Forms: Properly support formatting options for labels and required te…

…xt (#40924)

* Forms: remove formatting options from labels

* update `strip_tags` with `wp_kses_post`

* remove extra param in `wp_kses_post`

projects/packages/forms/changelog/forms-remove-formatting-options-from-labels

@@ -0,0 +1,4 @@
+Significance: patch
+Type: fixed
+
+Forms: Properly support formatting options for labels and required text

projects/packages/forms/src/blocks/contact-form/components/jetpack-field-label.js

@@ -34,7 +34,7 @@ const FieldLabel = ( {
 				} }
 				placeholder={ placeholder ?? __( 'Add label…', 'jetpack-forms' ) }
 				withoutInteractiveFormatting
-				allowedFormats={ [ 'core/bold', 'core/italic' ] }
+				allowedFormats={ [ 'core/italic' ] }
 			/>
 			{ suffix && <span className="jetpack-field-label__suffix">{ suffix }</span> }
 			{ required && (

projects/packages/forms/src/contact-form/class-contact-form-field.php

@@ -455,7 +455,7 @@ public function render_label( $type, $id, $label, $required, $required_field_tex
 				class='grunion-field-label{$type_class}" . ( $this->is_error() ? ' form-error' : '' ) . "'"
 				. $extra_attrs_string
 				. '>'
-				. esc_html( $label )
+				. wp_kses_post( $label )
 				. ( $required ? '<span class="grunion-label-required" aria-hidden="true">' . $required_field_text . '</span>' : '' )
 				. "</label>\n";
 	}
@@ -1012,7 +1012,7 @@ public function render_field( $type, $id, $label, $value, $class, $placeholder,
 		 *
 		 * @param string $var Required field text. Default is "(required)".
 		 */
-		$required_field_text = esc_html( apply_filters( 'jetpack_required_field_text', $required_field_text ) );
+		$required_field_text = wp_kses_post( apply_filters( 'jetpack_required_field_text', $required_field_text ) );
 
 		$block_style = 'style="' . $this->block_styles . '"';
 

projects/packages/forms/src/contact-form/class-contact-form-plugin.php

@@ -117,13 +117,13 @@ public static function strip_tags( $data_with_tags ) {
 		if ( is_array( $data_with_tags ) ) {
 			foreach ( $data_with_tags as $index => $value ) {
 				$index = sanitize_text_field( (string) $index );
-				$value = wp_kses( (string) $value, array() );
+				$value = wp_kses_post( (string) $value );
 				$value = str_replace( '&', '&', $value ); // undo damage done by wp_kses_normalize_entities()
 
 				$data_without_tags[ $index ] = $value;
 			}
 		} else {
-			$data_without_tags = wp_kses( (string) $data_with_tags, array() );
+			$data_without_tags = wp_kses_post( (string) $data_with_tags );
 			$data_without_tags = str_replace( '&', '&', $data_without_tags ); // undo damage done by wp_kses_normalize_entities()
 		}