The Popup Maker upgrade notice form to process changes does not render completely so it doesn't work

[marklchaves]

Describe the bug

The Popup Maker upgrade notice form to Process Changes does not render completely (button missing).

On a multisite network in the admin notices section, the form tag and input fields are stripped out.

Form tag code: https://github.com/PopupMaker/Popup-Maker/blob/b3d7ae274b2f8b628cf656a886a2befd644487d3/classes/Utils/Upgrades.php#L385

On the Popup Maker Tool page (Upgrades tab), the form tag is stripped out, but the Process Changes button shows. Unfortunately, the Process Changes button doesn't work because its wrapping form tag is gone. The page just reloads when you click it and the same upgrade notification displays again in the admin section and the Tools > Upgrades tab.

See screen captures below.

Site information

Popup Maker version: 1.7.25 and 1.17.1

See the site info dump below for more.

wp-core

version: 6.1.1 site_language: en_US user_language: en_US timezone: +00:00 permalink: /blog/%year%/%monthnum%/%day%/%postname%/ https_status: false multisite: true user_registration: false blog_public: 1 default_comment_status: open environment_type: local site_count: 2 network_count: 1 user_count: 1 dotorg_communication: true

wp-dropins (1)

db.php: true

wp-active-theme

name: Twenty Twenty-Three (twentytwentythree) version: 1.0 author: the WordPress team author_website: https://wordpress.org parent_theme: none theme_features: core-block-patterns, post-thumbnails, responsive-embeds, editor-styles, html5, automatic-feed-links, block-templates, widgets-block-editor, editor-style theme_path: /Users/markchaves/Local Sites/multisite/app/public/wp-content/themes/twentytwentythree auto_update: Disabled

wp-themes-inactive (2)

Twenty Twenty-One: version: 1.7, author: the WordPress team, Auto-updates disabled Twenty Twenty-Two: version: 1.3, author: the WordPress team, Auto-updates disabled

wp-plugins-active (3)

Code Snippets: version: 3.2.2, author: Code Snippets Pro, Auto-updates disabled Popup Maker: version: 1.17.1, author: Popup Maker, Auto-updates disabled Query Monitor: version: 3.11.1, author: John Blackbourn, Auto-updates disabled

wp-media

image_editor: WP_Image_Editor_Imagick imagick_module_version: 1691 imagemagick_version: ImageMagick 6.9.11-35 Q16 x86_64 2020-11-13 https://imagemagick.org imagick_version: 3.4.4 file_uploads: File uploads is turned off post_max_size: 1000M upload_max_filesize: 300M max_effective_size: 300 MB max_file_uploads: 20 imagick_limits: imagick::RESOURCETYPE_AREA: 32 GB imagick::RESOURCETYPE_DISK: 9.2233720368548E+18 imagick::RESOURCETYPE_FILE: 6144 imagick::RESOURCETYPE_MAP: 32 GB imagick::RESOURCETYPE_MEMORY: 16 GB imagick::RESOURCETYPE_THREAD: 1 imagemagick_file_formats: 3FR, 3G2, 3GP, AAI, AI, APNG, ART, ARW, AVI, AVS, BGR, BGRA, BGRO, BMP, BMP2, BMP3, BRF, CAL, CALS, CANVAS, CAPTION, CIN, CIP, CLIP, CMYK, CMYKA, CR2, CR3, CRW, CUR, CUT, DATA, DCM, DCR, DCX, DDS, DFONT, DNG, DOT, DPX, DXT1, DXT5, EPDF, EPI, EPS, EPS2, EPS3, EPSF, EPSI, EPT, EPT2, EPT3, ERF, FAX, FILE, FITS, FRACTAL, FTP, FTS, G3, G4, GIF, GIF87, GRADIENT, GRAY, GRAYA, GROUP4, GV, H, HALD, HDR, HISTOGRAM, HRZ, HTM, HTML, HTTP, HTTPS, ICB, ICO, ICON, IIQ, INFO, INLINE, IPL, ISOBRL, ISOBRL6, J2C, J2K, JNG, JNX, JP2, JPC, JPE, JPEG, JPG, JPM, JPS, JPT, JSON, K25, KDC, LABEL, M2V, M4V, MAC, MAGICK, MAP, MASK, MAT, MATTE, MEF, MIFF, MKV, MNG, MONO, MOV, MP4, MPC, MPG, MRW, MSL, MSVG, MTV, MVG, NEF, NRW, NULL, ORF, OTB, OTF, PAL, PALM, PAM, PANGO, PATTERN, PBM, PCD, PCDS, PCL, PCT, PCX, PDB, PDF, PDFA, PEF, PES, PFA, PFB, PFM, PGM, PGX, PICON, PICT, PIX, PJPEG, PLASMA, PNG, PNG00, PNG24, PNG32, PNG48, PNG64, PNG8, PNM, POCKETMOD, PPM, PREVIEW, PS, PS2, PS3, PSB, PSD, PTIF, PWP, RADIAL-GRADIENT, RAF, RAS, RAW, RGB, RGBA, RGBO, RGF, RLA, RLE, RMF, RW2, SCR, SCT, SFW, SGI, SHTML, SIX, SIXEL, SPARSE-COLOR, SR2, SRF, STEGANO, SUN, SVG, SVGZ, TEXT, TGA, THUMBNAIL, TIFF, TIFF64, TILE, TIM, TTC, TTF, TXT, UBRL, UBRL6, UIL, UYVY, VDA, VICAR, VID, VIDEO, VIFF, VIPS, VST, WBMP, WEBM, WEBP, WMV, WPG, X3F, XBM, XC, XCF, XPM, XPS, XV, YCbCr, YCbCrA, YUV gd_version: bundled (2.1.0 compatible) gd_formats: GIF, JPEG, PNG, BMP ghostscript_version: not available

wp-server

server_architecture: Darwin 20.6.0 x86_64 httpd_software: Apache/2.4.43 (Unix) php_version: 7.4.1 64bit php_sapi: fpm-fcgi max_input_variables: 4000 time_limit: 1200 memory_limit: 256M max_input_time: 600 upload_max_filesize: 300M php_post_max_size: 1000M curl_version: 7.54.0 LibreSSL/2.6.5 suhosin: false imagick_availability: true pretty_permalinks: true htaccess_extra_rules: false

wp-database

extension: mysqli server_version: 8.0.16 client_version: mysqlnd 7.4.1 max_allowed_packet: 16777216 max_connections: 151

wp-constants

WP_HOME: undefined WP_SITEURL: undefined WP_CONTENT_DIR: /Users/markchaves/Local Sites/multisite/app/public/wp-content WP_PLUGIN_DIR: /Users/markchaves/Local Sites/multisite/app/public/wp-content/plugins WP_MEMORY_LIMIT: 64M WP_MAX_MEMORY_LIMIT: 256M WP_DEBUG: false WP_DEBUG_DISPLAY: true WP_DEBUG_LOG: false SCRIPT_DEBUG: false WP_CACHE: false CONCATENATE_SCRIPTS: undefined COMPRESS_SCRIPTS: undefined COMPRESS_CSS: undefined WP_ENVIRONMENT_TYPE: local DB_CHARSET: utf8 DB_COLLATE: undefined

wp-filesystem

wordpress: writable wp-content: writable uploads: writable plugins: writable themes: writable

Expected behavior

1. In the admin notice, the Process Changes button should appear and submit the form successfully.
2. In the Upgrades tab, the button should submit the form successfully.

Current behavior

After upgrading from Popup Maker 1.7.25 to 1.17.1 on a multisite network, on the Popup Maker Tool page (Upgrades tab), the form tag is stripped out, but the Process Changes button shows. Unfortunately, the Process Changes button doesn't work because its wrapping form tag is gone. The page just reloads when you click it and the same upgrade notification displays again in the admin section and the Tools > Upgrades tab.

Steps to reproduce

1. Create a WordPress multisite.
2. Install Popup Maker 1.7.25.
3. Changes some Popup Maker settings. I turned on Enable Debug Mode, turned off Disable categories & tags?, and turned on Don't Load Google Fonts.
4. Create a popup and test that it works.
5. Upgrade Popup Maker to 1.17.1.
6. View the admin notification on any admin page on your subsite or main site.
7. View the Popup Maker Tools > Upgrades tab on your subsite.

Errors

None.

Additional notes

I think I've narrowed the problem down to Popup Maker. I created a custom admin notice with a form that has an input field and submit button. My custom admin notice displays the form fine (form and input tag are there) while the Popup Maker admin notices does not display the same form (screen capture below).

Also, I think if the process changes form does render in the Upgrades tab, it'll be nested in the pum-tools form. That might be a problem too. See the screen capture below.

Screen captures

[danieliser]

@marklchaves is the assessment that we over escaped that output in recent updates?

[marklchaves]

Hey @danieliser ,

That'd be my first guess.

I just tested our theory with 1.16.4 to answer your question. I picked 1.16.4 because it looked like the last version before the security patches from late last year (2022).

The Process Changes button shows up and seems to work for 1.16.4. See the screen captures.

I hope this narrows it down more 😌

[danieliser]

Sweet, will fix that shortly.

[danieliser]

This should be resolved in develop branch.