fix: remove wp_kses_post() HTML escaping from REST API JSON output

The security audit added wp_kses_post()/esc_html() to article fields
before returning them via the REST API. This caused double-encoding
(e.g., & → &) because REST responses are JSON, not HTML —
WordPress's rest_ensure_response() already handles JSON encoding.
The frontend is responsible for output escaping at render time.

Removes the 4 escaping lines from get_articles() to fix broken
summaries and truncated content on the live site.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Terence Ong
2026-04-09 12:34:02 +07:00
parent d78347de40
commit 221a46a60a
2 changed files with 10 additions and 21 deletions

View File

@@ -185,11 +185,6 @@ class Peptide_News_Rest_API {
}
}
// Escape string fields for REST API output
$article->title = wp_kses_post( $article->title );
$article->excerpt = wp_kses_post( $article->excerpt );
$article->ai_summary = wp_kses_post( $article->ai_summary );
$article->author = esc_html( $article->author );
}
$data = array(