[girishpanchal30]

Summary

Fixed double-escaped HTML attributes in Elementor and Beaver Builder integrations by using Elementor’s print_render_attribute_string() to output already-escaped attribute strings correctly and wp_kses_post() for editor notice previews. Updated the Beaver submit fieldset and placeholder attributes to print each value once within properly quoted attributes, and removed the stray quote after the Beaver text input. Also corrected additional affected paths beyond those identified in the issue while preserving PHPCS compliance.

Check before Pull Request is ready:

• I have written a test and included it in this PR
• I have run all tests and they pass
• The code passes when running the PHP CodeSniffer
• Code meets WordPress Coding Standards for PHP, HTML, CSS and JS
• Security and Sanitization requirements have been followed
• I have assigned a reviewer or two to review this PR

Closes #993

[pirate-bot]

Plugin build for c7e2314 is ready 🛎️!

• Download build

[pirate-bot]

🟡 Changes requested

The escaping fix works, but two changed outputs have no test: the Elementor submit icon span and the Beaver address placeholder.

Validation details

• Files reviewed: 6/6 changed files.
• The new tests pass at HEAD on PHP 8.3 with PHPUnit 9.6: cd /repo; cat /workspace/checks/R1/bin/phpunit; /workspace/checks/R1/bin/phpunit --do-not-cache-result --filter 'Test_Co… printed OK (5 tests, 11 assertions) (run R7)
• All five tests fail on the pr-base code, so each one detects the change: set -o pipefail; B=/workspace/checks/R1/base-tree; rm -rf $B; mkdir -p $B; git -C /repo archive 768260b | tar -x -C $B &… printed Tests: 5, Assertions: 5, Failures: 5. (run R8)
• The full suite shows the same four existing svg-uploads errors before and after the change. Those errors come from missing Composer packages.
• No esc_attr() call around get_render_attribute_string() remains in obfx_modules.
• The security check found every changed output escaped once.

Untested areas

• PHPCS was not run. CI runs the linter.
• The sandbox had no Composer packages. A prepend loaded form_manager.php for the tests. CI loads it through vendor/autoload.php.
• Question for the author: CONTRIBUTING.md asks for tests under tests/php/unit, which does not exist. Should that document change?

🤖 Automated review · run code-review-agent_6adf42946343b4.10000057.

---

🤖 Review agent — review posted ✅ on 768260b2 · changes requested · 2 findings · 17 min

Run code-review-agent_6adf42946343b4.10000057 · trail

[pirate-bot]

🟢 Approved

The PR passes. The two new tests cover the submit icon span and the address placeholders, and both fail on the old code.

Validation details

• Files reviewed: 6/6 changed files. Since the last review, only the test file and two test stubs changed.
• The test class passes at HEAD on PHP 8.3 with PHPUnit 9.6: cd /repo && export WP_TESTS_DIR=/var/www/html/.wp-tests/tests/phpunit; set -o pipefail; timeout 300 /workspace/checks/R1… printed OK (7 tests, 15 assertions) (run R2)
• All seven tests fail when the three changed source files come from pr-base: set -e; B=/workspace/checks/R1/base-tree; rm -rf $B; mkdir -p $B; git -C /repo archive c7e23148c03167b81ef61d6a528e1bcc1… printed Tests: 7, Assertions: 7, Failures: 7. (run R3)
• The source and security checks from run code-review-agent_6adf42946343b4.10000057 still apply. No source file changed since then. They were not rerun.

Untested areas

• PHPCS was not run. CI runs the linter.
• The sandbox had no Composer packages. A prepend loaded form_manager.php for the tests.
• No browser rendered a real Elementor or Beaver Builder page.

🤖 Automated review · run code-review-agent_6adf497d2fb1c7.11857478.

---

🤖 Review agent — review posted ✅ on c7e23148 · approved · 0 findings · 4 min

Run code-review-agent_6adf497d2fb1c7.11857478 · trail