fix: remove wp_kses_post() HTML escaping from REST API JSON output
The security audit added wp_kses_post()/esc_html() to article fields before returning them via the REST API. This caused double-encoding (e.g., & → &) because REST responses are JSON, not HTML — WordPress's rest_ensure_response() already handles JSON encoding. The frontend is responsible for output escaping at render time. Removes the 4 escaping lines from get_articles() to fix broken summaries and truncated content on the live site. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -185,11 +185,6 @@ class Peptide_News_Rest_API {
|
||||
}
|
||||
}
|
||||
|
||||
// Escape string fields for REST API output
|
||||
$article->title = wp_kses_post( $article->title );
|
||||
$article->excerpt = wp_kses_post( $article->excerpt );
|
||||
$article->ai_summary = wp_kses_post( $article->ai_summary );
|
||||
$article->author = esc_html( $article->author );
|
||||
}
|
||||
|
||||
$data = array(
|
||||
|
||||
Reference in New Issue
Block a user