Updates to 6.2.9

acf.php

@@ -9,7 +9,7 @@
  * Plugin Name:       Advanced Custom Fields PRO
  * Plugin URI:        https://www.advancedcustomfields.com
  * Description:       Customize WordPress with powerful, professional and intuitive fields.
- * Version:           6.2.8
+ * Version:           6.2.9
  * Author:            WP Engine
  * Author URI:        https://wpengine.com/?utm_source=wordpress.org&utm_medium=referral&utm_campaign=plugin_directory&utm_content=advanced_custom_fields
  * Update URI:        https://www.advancedcustomfields.com/pro
@@ -36,7 +36,7 @@ if ( ! class_exists( 'ACF' ) ) {
 		 *
 		 * @var string
 		 */
-		public $version = '6.2.8';
+		public $version = '6.2.9';
 
 		/**
 		 * The plugin settings array.

assets/build/js/acf-field-group.js

@@ -1425,7 +1425,7 @@ function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t =
       }
     },
     onChangeName: function (e, $el) {
-      const sanitizedName = acf.strSanitize($el.val());
+      const sanitizedName = acf.strSanitize($el.val(), false);
       $el.val(sanitizedName);
       this.set('name', sanitizedName);
       if (sanitizedName.startsWith('field_')) {

assets/build/js/acf-input.js

@@ -8041,6 +8041,7 @@
       ajaxResults: function (json) {
         return json;
       },
+      escapeMarkup: false,
       templateSelection: false,
       templateResult: false,
       dropdownCssClass: '',
@@ -8301,20 +8302,12 @@
         allowClear: this.get('allowNull'),
         placeholder: this.get('placeholder'),
         multiple: this.get('multiple'),
+        escapeMarkup: this.get('escapeMarkup'),
         templateSelection: this.get('templateSelection'),
         templateResult: this.get('templateResult'),
         dropdownCssClass: this.get('dropdownCssClass'),
         suppressFilters: this.get('suppressFilters'),
-        data: [],
-        escapeMarkup: function (markup) {
-          if (typeof markup !== 'string') {
-            return markup;
-          }
-          if (this.suppressFilters) {
-            return acf.strEscape(markup);
-          }
-          return acf.applyFilters('select2_escape_markup', acf.strEscape(markup), markup, $select, this.data, field || false, this);
-        }
+        data: []
       };
 
       // Clear empty templateSelections, templateResults, or dropdownCssClass.
@@ -8343,6 +8336,19 @@
         delete options.templateResult;
       }
 
+      // Use a default, filterable escapeMarkup if not provided.
+      if (!options.escapeMarkup) {
+        options.escapeMarkup = function (markup) {
+          if (typeof markup !== 'string') {
+            return markup;
+          }
+          if (this.suppressFilters) {
+            return acf.strEscape(markup);
+          }
+          return acf.applyFilters('select2_escape_markup', acf.strEscape(markup), markup, $select, this.data, field || false, this);
+        };
+      }
+
       // multiple
       if (options.multiple) {
         // reorder options

assets/build/js/acf.js

@@ -2093,7 +2093,7 @@
   acf.strSlugify = function (str) {
     return acf.strReplace('_', '-', str.toLowerCase());
   };
-  acf.strSanitize = function (str) {
+  acf.strSanitize = function (str, toLowerCase = true) {
     // chars (https://jsperf.com/replace-foreign-characters)
     var map = {
       À: 'A',
@@ -2338,7 +2338,9 @@
     str = str.replace(nonWord, mapping);
 
     // lowercase
-    str = str.toLowerCase();
+    if (toLowerCase) {
+      str = str.toLowerCase();
+    }
 
     // return
     return str;

includes/admin/post-types/admin-field-group.php

@@ -353,11 +353,12 @@ if ( ! class_exists( 'acf_admin_field_group' ) ) :
 			}
 
 			$_POST['acf_field_group']['ID'] = $post_id;
-			// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized when saved.
-			$_POST['acf_field_group']['title'] = acf_maybe_get_POST( 'post_title', '' );
+			// phpcs:disable WordPress.Security.ValidatedSanitizedInput
+			$_POST['acf_field_group']['title'] = isset( $_POST['post_title'] ) ? $_POST['post_title'] : ''; // Post title is stored unsafe like WordPress, escaped on output.
 
 			// save field group.
-			acf_update_field_group( $_POST['acf_field_group'] ); //phpcs:ignore WordPress.Security.ValidatedSanitizedInput
+			acf_update_field_group( $_POST['acf_field_group'] );
+			// phpcs:enable WordPress.Security.ValidatedSanitizedInput
 			// phpcs:enable WordPress.Security.NonceVerification.Missing
 
 			return $post_id;

includes/forms/form-post.php

@@ -191,10 +191,13 @@ if ( ! class_exists( 'ACF_Form_Post' ) ) :
 			// render 'acf_after_title' metaboxes
 			do_meta_boxes( get_current_screen(), 'acf_after_title', $post );
 
-			if ( ! empty( $this->style ) ) {
-				// render dynamic field group style, using wp_strip_all_tags as this is filterable, but should only contain valid styles and no html.
-				echo '<style type="text/css" id="acf-style">' . wp_strip_all_tags( $this->style ) . '</style>'; //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CSS only, escaped by wp_strip_all_tags.
+			$style = '';
+			if ( is_string( $this->style ) ) {
+				$style = $this->style;
 			}
+
+			// Render dynamic field group style, using wp_strip_all_tags as this is filterable, but should only contain valid styles and no html.
+			echo '<style type="text/css" id="acf-style">' . wp_strip_all_tags( $style ) . '</style>'; //phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CSS only, escaped by wp_strip_all_tags.
 		}
 
 		/**

lang/acf-ar.po

@@ -12,7 +12,7 @@
 # This file is distributed under the same license as Advanced Custom Fields.
 msgid ""
 msgstr ""
-"PO-Revision-Date: 2024-03-29T21:10:52+00:00\n"
+"PO-Revision-Date: 2024-04-08T08:54:42+00:00\n"
 "Report-Msgid-Bugs-To: http://support.advancedcustomfields.com\n"
 "Language: ar\n"
 "MIME-Version: 1.0\n"

lang/acf-bg_BG.po

@@ -12,7 +12,7 @@
 # This file is distributed under the same license as Advanced Custom Fields.
 msgid ""
 msgstr ""
-"PO-Revision-Date: 2024-03-29T21:10:52+00:00\n"
+"PO-Revision-Date: 2024-04-08T08:54:42+00:00\n"
 "Report-Msgid-Bugs-To: http://support.advancedcustomfields.com\n"
 "Language: bg_BG\n"
 "MIME-Version: 1.0\n"

lang/acf-de_CH.po

@@ -12,7 +12,7 @@
 # This file is distributed under the same license as Advanced Custom Fields.
 msgid ""
 msgstr ""
-"PO-Revision-Date: 2024-03-29T21:10:52+00:00\n"
+"PO-Revision-Date: 2024-04-08T08:54:42+00:00\n"
 "Report-Msgid-Bugs-To: http://support.advancedcustomfields.com\n"
 "Language: de_CH\n"
 "MIME-Version: 1.0\n"

lang/acf-he_IL.po

@@ -12,7 +12,7 @@
 # This file is distributed under the same license as Advanced Custom Fields.
 msgid ""
 msgstr ""
-"PO-Revision-Date: 2024-03-29T21:10:52+00:00\n"
+"PO-Revision-Date: 2024-04-08T08:54:42+00:00\n"
 "Report-Msgid-Bugs-To: http://support.advancedcustomfields.com\n"
 "Language: he_IL\n"
 "MIME-Version: 1.0\n"

lang/acf-hu_HU.po

@@ -12,7 +12,7 @@
 # This file is distributed under the same license as Advanced Custom Fields.
 msgid ""
 msgstr ""
-"PO-Revision-Date: 2024-03-29T21:10:52+00:00\n"
+"PO-Revision-Date: 2024-04-08T08:54:42+00:00\n"
 "Report-Msgid-Bugs-To: http://support.advancedcustomfields.com\n"
 "Language: hu_HU\n"
 "MIME-Version: 1.0\n"

lang/acf-id_ID.po

@@ -12,7 +12,7 @@
 # This file is distributed under the same license as Advanced Custom Fields.
 msgid ""
 msgstr ""
-"PO-Revision-Date: 2024-03-29T21:10:52+00:00\n"
+"PO-Revision-Date: 2024-04-08T08:54:42+00:00\n"
 "Report-Msgid-Bugs-To: http://support.advancedcustomfields.com\n"
 "Language: id_ID\n"
 "MIME-Version: 1.0\n"