Don't strip HTML out of templates during settings import

joedolson · May 14, 2024 · 17d780b · 17d780b
1 parent 484f7ec
commit 17d780b
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/my-calendar-settings.php b/src/my-calendar-settings.php
@@ -520,7 +520,10 @@ function mc_import_settings() {
 					if ( ! $valid ) {
 						$return = __( "The file uploaded doesn't seem to be a valid collection of My Calendar settings.", 'my-calendar' );
 					} else {
-						$settings = map_deep( $settings, 'sanitize_textarea_field' );
+						// Templates need different sanitizing than other fields.
+						$templates             = map_deep( $settings['templates'], 'wp_kses_post' );;
+						$settings              = map_deep( $settings, 'sanitize_textarea_field' );
+						$settings['templates'] = $templates;
 						// Remove the calendar location ID from imported settings. Set to local value if present.
 						if ( isset( $settings['uri_id'] ) ) {
 							if ( mc_get_option( 'uri_id' ) ) {