merged PRs in 30d

Description

After 5.9.8. ACF introduced the following change: https://github.com/AdvancedCustomFields/acf/commit/0c8704f5378df4b320bf03b4011c7a047f6e08f6#diff-08f62fedcdebd3d9a0a3142b5d5aeee9e82c0e5421ff39306ced09cde1316053R206-R208

This causes all ampersands in value of text and textarea fields to be encoded as & in admin for not super-admin users in multisite:

Screenshot 2021-12-28 at 15 13 53

Screenshot 2021-12-28 at 15 14 05

Tested this with WordPress Core 5.8.2, other plugins and mu-plugins disabled and with twentytwentyone theme. Issue also occurs in single sites for all user roles, if define( 'DISALLOW_UNFILTERED_HTML', true ); is set (which is the case in our situation). We use ACF Pro, but the issue seems to occur both in acf and acf-pro with latest versions.

I believe this happens because render_field() calls acf_get_text_input() here.

I fixed the situation for now with following code:

add_filter( 'acf/load_value/type=text', function ( $value ) {
	$value = htmlspecialchars_decode( $value );

	return $value;
} );

but it would be nice to have the fix in ACF.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in includes/fields/class-acf-field-text.php at render_field(), which calls acf_get_text_input(), and review the linked ACF change from the report. Reproduce the issue with WordPress 5.8.2 under the stated multisite or DISALLOW_UNFILTERED_HTML conditions, then verify that ampersands in text and textarea admin values are no longer displayed as &.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.