Problem using backslash within settings field value

Beaver Builder
1

Hello,

I noticed an issue when using the backslash character within settings field value.
For example, let’s say you are using a text editor module and you want to add this text :

c:\windows

When you save the module settings, no problem, the text will be rendered correctly.
Now if you open any other settings form on the same page and you save it you’ll notice that the backslash within “c:\windows” is missing and our text became “c:windows”.

So what’s happen:

When you first save the text module just after you add “c:\windows”, the related field value within $new_settings from the method FLBuilderModel::save_settings() is escaped like this “c:\windows”.
However when the whole layout data is saved back to the db using update_metadata() the value become “c:\windows” as the update_metadata() method makes use of stripslashes_deep().

Then when you save another settings form, FLBuilderModel::save_settings() will merge it with the layout data from the db and save it back again using update_metadata.
Here our “c:\windows” field value comming from the db will be saved back as “c:windows” as update_metadata() runs stripslashes_deep() again.

A solution could be to run wp_slash() on each layout data settings fields values just before merging the layout data with the settings form being saved.

Best regards,

Nicolas

2

Hey Nicolas! Thanks for taking the time to let us know about this. Sure enough, I was able to recreate this on my end. There’s definitely a bug here. I added this to our bug list and we’ll do our best to get a fix out ASAP. In the meantime, I hope this isn’t causing you too much inconvenience.

3

Hey Robby,

Thanks for your feedback.

Just to let you know that the solution I propose previously doesn’t works with nested settings (ex: testimonials).

The solution I found is to parse $new_settings within FLBuilderModel::save_settings() to run wp_unslash() on each property which stands at the settings object root as these settigns are not unescaped by FLBuilderModel::json_decode_settings().

Then I run wp_slash() on each layout data settings fields values (after the merge with $new_settings).

It works for me but I’m sure you’ll find a better solution :wink: