ACF js filter `esc_html_dompurify_config` not working

[znikap]

Describe the bug
Trying to use the new filter introduced in 6.4.3 esc_html_dompurify_config to not escape some html tags in the group label.

To Reproduce
Steps to reproduce the behavior:

1. Go to Editor (with a block or field with group label)
2. Monitor the console.
3. No console for the filter.

Expected behavior
acf filter 'esc_html_dompurify_config' to function.

Code
Tried with:

import domReady from '@wordpress/dom-ready';

domReady(() => {
 if (typeof acf !== 'undefined') {
    acf.add_filter(
      'esc_html_dompurify_config',
      function (config) {
        console.log('Sis');
        return config;
      }
    );
  }
});

and with:

acf.addFilter('esc_html_dompurify_config', function(config) {
 console.log('Bro');
  return config;
});

Important

The script is enqueued and other filters work.

Version Information:

• WordPress 6.8.2
• PHP Version 8.2
• ACF Version 6.4.3
• Browser doesn't matter

Any help will be apreciated 👉👈

[lgladdy]

Hey there,

DOMPurify is used in JS contexts for escaping. This is things like select2 population, or when you're in the ACF field editor admin pages changing the name or label of a field.

For all other places, PHP escaping happens. We use esc_html for this, which has its own WP filter, but we also have our own filters specific to the thing being output.

Field Labels are run through the acf/get_field_label filter, so something like this could be used to wrap a field group label in a <strong> tag:

<?php
/**
 * Wrap specific field labels in <strong> tags.
 *
 * @param string $label   The field label HTML.
 * @param array  $field   The field array.
 * @param string $context The output context (admin).
 * @return string The modified label HTML.
 */
function my_custom_field_label_formatting( $label, $field, $context ) {
    // Define fields that should have bold labels
    $bold_fields = array(
        'field_name_one',
        'field_name_two'
    );
    
    // Check if current field name is in our array
    if ( in_array( $field['name'], $bold_fields, true ) ) {
        $label = '<strong>' . $label . '</strong>';
    }
    
    return $label;
}
add_filter( 'acf/get_field_label', 'my_custom_field_label_formatting', 10, 3 );

If you're talking about actual WordPress metabox titles which use the Field Group Title, which looks something like this:

Unfortunately this isn't filterable, due to the way different ways meta boxes get created between the block editor and the classic editor, or sometimes by JavaScript if you're showing a field group conditionally.

If you really wanted to try and do something with metabox titles, we do fire the acf/add_meta_boxes action after we've added our initial meta boxes. You could use that to access the global $wp_meta_boxes variable and modify titles in there, but we wouldn't recommend that. Alternatively, you could use the global esc_html filter, but again we'd urge caution here, given the security risks you could open up.