Merge pull request #31 from Bynder/fix/GC-5065

[GC-5065] Testing and tweaking
Bynder · Jun 13, 2024 · 6bd8ded · 6bd8ded
2 parents 7c95300 + 3bfb117
commit 6bd8ded
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/includes/classes/admin/mapping/field-types/acf.php b/includes/classes/admin/mapping/field-types/acf.php
@@ -53,11 +53,11 @@ public function underscore_template( View $view ) {
 			}, $groupIds ) );
 
 			// Prepare and execute query to get all fields for all groups
+			$wild           = '%' . $wpdb->esc_like( 'repeater' ) . '%';
 			$fields_results = $wpdb->get_results(
 				$wpdb->prepare(
 					"SELECT * FROM {$wpdb->posts} WHERE post_type = 'acf-field' AND post_content LIKE %s AND post_parent IN ($groupIdPlaceholders)",
-					'%' . $wpdb->esc_like('repeater') . '%',
-					$groupIds
+					array_merge( [ $wild ], $groupIds )
 				)
 			);
 

diff --git a/includes/classes/admin/mapping/field-types/database.php b/includes/classes/admin/mapping/field-types/database.php
@@ -148,7 +148,11 @@ class="cw-column-selector"
 				<option value="">Select a column</option>
 
 				<?php
-				echo wp_kses_post( implode( '\r\n', $this->getAllTableColOptions() ) );
+				/**
+				 * This is not escaped as it can contain various tags that we know are safe.
+				 */
+				// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
+				echo implode( '\r\n', $this->getAllTableColOptions() );
 				?>
 			</select>