v5.9.6

Changed
 - Update ACF to v5.9.6 (b56148d)
 - Update supported PHP version to include PHP 8.0 (c7ac90f)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE28mOhcNTKWG2VpmMopKj2zED8Z0FAmDJpREACgkQopKj2zED
 8Z14CQ/+LmY90RccYtqBOBr1HETGCJA4+2Kt4tTzBHx1LmwV+7JxxxYktnxeGw+1
 BkmMghUNZAvHO2vg3OKwMO0rqAlSbSYLHcL6kvJ1ZkZNousHEybSqednIdZSc2WQ
 9k0XWoKXX1DlKfBneYFjIsiyYYkDSlVnVXXBYvpaaV7Dmk7FmgjvTVqB58D6W77P
 JE+luLE8ycyHX/i6LSpYCH0mbBU/TzXtUSgrZ07DbwBuxe6D1EJQIcZaLNsk5xTY
 fze1GbvL0Do8WjIIUF6V2t2TBqu3er9mNRRI8/g2FoZWYktcNxRMC4SM9KkXvFVh
 Y867wItIOublGS9wLz4eEq88dpd0Ld4+B4UhpSwS84p0OuDnS0+x/10iT0y6B8AA
 B96gMVEpF7wYpZNINyd03XwoQqISznLVkEN72/H4DRvJzSBzO1w8jdYuCdxsglep
 hO0pcsGPcZZXICOdmZWBFZ6g0PaaiELX4/9A+SjbW2qOts/Y04pMboCJVyJqwATq
 D/cH7o8oBX5oBQwblVvAVpyaelFuYe6wq1bgvkThU2d5XGqiQ8b5PYhJUisNePkJ
 B/ItAxMH7qcjlKvULvGTmF22hncc3QNB7eIedKL1RSitgjP/W8q790Xlnjdvrp/R
 FMy0ev0A6t/VdJRD6bMWeJssjMHzP38Y0Ae0XkxVgeTol2zZcLs=
 =hHNy
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE28mOhcNTKWG2VpmMopKj2zED8Z0FAmDJpRMACgkQopKj2zED
 8Z0+chAAluni2hf5V0JeJOVkq1Pk6va7MS5R3dOFUp4f7UpGoznYbjgqNBr8sWqz
 m0ZwFtllLtHmCzMeJlwNXSzGft5jQBLNTb1q6jU5jj6NyjxPgDxYnanF/23wge+d
 /bpk4cjcJnj+suKw/u0//I1CzT49YWsIpxuu8CD78ubZUXzMKOqYXigrArMtV5XE
 GCRX1AVYcydtWghmnL9gouJEn/xC2uKrlsJdmE3k1Yu/Nozbk+QKFKltP73fr6nC
 K15LDaH/f2kvgGudCeGh77i64p2KhB6pit+bN4vK2MOauNYbFa145P+sDvR+d0Nu
 VMZvDc9qtlKwHafDf1u82NCk8Qrrgbenm/F7/Z6UsDN76A8bTfBtk+3Xe8uulzkm
 UJAE0sVqY7qLdyEl2m3HbLKosjr9k+xQV4tCvqApe3nIbIF+27r3AJP1NlLtXr/M
 BczBoFoZnivu2ktWho/lZQux5Xs5VhgsE8jTqHdjgDIv8NdsBtfJmdi1sMkXdEPW
 z+80DiCVkdDwp+gVxVcbcnCMcgsNsGfeSIWr1f8nQw429Ot2Nol8AiKA4JNnefbD
 rFjOlQ5AZc8lHnHiwhQyD1fzeoaOckOjPgz2I4C+Fr/7fWyMF6DfK2Kq/bD8dWDL
 g9G2e3Tm3nqdDcltYg3KNq8X7teYgU/F8fNrJK7kdGGj3qxnC0k=
 =JR5l
 -----END PGP SIGNATURE-----

Merge tag '5.9.6' into develop

v5.9.6

Changed
- Update ACF to v5.9.6 (b56148d)
- Update supported PHP version to include PHP 8.0 (c7ac90f)

acf.php

@@ -3,7 +3,7 @@
 Plugin Name: Advanced Custom Fields PRO
 Plugin URI: https://www.advancedcustomfields.com
 Description: Customize WordPress with powerful, professional and intuitive fields.
-Version: 5.9.5
+Version: 5.9.6
 Author: Elliot Condon
 Author URI: https://www.advancedcustomfields.com
 Text Domain: acf
@@ -17,7 +17,7 @@ if( ! class_exists('ACF') ) :
 class ACF {
 	
 	/** @var string The plugin version number. */
-	var $version = '5.9.5';
+	var $version = '5.9.6';
 	
 	/** @var array The plugin settings array. */
 	var $settings = array();

assets/inc/datepicker/jquery-ui.css

@@ -613,25 +613,25 @@
 .acf-ui-datepicker .ui-corner-top,
 .acf-ui-datepicker .ui-corner-left,
 .acf-ui-datepicker .ui-corner-tl {
-	border-top-left-radius: 3;
+	border-top-left-radius: 3px;
 }
 .acf-ui-datepicker .ui-corner-all,
 .acf-ui-datepicker .ui-corner-top,
 .acf-ui-datepicker .ui-corner-right,
 .acf-ui-datepicker .ui-corner-tr {
-	border-top-right-radius: 3;
+	border-top-right-radius: 3px;
 }
 .acf-ui-datepicker .ui-corner-all,
 .acf-ui-datepicker .ui-corner-bottom,
 .acf-ui-datepicker .ui-corner-left,
 .acf-ui-datepicker .ui-corner-bl {
-	border-bottom-left-radius: 3;
+	border-bottom-left-radius: 3px;
 }
 .acf-ui-datepicker .ui-corner-all,
 .acf-ui-datepicker .ui-corner-bottom,
 .acf-ui-datepicker .ui-corner-right,
 .acf-ui-datepicker .ui-corner-br {
-	border-bottom-right-radius: 3;
+	border-bottom-right-radius: 3px;
 }
 
 /* Overlays */

composer.json

@@ -11,7 +11,7 @@
     ],
     "minimum-stability": "dev",
     "require": {
-        "php": "^5.6.20||^7.0",
+        "php": "^5.6.20 || ^7.0 || ^8.0",
         "composer/installers": "^1.9.0"
     }
 }

includes/acf-helper-functions.php

@@ -363,9 +363,7 @@ function acf_slugify( $str = '', $glue = '-' ) {
 }
 
 /**
- * acf_punctify
+ * Returns a string with correct full stop punctuation.
- *
- * Returns a string with correct full stop puctuation.
  *
  * @date	12/7/19
  * @since	5.8.2
@@ -374,7 +372,10 @@ function acf_slugify( $str = '', $glue = '-' ) {
  * @return	string
  */
 function acf_punctify( $str = '' ) {
-	return trim($str, '.') . '.';
+	if ( substr( trim( strip_tags( $str ) ), -1) !== '.' ) {
+		return trim( $str ) . '.';
+	}
+	return trim( $str );
 }
 
 /**
@@ -449,4 +450,21 @@ function acf_doing_action( $action ) {
 		return $wp_filter[ $action ]->current_priority();
 	}
 	return false;
+}
+
+/**
+ * Returns the current URL.
+ *
+ * @date	23/01/2015
+ * @since	5.1.5
+ *
+ * @param	void
+ * @return	string
+ */
+function acf_get_current_url() {
+	// Ensure props exist to avoid PHP Notice during CLI commands.
+	if( isset( $_SERVER['HTTP_HOST'], $_SERVER['REQUEST_URI'] ) ) {
+		return ( is_ssl() ? 'https' : 'http' ) . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+	}
+	return '';
 }

includes/acf-input-functions.php

@@ -64,26 +64,68 @@ function acf_esc_attrs( $attrs ) {
 	return trim( $html );
 }
 
-/**
+if ( defined('ACF_EXPERIMENTAL_ESC_HTML') && ACF_EXPERIMENTAL_ESC_HTML ) {
- * acf_esc_html
+
- *
+	/**
- * Encodes <script> tags for safe HTML output.
+	 * Sanitizes text content and strips out disallowed HTML.
- *
+	 *
- * @date	12/6/19
+	 * This function emulates `wp_kses_post()` with a context of "acf" for extensibility.
- * @since	5.8.1
+	 *
- *
+	 * @date	16/4/21
- * @param	string $string
+	 * @since	5.9.6
- * @return	string
+	 *
- */
+	 * @param	string $string
-function acf_esc_html( $string = '' ) {
+	 * @return	string
-	$string = strval($string);
+	 */
-	
+	function acf_esc_html( $string = '' ) {
-	// Encode "<script" tags to invalidate DOM elements.
+		return wp_kses( (string) $string, 'acf' );
-	if( strpos($string, '<script') !== false ) {
+	}
-		$string = str_replace('<script', htmlspecialchars('<script'), $string);
+	
-		$string = str_replace('</script', htmlspecialchars('</script'), $string);
+	/**
+	 * Private callback for the "wp_kses_allowed_html" filter used to return allowed HTML for "acf" context.
+	 *
+	 * @date	16/4/21
+	 * @since	5.9.6
+	 *
+	 * @param	array $tags An array of allowed tags.
+	 * @param	string $context The context name.
+	 * @return	array.
+	 */
+	
+	function _acf_kses_allowed_html( $tags, $context ) {
+		global $allowedposttags;
+		
+		if( $context === 'acf' ) {
+			return $allowedposttags;
+		}
+		return $tags;
+	}
+	
+	add_filter( 'wp_kses_allowed_html', '_acf_kses_allowed_html', 0, 2 );
+
+} else {
+	
+	/**
+	 * acf_esc_html
+	 *
+	 * Encodes <script> tags for safe HTML output.
+	 *
+	 * @date	12/6/19
+	 * @since	5.8.1
+	 *
+	 * @param	string $string
+	 * @return	string
+	 */
+	function acf_esc_html( $string = '' ) {
+		$string = strval($string);
+		
+		// Encode "<script" tags to invalidate DOM elements.
+		if( strpos($string, '<script') !== false ) {
+			$string = str_replace('<script', htmlspecialchars('<script'), $string);
+			$string = str_replace('</script', htmlspecialchars('</script'), $string);
+		}
+		return $string;
 	}
-	return $string;
 }
 
 /**

includes/admin/admin-field-group.php

@@ -383,25 +383,16 @@ class acf_admin_field_group {
 	*/
 	
 	function post_submitbox_misc_actions() {
-		
-		// global
 		global $field_group;
+		$status_label = $field_group['active'] ? _x( 'Active', 'post status', 'acf' ) : _x( 'Disabled', 'post status', 'acf' );
 		
-		
+		?>
-		// vars
-		$status = $field_group['active'] ? __("Active",'acf') : __("Inactive",'acf');
-		
-?>
 <script type="text/javascript">
 (function($) {
-	
+	$('#post-status-display').html( '<?php echo esc_html( $status_label ); ?>' );
-	// modify status
-	$('#post-status-display').html('<?php echo $status; ?>');
-
 })(jQuery);	
 </script>
-<?php	
+		<?php
-		
 	}
 	
 	
@@ -748,13 +739,18 @@ class acf_admin_field_group {
 			acf_update_field($field);
 			
 			
-			// message
+			// Output HTML.
-			$a = '<a href="' . admin_url("post.php?post={$field_group['ID']}&action=edit") . '" target="_blank">' . $field_group['title'] . '</a>';
+			$link = '<a href="' . admin_url( 'post.php?post=' . $field_group['ID'] . '&action=edit' ) . '" target="_blank">' . esc_html( $field_group['title'] ) . '</a>';
-			echo '<p><strong>' . __('Move Complete.', 'acf') . '</strong></p>';
-			echo '<p>' . sprintf( __('The %s field can now be found in the %s field group', 'acf'), $field['label'], $a ). '</p>';
-			echo '<a href="#" class="button button-primary acf-close-popup">' . __("Close Window",'acf') . '</a>';
-			die();
 			
+			echo '' .
+				'<p><strong>' . __( 'Move Complete.', 'acf' ) . '</strong></p>' .
+				'<p>' . sprintf( 
+					acf_punctify( __( 'The %s field can now be found in the %s field group', 'acf' ) ), 
+					esc_html( $field['label'] ), 
+					$link
+				). '</p>' .
+				'<a href="#" class="button button-primary acf-close-popup">' . __( 'Close Window', 'acf' ) . '</a>';
+			die();
 		}
 		
 		

includes/admin/admin-notices.php

@@ -32,9 +32,6 @@ class ACF_Admin_Notice extends ACF_Data {
 		/** @type string Text displayed in notice. */
 		'text' => '',
 		
-		/** @type string Optional HTML alternative to text. 
-		'html' => '', */
-		
 		/** @type string The type of notice (warning, error, success, info). */
 		'type' => 'info',
 		
@@ -54,25 +51,14 @@ class ACF_Admin_Notice extends ACF_Data {
 	*  @return	void
 	*/
 	function render() {
+		$notice_text = $this->get('text');
+		$notice_type = $this->get('type');
+		$is_dismissible = $this->get('dismissible');
 		
-		// Ensure text contains punctuation.
-		// todo: Remove this after updating translations.
-		$text = $this->get('text');
-		if( substr($text, -1) !== '.' && substr($text, -1) !== '>' ) {
-			$text .= '.';
-		} 
-		
-		// Print HTML.
 		printf('<div class="acf-admin-notice notice notice-%s %s">%s</div>',
-			
+			esc_attr( $notice_type ),
-			// Type class.
+			$is_dismissible ? 'is-dismissible' : '',
-			$this->get('type'),
+			acf_esc_html( wpautop( acf_punctify( $notice_text ) ) )
-			
-			// Dismissible class.
-			$this->get('dismissible') ? 'is-dismissible' : '',
-			
-			// InnerHTML
-			$this->has('html') ? $this->get('html') : wpautop($text)
 		);
 	}
 }

includes/admin/admin-tools.php

@@ -243,9 +243,8 @@ class acf_admin_tools {
 			// check active
 			if( $active && $active !== $tool->name ) continue;
 			
-			
 			// add metabox
-			add_meta_box( 'acf-admin-tool-' . $tool->name, $tool->title, array($this, 'metabox_html'), $screen->id, 'normal', 'default', array('tool' => $tool->name) );
+			add_meta_box( 'acf-admin-tool-' . $tool->name, acf_esc_html( $tool->title ), array($this, 'metabox_html'), $screen->id, 'normal', 'default', array('tool' => $tool->name) );
 			
 		}
 		

includes/admin/views/field-group-field.php

@@ -1,34 +1,38 @@
 <?php 
 
-// vars
+// Define input name prefix using unique identifier.
-$prefix = 'acf_fields[' . $field['ID'] . ']';
+$input_prefix = 'acf_fields[' . $field['ID'] . ']';
-$id = acf_idify( $prefix );
+$input_id = acf_idify( $input_prefix );
 
-// add prefix
+// Update field props.
-$field['prefix'] = $prefix;
+$field['prefix'] = $input_prefix;
 
-// div
+// Elements.
-$div = array(
+$div_attrs = array(
-	'class' 	=> 'acf-field-object acf-field-object-' . acf_slugify($field['type']),
+	'class' 	=> 'acf-field-object acf-field-object-' . acf_slugify( $field['type'] ),
 	'data-id'	=> $field['ID'],
 	'data-key'	=> $field['key'],
 	'data-type'	=> $field['type'],
 );
 
-$meta = array(
+// Misc template vars.
-	'ID'			=> $field['ID'],
+$field_label = acf_get_field_label( $field, 'admin' );
-	'key'			=> $field['key'],
+$field_type_label = acf_get_field_type_label( $field['type'] );
-	'parent'		=> $field['parent'],
-	'menu_order'	=> $i,
-	'save'			=> ''
-);
 
 ?>
-<div <?php echo acf_esc_attr( $div ); ?>>
+<div <?php echo acf_esc_attr( $div_attrs ); ?>>
 	
 	<div class="meta">
-		<?php foreach( $meta as $k => $v ):
+		<?php 
-			acf_hidden_input(array( 'name' => $prefix . '[' . $k . ']', 'value' => $v, 'id' => $id . '-' . $k ));
+		$meta_inputs = array(
+			'ID'			=> $field['ID'],
+			'key'			=> $field['key'],
+			'parent'		=> $field['parent'],
+			'menu_order'	=> $i,
+			'save'			=> ''
+		);
+		foreach( $meta_inputs as $k => $v ):
+			acf_hidden_input(array( 'name' => $input_prefix . '[' . $k . ']', 'value' => $v, 'id' => $input_id . '-' . $k ));
 		endforeach; ?>
 	</div>
 	
@@ -39,7 +43,7 @@ $meta = array(
 			</li>
 			<li class="li-field-label">
 				<strong>
-					<a class="edit-field" title="<?php _e("Edit field",'acf'); ?>" href="#"><?php echo acf_get_field_label($field, 'admin'); ?></a>
+					<a class="edit-field" title="<?php _e("Edit field",'acf'); ?>" href="#"><?php echo acf_esc_html( $field_label ); ?></a>
 				</strong>
 				<div class="row-options">
 					<a class="edit-field" title="<?php _e("Edit field",'acf'); ?>" href="#"><?php _e("Edit",'acf'); ?></a>
@@ -49,9 +53,9 @@ $meta = array(
 				</div>
 			</li>
 			<?php // whitespace before field name looks odd but fixes chrome bug selecting all text in row ?>
-			<li class="li-field-name"> <?php echo $field['name']; ?></li>
+			<li class="li-field-name"> <?php echo esc_html( $field['name'] ); ?></li>
-			<li class="li-field-key"> <?php echo $field['key']; ?></li>
+			<li class="li-field-key"> <?php echo esc_html( $field['key'] ); ?></li>
-			<li class="li-field-type"> <?php echo acf_get_field_type_label($field['type']); ?></li>
+			<li class="li-field-type"> <?php echo esc_html( $field_type_label ); ?></li>
 		</ul>
 	</div>
 	

includes/api/api-helpers.php

@@ -3250,23 +3250,6 @@ function acf_get_truncated( $text, $length = 64 ) {
 	
 }
 
-
-/*
-*  acf_get_current_url
-*
-*  This function will return the current URL.
-*
-*  @date	23/01/2015
-*  @since	5.1.5
-*
-*  @param	void
-*  @return	string
-*/
-
-function acf_get_current_url() {
-	return ( is_ssl() ? 'https' : 'http' ) . '://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
-}
-
 /*
 *  acf_current_user_can_admin
 *
@@ -3450,53 +3433,6 @@ function acf_get_valid_terms( $terms = false, $taxonomy = 'category' ) {
 }
 
 
-/*
-*  acf_esc_html_deep
-*
-*  Navigates through an array and escapes html from the values.
-*
-*  @type	function
-*  @date	10/06/2015
-*  @since	5.2.7
-*
-*  @param	$value (mixed)
-*  @return	$value
-*/
-
-/*
-function acf_esc_html_deep( $value ) {
-	
-	// array
-	if( is_array($value) ) {
-		
-		$value = array_map('acf_esc_html_deep', $value);
-	
-	// object
-	} elseif( is_object($value) ) {
-		
-		$vars = get_object_vars( $value );
-		
-		foreach( $vars as $k => $v ) {
-			
-			$value->{$k} = acf_esc_html_deep( $v );
-		
-		}
-		
-	// string
-	} elseif( is_string($value) ) {
-
-		$value = esc_html($value);
-
-	}
-	
-	
-	// return
-	return $value;
-
-}
-*/
-
-
 /*
 *  acf_validate_attachment
 *

includes/assets.php

@@ -115,9 +115,9 @@ class ACF_Assets {
 		wp_register_script( 'acf-field-group', acf_get_url( 'assets/js/acf-field-group' . $suffix . '.js' ), array( 'acf-input' ), $version );
 		
 		// Register styles.
-		wp_register_style( 'acf-global', acf_get_url( 'assets/css/acf-global.css' ), array(), $version );
+		wp_register_style( 'acf-global', acf_get_url( 'assets/css/acf-global.css' ), array( 'dashicons' ), $version );
-		wp_register_style( 'acf-input', acf_get_url( 'assets/css/acf-input.css' ), array('acf-global'), $version );
+		wp_register_style( 'acf-input', acf_get_url( 'assets/css/acf-input.css' ), array( 'acf-global' ), $version );
-		wp_register_style( 'acf-field-group', acf_get_url( 'assets/css/acf-field-group.css' ), array('acf-input'), $version );
+		wp_register_style( 'acf-field-group', acf_get_url( 'assets/css/acf-field-group.css' ), array( 'acf-input' ), $version );
 		
 		/**
 		 * Fires after core scripts and styles have been registered.

includes/fields/class-acf-field-date_picker.php

@@ -120,6 +120,7 @@ class acf_field_date_picker extends acf_field {
 		// special attributes
 		foreach( array( 'readonly', 'disabled' ) as $k ) {
 			if( !empty($field[ $k ]) ) {
+				$hidden_input[ $k ] = $k;
 				$text_input[ $k ] = $k;
 			}
 		}

includes/fields/class-acf-field-date_time_picker.php

@@ -103,45 +103,43 @@ class acf_field_date_and_time_picker extends acf_field {
 	
 	function render_field( $field ) {
 		
-		// format value
+		// Set value.
 		$hidden_value = '';
 		$display_value = '';
 		
 		if( $field['value'] ) {
-			
 			$hidden_value = acf_format_date( $field['value'], 'Y-m-d H:i:s' );
 			$display_value = acf_format_date( $field['value'], $field['display_format'] );
-			
 		}
 		
+		// Convert "display_format" setting to individual date and time formats.
+		$formats = acf_split_date_time( $field['display_format'] );
 		
-		// convert display_format to date and time
+		// Elements.
-		// the letter 'm' is used for date and minute in JS, so this must be done here in PHP
-		$formats = acf_split_date_time($field['display_format']);
-		
-		
-		// vars
 		$div = array(
 			'class'					=> 'acf-date-time-picker acf-input-wrap',
 			'data-date_format'		=> acf_convert_date_to_js($formats['date']),
 			'data-time_format'		=> acf_convert_time_to_js($formats['time']),
 			'data-first_day'		=> $field['first_day'],
 		);
-		
 		$hidden_input = array(
 			'id'					=> $field['id'],
 			'class' 				=> 'input-alt',
 			'name'					=> $field['name'],
 			'value'					=> $hidden_value,
 		);
-		
 		$text_input = array(
 			'class' 				=> 'input',
 			'value'					=> $display_value,
 		);
+		foreach( array( 'readonly', 'disabled' ) as $k ) {
+			if( !empty($field[ $k ]) ) {
+				$hidden_input[ $k ] = $k;
+				$text_input[ $k ] = $k;
+			}
+		}
 		
-		
+		// Output.
-		// html
 		?>
 		<div <?php acf_esc_attr_e( $div ); ?>>
 			<?php acf_hidden_input( $hidden_input ); ?>

includes/fields/class-acf-field-email.php

@@ -163,8 +163,8 @@ class acf_field_email extends acf_field {
 	 * @return bool|string
 	 */
 	public function validate_value( $valid, $value, $field, $input ) {
-		if ( $value && filter_var( $value, FILTER_VALIDATE_EMAIL ) === false ) {
+		if ( $value && filter_var( wp_unslash($value), FILTER_VALIDATE_EMAIL ) === false ) {
-			return sprintf( __( "'%s' is not a valid email address", 'acf' ), $value );
+			return sprintf( __( "'%s' is not a valid email address", 'acf' ), esc_html( $value ) );
 		}
 
 		return $valid;

includes/fields/class-acf-field-radio.php

@@ -68,43 +68,32 @@ class acf_field_radio extends acf_field {
 		$ul['class'] .= ' ' . $field['class'];
 		
 		
-		// select value
+		// Determine selected value.
-		$checked = '';
+		$value = (string) $field['value'];
-		$value = strval($field['value']);
 		
-		
+		// 1. Selected choice.
-		// selected choice
+		if( isset( $field['choices'][ $value ] ) ) {
-		if( isset($field['choices'][ $value ]) ) {
+			$checked = (string) $value;
 			
-			$checked = $value;
+		// 2. Custom choice.
-			
-		// custom choice
 		} elseif( $field['other_choice'] && $value !== '' ) {
-			
 			$checked = 'other';
 			
-		// allow null	
+		// 3. Empty choice. 
 		} elseif( $field['allow_null'] ) {
+			$checked = '';
 			
-			// do nothing
+		// 4. Default to first choice.
-			
-		// select first input by default	
 		} else {
-			
+			$checked = (string) key( $field['choices'] );
-			$checked = key($field['choices']);
-			
 		}
-		
-		
-		// ensure $checked is a string (could be an int)
-		$checked = strval($checked); 
-		
 				
 		// other choice
+		$other_input = false;
 		if( $field['other_choice'] ) {
 			
-			// vars
+			// Define other input attrs.
-			$input = array(
+			$other_input = array(
 				'type'		=> 'text',
 				'name'		=> $field['name'],
 				'value'		=> '',
@@ -112,89 +101,70 @@ class acf_field_radio extends acf_field {
 				'class'		=> 'acf-disabled'
 			);
 			
-			
+			// Select other choice if value is not a valid choice.
-			// select other choice if value is not a valid choice
 			if( $checked === 'other' ) {
-				
+				unset( $other_input['disabled'] );
-				unset($input['disabled']);
+				$other_input['value'] = $field['value'];
-				$input['value'] = $field['value'];
-				
 			}
 			
-			
+			// Ensure an 'other' choice is defined.
-			// allow custom 'other' choice to be defined
+			if( !isset( $field['choices']['other'] ) ) {
-			if( !isset($field['choices']['other']) ) {
-				
 				$field['choices']['other'] = '';
-				
 			}
-			
-			
-			// append other choice
-			$field['choices']['other'] .= '</label> <input type="text" ' . acf_esc_attr($input) . ' /><label>';
-		
 		}
 		
+		// Bail early if no choices.
+		if( empty( $field['choices'] ) ) {
+			return;
+		}
 		
-		// bail early if no choices
+		// Hiden input.
-		if( empty($field['choices']) ) return;
-		
-		
-		// hiden input
 		$e .= acf_get_hidden_input( array('name' => $field['name']) );
 		
-		
+		// Open <ul>.
-		// open
 		$e .= '<ul ' . acf_esc_attr($ul) . '>';
 		
-		
+		// Loop through choices.
-		// foreach choices
 		foreach( $field['choices'] as $value => $label ) {
+			$is_selected = false;
 			
-			// ensure value is a string
+			// Ensure value is a string.
-			$value = strval($value);
+			$value = (string) $value;
-			$class = '';
 			
-			
+			// Define input attrs.
-			// vars
+			$attrs = array(
-			$atts = array(
 				'type'	=> 'radio',
 				'id'	=> sanitize_title( $field['id'] . '-' . $value ), 
 				'name'	=> $field['name'],
 				'value'	=> $value
 			);
 			
-			
+			// Check if selected.
-			// checked
+			if( esc_attr($value) === esc_attr($checked) ) {
-			if( $value === $checked ) {
+				$attrs['checked'] = 'checked';
-				
+				$is_selected = true;
-				$atts['checked'] = 'checked';
-				$class = ' class="selected"';
-				
 			}
 			
-			
+			// Check if is disabled.
-			// deisabled
 			if( isset($field['disabled']) && acf_in_array($value, $field['disabled']) ) {
-			
+				$attrs['disabled'] = 'disabled';
-				$atts['disabled'] = 'disabled';
-				
 			}
 			
+			// Additional HTML (the "Other" input).
+			$additional_html = '';
+			if( $value === 'other' && $other_input ) {
+				$additional_html = ' ' . acf_get_text_input( $other_input );
+			}
 			
 			// append
-			$e .= '<li><label' . $class . '><input ' . acf_esc_attr( $atts ) . '/>' . $label . '</label></li>';
+			$e .= '<li><label' . ( $is_selected ? ' class="selected"' : '' ) . '><input ' . acf_esc_attr( $attrs ) . '/>' . acf_esc_html( $label ) . '</label>' . $additional_html . '</li>';
-			
 		}
 		
-		
+		// Close <ul>.
-		// close
 		$e .= '</ul>';
 		
-		
+		// Output HTML.
-		// return
 		echo $e;
-		
 	}
 	
 	

includes/fields/class-acf-field-time_picker.php

@@ -46,15 +46,14 @@ class acf_field_time_picker extends acf_field {
 	
 	function render_field( $field ) {
 		
-		// format value
+		// Set value.
 		$display_value = '';
 		
 		if( $field['value'] ) {
 			$display_value = acf_format_date( $field['value'], $field['display_format'] );
 		}
 		
-		
+		// Elements.
-		// vars
 		$div = array(
 			'class'					=> 'acf-time-picker acf-input-wrap',
 			'data-time_format'		=> acf_convert_time_to_js($field['display_format'])
@@ -71,9 +70,14 @@ class acf_field_time_picker extends acf_field {
 			'type'					=> 'text',
 			'value'					=> $display_value,
 		);
+		foreach( array( 'readonly', 'disabled' ) as $k ) {
+			if( !empty($field[ $k ]) ) {
+				$hidden_input[ $k ] = $k;
+				$text_input[ $k ] = $k;
+			}
+		}
 		
-		
+		// Output.
-		// html
 		?>
 		<div <?php acf_esc_attr_e( $div ); ?>>
 			<?php acf_hidden_input( $hidden_input ); ?>

includes/fields/class-acf-field-wysiwyg.php

@@ -206,7 +206,6 @@ class acf_field_wysiwyg extends acf_field {
 		$id = uniqid('acf-editor-');
 		$default_editor = 'html';
 		$show_tabs = true;
-		$button = '';
 		
 		
 		// get height
@@ -250,31 +249,6 @@ class acf_field_wysiwyg extends acf_field {
 		$switch_class = ($default_editor === 'html') ? 'html-active' : 'tmce-active';
 		
 		
-		// filter value for editor
-		remove_filter( 'acf_the_editor_content', 'format_for_editor', 10, 2 );
-		remove_filter( 'acf_the_editor_content', 'wp_htmledit_pre', 10, 1 );
-		remove_filter( 'acf_the_editor_content', 'wp_richedit_pre', 10, 1 );
-		
-		
-		// WP 4.3
-		if( acf_version_compare('wp', '>=', '4.3') ) {
-			
-			add_filter( 'acf_the_editor_content', 'format_for_editor', 10, 2 );
-			
-			$button = 'data-wp-editor-id="' . $id . '"';
-			
-		// WP < 4.3
-		} else {
-			
-			$function = ($default_editor === 'html') ? 'wp_htmledit_pre' : 'wp_richedit_pre';
-			
-			add_filter('acf_the_editor_content', $function, 10, 1);
-			
-			$button = 'onclick="switchEditors.switchto(this);"';
-			
-		}
-		
-		
 		// filter
 		$field['value'] = apply_filters( 'acf_the_editor_content', $field['value'], $default_editor );
 		
@@ -304,9 +278,9 @@ class acf_field_wysiwyg extends acf_field {
 		
 		?>
 		<div <?php acf_esc_attr_e($wrap); ?>>
-			<div id="wp-<?php echo $id; ?>-editor-tools" class="wp-editor-tools hide-if-no-js">
+			<div id="wp-<?php echo esc_attr( $id ); ?>-editor-tools" class="wp-editor-tools hide-if-no-js">
 				<?php if( $field['media_upload'] ): ?>
-				<div id="wp-<?php echo $id; ?>-media-buttons" class="wp-media-buttons">
+				<div id="wp-<?php echo esc_attr( $id ); ?>-media-buttons" class="wp-media-buttons">
 					<?php 
 					if( !function_exists( 'media_buttons' ) ) {
 						require ABSPATH . 'wp-admin/includes/media.php';
@@ -317,12 +291,12 @@ class acf_field_wysiwyg extends acf_field {
 				<?php endif; ?>
 				<?php if( user_can_richedit() && $show_tabs ): ?>
 					<div class="wp-editor-tabs">
-						<button id="<?php echo $id; ?>-tmce" class="wp-switch-editor switch-tmce" <?php echo $button; ?> type="button"><?php echo __('Visual', 'acf'); ?></button>
+						<button id="<?php echo esc_attr( $id ); ?>-tmce" class="wp-switch-editor switch-tmce" data-wp-editor-id="<?php echo esc_attr( $id ); ?>" type="button"><?php echo __('Visual', 'acf'); ?></button>
-						<button id="<?php echo $id; ?>-html" class="wp-switch-editor switch-html" <?php echo $button; ?> type="button"><?php echo _x( 'Text', 'Name for the Text editor tab (formerly HTML)', 'acf' ); ?></button>
+						<button id="<?php echo esc_attr( $id ); ?>-html" class="wp-switch-editor switch-html" data-wp-editor-id="<?php echo esc_attr( $id ); ?>" type="button"><?php echo _x( 'Text', 'Name for the Text editor tab (formerly HTML)', 'acf' ); ?></button>
 					</div>
 				<?php endif; ?>
 			</div>
-			<div id="wp-<?php echo $id; ?>-editor-container" class="wp-editor-container">
+			<div id="wp-<?php echo esc_attr( $id ); ?>-editor-container" class="wp-editor-container">
 				<?php if( $field['delay'] ): ?>
 					<div class="acf-editor-toolbar"><?php _e('Click to initialize TinyMCE', 'acf'); ?></div>
 				<?php endif; ?>

includes/forms/form-post.php

@@ -122,7 +122,7 @@ class ACF_Form_Post {
 				);
 				
 				// Add the meta box.
-				add_meta_box( $id, $title, array($this, 'render_meta_box'), $post_type, $context, $priority, array('field_group' => $field_group) );
+				add_meta_box( $id, acf_esc_html( $title ), array($this, 'render_meta_box'), $post_type, $context, $priority, array('field_group' => $field_group) );
 				
 			}
 			

includes/forms/form-user.php

@@ -333,7 +333,7 @@ class ACF_Form_User {
 			foreach( $acf_errors as $acf_error ) {
 				$errors->add(
 					acf_idify( $acf_error['input'] ), 
-					acf_punctify( sprintf( __('<strong>ERROR</strong>: %s', 'acf'), $acf_error['message'] ) )
+					acf_esc_html( acf_punctify( sprintf( __('<strong>Error</strong>: %s', 'acf'), $acf_error['message'] ) ) )
 				);
 			}
 		}

includes/third-party.php

@@ -136,7 +136,7 @@ class acf_third_party {
 				
 				
 				// add meta box
-				add_meta_box( $id, $title, '__return_true', $post_type );
+				add_meta_box( $id, acf_esc_html( $title ), '__return_true', $post_type );
 				
 			}
 			

includes/walkers/class-acf-walker-taxonomy-field.php

@@ -1,55 +1,131 @@
 <?php 
 
-if( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
+if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly
 
-if( ! class_exists('ACF_Taxonomy_Field_Walker') ) :
+if ( ! class_exists('ACF_Taxonomy_Field_Walker') ) :
 
 class ACF_Taxonomy_Field_Walker extends Walker {
 	
-	var $field = null,
+	/**
-		$tree_type = 'category',
+	 * What the class handles.
-		$db_fields = array ( 'parent' => 'parent', 'id' => 'term_id' );
+	 *
+	 * @since 2.1.0
+	 * @var string
+	 */
+	public $tree_type = 'category';
 	
+	/**
+	 * DB fields to use.
+	 *
+	 * @since 2.1.0
+	 * @var array
+	 */
+	public $db_fields = array(
+		'parent' => 'parent',
+		'id'     => 'term_id',
+	);
+	
+	/**
+	 * The field being rendered.
+	 *
+	 * @since 1.0.0
+	 * @var array
+	 */
+	public $field;
+	
+	/**
+	 * Constructor
+	 *
+	 * @date	20/4/21
+	 * @since 	1.0.0
+	 *
+	 * @param	array $field The field being rendered.
+	 * @return	void
+	 */
 	function __construct( $field ) {
-	
 		$this->field = $field;
-		
-	}
-
-	function start_el( &$output, $term, $depth = 0, $args = array(), $current_object_id = 0) {
-		
-		// vars
-		$selected = in_array( $term->term_id, $this->field['value'] );
-		
-		
-		// append
-		$output .= '<li data-id="' . $term->term_id . '"><label' . ($selected ? ' class="selected"' : '') . '><input type="' . $this->field['field_type'] . '" name="' . $this->field['name'] . '" value="' . $term->term_id . '" ' . ($selected ? 'checked="checked"' : '') . ' /> <span>' . $term->name . '</span></label>';
-				
 	}
 	
-	function end_el( &$output, $term, $depth = 0, $args = array() ) {
+	/**
-	
+	 * Starts the list before the elements are added.
-		// append
+	 *
-		$output .= '</li>' .  "\n";
+	 * @see Walker:start_lvl()
-		
+	 *
+	 * @since 1.0.0
+	 *
+	 * @param string $output Used to append additional content (passed by reference).
+	 * @param int    $depth  Depth of category. Used for tab indentation.
+	 * @param array  $args   An array of arguments. @see wp_terms_checklist()
+	 */
+	public function start_lvl( &$output, $depth = 0, $args = array() ) {
+		$indent  = str_repeat( "\t", $depth );
+		$output .= "$indent<ul class='children acf-bl'>\n";
 	}
 	
-	function start_lvl( &$output, $depth = 0, $args = array() ) {
+	/**
-		
+	 * Ends the list of after the elements are added.
-		// append
+	 *
-		$output .= '<ul class="children acf-bl">' . "\n";
+	 * @see Walker::end_lvl()
-		
+	 *
-	}
+	 * @since 1.0.0
-
+	 *
-	function end_lvl( &$output, $depth = 0, $args = array() ) {
+	 * @param string $output Used to append additional content (passed by reference).
-	
+	 * @param int    $depth  Depth of category. Used for tab indentation.
-		// append
+	 * @param array  $args   An array of arguments. @see wp_terms_checklist()
-		$output .= '</ul>' . "\n";
+	 */
-		
+	public function end_lvl( &$output, $depth = 0, $args = array() ) {
+		$indent  = str_repeat( "\t", $depth );
+		$output .= "$indent</ul>\n";
 	}
 	
+	/**
+	 * Start the element output.
+	 *
+	 * @see Walker::start_el()
+	 *
+	 * @since 1.0.0
+	 *
+	 * @param string  $output   Used to append additional content (passed by reference).
+	 * @param WP_Term $term 	The current term object.
+	 * @param int     $depth    Depth of the term in reference to parents. Default 0.
+	 * @param array   $args     An array of arguments. @see wp_terms_checklist()
+	 * @param int     $id       ID of the current term.
+	 */
+	public function start_el( &$output, $term, $depth = 0, $args = array(), $id = 0 ) {
+		$is_selected = in_array( $term->term_id, $this->field['value'] );
+		
+		// Generate array of checkbox input attributes.
+		$input_attrs = array(
+			'type'	=> $this->field['field_type'],
+			'name'	=> $this->field['name'],
+			'value' => $term->term_id
+		);
+		if ( $is_selected ) {
+			$input_attrs['checked'] = true;
+		}
+		
+		$output .= "\n" . '<li data-id="' . esc_attr( $term->term_id ) . '">' . 
+			'<label' . ( $is_selected ? ' class="selected"' : '' ) . '>' . 
+				'<input ' . acf_esc_attrs( $input_attrs ) . '/> ' . 
+				'<span>' . acf_esc_html( $term->name ) . '</span>'.
+			'</label>';
+	}
+	
+	/**
+	 * Ends the element output, if needed.
+	 *
+	 * @see Walker::end_el()
+	 *
+	 * @since 1.0.0
+	 *
+	 * @param string  $output   Used to append additional content (passed by reference).
+	 * @param WP_Term $category The current term object.
+	 * @param int     $depth    Depth of the term in reference to parents. Default 0.
+	 * @param array   $args     An array of arguments. @see wp_terms_checklist()
+	 */
+	public function end_el( &$output, $category, $depth = 0, $args = array() ) {
+		$output .= "</li>\n";
+	}
 }
 
 endif;
-
- ?>

lang/acf-fr_FR.po

@@ -3,7 +3,7 @@ msgstr ""
 "Project-Id-Version: Advanced Custom Fields Pro v5.8.5\n"
 "Report-Msgid-Bugs-To: http://support.advancedcustomfields.com\n"
 "POT-Creation-Date: 2020-08-17 10:46+0200\n"
-"PO-Revision-Date: 2020-09-11 10:26+0930\n"
+"PO-Revision-Date: 2021-03-31 09:22+0930\n"
 "Last-Translator: Elliot Condon <e@elliotcondon.com>\n"
 "Language-Team: Français\n"
 "Language: fr_FR\n"
@@ -3234,7 +3234,7 @@ msgstr "Retirer la disposition"
 #: pro/fields/class-acf-field-flexible-content.php:416
 #: pro/fields/class-acf-field-repeater.php:301
 msgid "Click to toggle"
-msgstr "Cliquer pour intervertir"
+msgstr "Cliquer pour ouvrir/fermer"
 
 # @ acf
 #: pro/fields/class-acf-field-flexible-content.php:556

pro/admin/admin-options-page.php

@@ -69,7 +69,7 @@ class acf_admin_options_page {
 			// child
 			} else {
 				
-				$slug = add_submenu_page( $page['parent_slug'], $page['page_title'], $page['menu_title'], $page['capability'], $page['menu_slug'], array($this, 'html') );
+				$slug = add_submenu_page( $page['parent_slug'], $page['page_title'], $page['menu_title'], $page['capability'], $page['menu_slug'], array($this, 'html'), $page['position'] );
 				
 			}
 			
@@ -232,7 +232,7 @@ class acf_admin_options_page {
 				
 				
 				// add meta box
-				add_meta_box( $id, $title, array($this, 'postbox_acf'), 'acf_options_page', $context, $priority, $args );
+				add_meta_box( $id, acf_esc_html( $title ), array($this, 'postbox_acf'), 'acf_options_page', $context, $priority, $args );
 				
 				
 			}

pro/fields/class-acf-field-clone.php

@@ -731,37 +731,28 @@ class acf_field_clone extends acf_field {
 		<tr>
 		<?php foreach( $field['sub_fields'] as $sub_field ): 
 			
-			// prepare field (allow sub fields to be removed)
+			// Prepare field (allow sub fields to be removed).
 			$sub_field = acf_prepare_field($sub_field);
-			
+			if( !$sub_field ) {
-			
+				continue;
-			// bail ealry if no field
-			if( !$sub_field ) continue;
-			
-			
-			// vars
-			$atts = array();
-			$atts['class'] = 'acf-th';
-			$atts['data-name'] = $sub_field['_name'];
-			$atts['data-type'] = $sub_field['type'];
-			$atts['data-key'] = $sub_field['key'];
-			
-			
-			// Add custom width
-			if( $sub_field['wrapper']['width'] ) {
-			
-				$atts['data-width'] = $sub_field['wrapper']['width'];
-				$atts['style'] = 'width: ' . $sub_field['wrapper']['width'] . '%;';
-				
 			}
 			
+			// Define attrs.
+			$attrs = array();
+			$attrs['class'] = 'acf-th';
+			$attrs['data-name'] = $sub_field['_name'];
+			$attrs['data-type'] = $sub_field['type'];
+			$attrs['data-key'] = $sub_field['key'];
+			
+			if( $sub_field['wrapper']['width'] ) {
+				$attrs['data-width'] = $sub_field['wrapper']['width'];
+				$attrs['style'] = 'width: ' . $sub_field['wrapper']['width'] . '%;';
+			}
 				
 			?>
-			<th <?php acf_esc_attr_e( $atts ); ?>>
+			<th <?php acf_esc_attr_e( $attrs ); ?>>
-				<?php echo acf_get_field_label( $sub_field ); ?>
+				<?php acf_render_field_label( $sub_field ); ?>
-				<?php if( $sub_field['instructions'] ): ?>
+				<?php acf_render_field_instructions( $sub_field ); ?>
-					<p class="description"><?php echo $sub_field['instructions']; ?></p>
-				<?php endif; ?>
 			</th>
 		<?php endforeach; ?>
 		</tr>

pro/fields/class-acf-field-flexible-content.php

@@ -286,14 +286,15 @@ class acf_field_flexible_content extends acf_field {
 		// no value message
 		$no_value_message = __('Click the "%s" button below to start creating your layout','acf');
 		$no_value_message = apply_filters('acf/fields/flexible_content/no_value_message', $no_value_message, $field);
-
+		$no_value_message = sprintf( $no_value_message, $field['button_label'] );
+		
 ?>
 <div <?php acf_esc_attr_e( $div ); ?>>
 	
 	<?php acf_hidden_input(array( 'name' => $field['name'] )); ?>
 	
 	<div class="no-value-message">
-		<?php printf( $no_value_message, $field['button_label'] ); ?>
+		<?php echo acf_esc_html( $no_value_message ); ?>
 	</div>
 	
 	<div class="clones">
@@ -320,7 +321,7 @@ class acf_field_flexible_content extends acf_field {
 	</div>
 	
 	<div class="acf-actions">
-		<a class="acf-button button button-primary" href="#" data-name="add-layout"><?php echo $field['button_label']; ?></a>
+		<a class="acf-button button button-primary" href="#" data-name="add-layout"><?php echo acf_esc_html( $field['button_label'] ); ?></a>
 	</div>
 	
 	<script type="text-html" class="tmpl-popup"><?php 
@@ -333,7 +334,7 @@ class acf_field_flexible_content extends acf_field {
 				'data-max' 		=> $layout['max'],
 			);
 			
-			?><li><a <?php acf_esc_attr_e( $atts ); ?>><?php echo $layout['label']; ?></a></li><?php 
+			?><li><a <?php acf_esc_attr_e( $atts ); ?>><?php echo acf_esc_html( $layout['label'] ); ?></a></li><?php 
 		
 		endforeach; ?></ul>
 	</script>
@@ -407,7 +408,7 @@ class acf_field_flexible_content extends acf_field {
 			
 	<?php acf_hidden_input(array( 'name' => $prefix.'[acf_fc_layout]', 'value' => $layout['name'] )); ?>
 	
-	<div class="acf-fc-layout-handle" title="<?php _e('Drag to reorder','acf'); ?>" data-name="collapse-layout"><?php echo $title; ?></div>
+	<div class="acf-fc-layout-handle" title="<?php _e('Drag to reorder','acf'); ?>" data-name="collapse-layout"><?php echo acf_esc_html( $title ); ?></div>
 	
 	<div class="acf-fc-layout-controls">
 		<a class="acf-icon -plus small light acf-js-tooltip" href="#" data-name="add-layout" title="<?php _e('Add layout','acf'); ?>"></a>
@@ -425,38 +426,32 @@ class acf_field_flexible_content extends acf_field {
 			<tr>
 				<?php foreach( $sub_fields as $sub_field ): 
 					
-					// prepare field (allow sub fields to be removed)
+					// Set prefix to generate correct "for" attribute on <label>.
+					$sub_field['prefix'] = $prefix;
+					
+					// Prepare field (allow sub fields to be removed).
 					$sub_field = acf_prepare_field($sub_field);
+					if( !$sub_field ) {
+						continue;
+					}
 					
+					// Define attrs.
+					$attrs = array();
+					$attrs['class'] = 'acf-th';
+					$attrs['data-name'] = $sub_field['_name'];
+					$attrs['data-type'] = $sub_field['type'];
+					$attrs['data-key'] = $sub_field['key'];
 					
-					// bail ealry if no field
-					if( !$sub_field ) continue;
-					
-					
-					// vars
-					$atts = array();
-					$atts['class'] = 'acf-th';
-					$atts['data-name'] = $sub_field['_name'];
-					$atts['data-type'] = $sub_field['type'];
-					$atts['data-key'] = $sub_field['key'];
-					
-					
-					// Add custom width
 					if( $sub_field['wrapper']['width'] ) {
-					
+						$attrs['data-width'] = $sub_field['wrapper']['width'];
-						$atts['data-width'] = $sub_field['wrapper']['width'];
+						$attrs['style'] = 'width: ' . $sub_field['wrapper']['width'] . '%;';
-						$atts['style'] = 'width: ' . $sub_field['wrapper']['width'] . '%;';
-						
 					}
 					
 					?>
-					<th <?php echo acf_esc_attr( $atts ); ?>>
+					<th <?php acf_esc_attr_e( $attrs ); ?>>
-						<?php echo acf_get_field_label( $sub_field ); ?>
+						<?php acf_render_field_label( $sub_field ); ?>
-						<?php if( $sub_field['instructions'] ): ?>
+						<?php acf_render_field_instructions( $sub_field ); ?>
-							<p class="description"><?php echo $sub_field['instructions']; ?></p>
-						<?php endif; ?>
 					</th>
-					
 				<?php endforeach; ?> 
 			</tr>
 		</thead>
@@ -549,7 +544,7 @@ class acf_field_flexible_content extends acf_field {
 			$layout_prefix = "{$field['prefix']}[layouts][{$layout['key']}]";
 			
 			
-?><tr class="acf-field acf-field-setting-fc_layout" data-name="fc_layout" data-setting="flexible_content" data-id="<?php echo $layout['key']; ?>">
+?><tr class="acf-field acf-field-setting-fc_layout" data-name="fc_layout" data-setting="flexible_content" data-id="<?php echo esc_attr( $layout['key'] ); ?>">
 	<td class="acf-label">
 		<label><?php _e("Layout",'acf'); ?></label>
 		<ul class="acf-bl acf-fl-actions">
@@ -1513,7 +1508,7 @@ class acf_field_flexible_content extends acf_field {
 		
 		// prepend order
 		$order = is_numeric($i) ? $i+1 : 0;
-		$title = '<span class="acf-fc-layout-order">' . $order . '</span> ' . $title;
+		$title = '<span class="acf-fc-layout-order">' . $order . '</span> ' . acf_esc_html( $title );
 		
 		
 		// return

pro/fields/class-acf-field-repeater.php

@@ -246,36 +246,31 @@ class acf_field_repeater extends acf_field {
 				
 				<?php foreach( $sub_fields as $sub_field ): 
 					
-					// prepare field (allow sub fields to be removed)
+					// Prepare field (allow sub fields to be removed).
 					$sub_field = acf_prepare_field($sub_field);
-					
+					if( !$sub_field ) {
-					
+						continue;
-					// bail ealry if no field
-					if( !$sub_field ) continue;
-					
-					
-					// vars
-					$atts = array();
-					$atts['class'] = 'acf-th';
-					$atts['data-name'] = $sub_field['_name'];
-					$atts['data-type'] = $sub_field['type'];
-					$atts['data-key'] = $sub_field['key'];
-					
-					
-					// Add custom width
-					if( $sub_field['wrapper']['width'] ) {
-					
-						$atts['data-width'] = $sub_field['wrapper']['width'];
-						$atts['style'] = 'width: ' . $sub_field['wrapper']['width'] . '%;';
-						
 					}
 					
+					// Define attrs.
+					$attrs = array();
+					$attrs['class'] = 'acf-th';
+					$attrs['data-name'] = $sub_field['_name'];
+					$attrs['data-type'] = $sub_field['type'];
+					$attrs['data-key'] = $sub_field['key'];
+					
+					if( $sub_field['wrapper']['width'] ) {
+						$attrs['data-width'] = $sub_field['wrapper']['width'];
+						$attrs['style'] = 'width: ' . $sub_field['wrapper']['width'] . '%;';
+					}
+					
+					// Remove "id" to avoid "for" attribute on <label>.
+					$sub_field['id'] = '';
+					
 					?>
-					<th <?php echo acf_esc_attr( $atts ); ?>>
+					<th <?php acf_esc_attr_e( $attrs ); ?>>
-						<?php echo acf_get_field_label( $sub_field ); ?>
+						<?php acf_render_field_label( $sub_field ); ?>
-						<?php if( $sub_field['instructions'] ): ?>
+						<?php acf_render_field_instructions( $sub_field ); ?>
-							<p class="description"><?php echo $sub_field['instructions']; ?></p>
-						<?php endif; ?>
 					</th>
 				<?php endforeach; ?>
 
@@ -293,7 +288,7 @@ class acf_field_repeater extends acf_field {
 			$id = ( $i === 'acfcloneindex' ) ? 'acfcloneindex' : "row-$i";
 			
 			?>
-			<tr class="acf-row<?php if( $i === 'acfcloneindex' ){ echo ' acf-clone'; } ?>" data-id="<?php echo $id; ?>">
+			<tr class="acf-row<?php if( $i === 'acfcloneindex' ){ echo ' acf-clone'; } ?>" data-id="<?php echo esc_attr( $id ); ?>">
 				
 				<?php if( $show_order ): ?>
 					<td class="acf-row-handle order" title="<?php _e('Drag to reorder','acf'); ?>">
@@ -348,7 +343,7 @@ class acf_field_repeater extends acf_field {
 <?php if( $show_add ): ?>
 	
 	<div class="acf-actions">
-		<a class="acf-button button button-primary" href="#" data-event="add-row"><?php echo $field['button_label']; ?></a>
+		<a class="acf-button button button-primary" href="#" data-event="add-row"><?php echo acf_esc_html( $field['button_label'] ); ?></a>
 	</div>
 			
 <?php endif; ?>

pro/options-page.php

@@ -6,7 +6,7 @@ if( ! class_exists('acf_options_page') ) :
 
 class acf_options_page {
 	
-	/** @var array Contains an array of optiions page settings */
+	/** @var array Contains an array of options page settings */
 	var $pages = array();
 	
 	
@@ -29,35 +29,28 @@ class acf_options_page {
 		
 	}
 	
-	
+	/**
-	/*
+	 * Validates an Options Page settings array.
-	*  validate_page
+	 *
-	*
+	 * @date	28/2/17
-	*  description
+	 * @since	5.5.8
-	*
+	 *
-	*  @type	function
+	 * @param	array|string $page The Options Page settings array or name.
-	*  @date	28/2/17
+	 * @return	array
-	*  @since	5.5.8
+	 */
-	*
-	*  @param	$post_id (int)
-	*  @return	$post_id (int)
-	*/
-	
 	function validate_page( $page ) {
 		
-		// default
+		// Allow empty arg to generate the default Options Page.
 		if( empty($page) ) {
-			
+			$page_title =  __( 'Options', 'acf' );
-			$page_title =  __('Options', 'acf');
 			$page = array(
 				'page_title'	=> $page_title,
 				'menu_title'	=> $page_title,
 				'menu_slug' 	=> 'acf-options'
 			);
 		
-		// string		
+		// Allow string to define Options Page name.		
 		} elseif( is_string($page) ) {
-		
 			$page_title = $page;
 			$page = array(
 				'page_title'	=> $page_title,
@@ -65,58 +58,52 @@ class acf_options_page {
 			);
 		}
 		
-		
+		// Apply defaults.
-		// defaults
+		$page = wp_parse_args( $page, array(
-		$page = wp_parse_args($page, array(
 			'page_title' 		=> '',
 			'menu_title'		=> '',
 			'menu_slug' 		=> '',
 			'capability'		=> 'edit_posts',
 			'parent_slug'		=> '',
-			'position'			=> false,
+			'position'			=> null,
 			'icon_url'			=> false,
 			'redirect'			=> true,
 			'post_id'			=> 'options',
 			'autoload'			=> false,
-			'update_button'		=> __('Update', 'acf'),
+			'update_button'		=> __( 'Update', 'acf' ),
-			'updated_message'	=> __("Options Updated", 'acf'),
+			'updated_message'	=> __( 'Options Updated', 'acf' ),
 		));
 		
-		
+		// Allow compatibility for changed settings.
-		// ACF4 compatibility
 		$migrate = array(
 			'title' 	=> 'page_title',
 			'menu'		=> 'menu_title',
 			'slug'		=> 'menu_slug',
 			'parent'	=> 'parent_slug'
 		);
-		
 		foreach( $migrate as $old => $new ) {
-			if( !empty($page[$old]) ) {
+			if( !empty( $page[ $old ] ) ) {
 				$page[ $new ] = $page[ $old ];
 			}
 		}
 		
-		
+		// If no menu_title is set, use the page_title value.
-		// page_title (allows user to define page with just page_title or title)
+		if( empty( $page['menu_title'] ) ) {
-		if( empty($page['menu_title']) ) {
 			$page['menu_title'] = $page['page_title'];
 		}
 		
-		
+		// If no menu_slug is set, generate one using the menu_title value.
-		// menu_slug
 		if( empty($page['menu_slug']) ) {
 			$page['menu_slug'] = 'acf-options-' . sanitize_title( $page['menu_title'] );
 		}
 		
-		
+		/**
-		// filter
+		 * Filters the $page array after it has been validated.
-		$page = apply_filters('acf/validate_options_page', $page);
+		 *
-		
+		 * @since	5.5.8
-		
+		 * @param	array $page The Options Page settings array.
-		// return
+		 */
-		return $page;
+		return apply_filters( 'acf/validate_options_page', $page );
-		
 	}
 	
 	

readme.txt

@@ -2,7 +2,7 @@
 Contributors: elliotcondon
 Tags: acf, fields, custom fields, meta, repeater
 Requires at least: 4.7
-Tested up to: 5.6
+Tested up to: 5.7
 Requires PHP: 5.6
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -67,6 +67,20 @@ From your WordPress dashboard
 
 == Changelog ==
 
+= 5.9.6 =
+*Release Date - 20 May 2021*
+
+* Enhancement - Added 'position' setting compatibility for Options Page submenus.
+* Enhancement - Visually highlight "High" metabox area when dragging metaboxes.
+* Fix - Fixed compatibility issue between Block matrix alignment setting and the latest version of Gutenberg (10.6).
+* Fix - Fixed bug breaking WYSIWYG field after reordering a child block via the block's toolbar up/down buttons.
+* Fix - Added missing "readonly" and "disabled" attributes to DateTime and Time picker fields.
+* Fix - Fixed bug incorrectly validating Email field values containing special characters.
+* Fix - Fixed missing "dashicons" asset dependency from front-end forms.
+* Fix - Fixed bug causing Review JSON diff modal to appear with narrow column since WP 5.7.
+* Dev - Added label elements to Repeater, Flexible Content and Clone field's table header titles.
+* Dev - Added new `ACF_EXPERIMENTAL_ESC_HTML` constant. [Read more](https://github.com/AdvancedCustomFields/acf/issues/500)
+
 = 5.9.5 =
 *Release Date - 11 February 2021*