chore: minor defensive coding improvements

Author: dannyvankooten

src/admin/class-admin.php

@@ -539,6 +539,7 @@ public function save_box_options($box_id, $post)
      */
     public function sanitize_settings($opts)
     {
+        $opts['test_mode'] = (int) $opts['test_mode'] ? 1 : 0;
         return $opts;
     }
 

src/admin/class-notices.php

@@ -14,7 +14,7 @@ class Notices
      */
     public function __construct()
     {
-        add_action('admin_notices', [ $this, 'show' ]);
+        add_action('admin_notices', [ $this, 'action_admin_notices' ], 10, 0);
     }
 
     /**
@@ -36,10 +36,11 @@ public function add($message, $type = 'updated')
     /**
      * Output the registered notices
      */
-    public function show()
+    public function admin_notices(): void
     {
+        $allowed_html = [ 'strong' => [], 'em' => [], 'a' => [ 'href' => [] ] ];
         foreach ($this->notices as $notice) {
-            echo "<div class=\"notice notice-{$notice['type']}\"><p>{$notice['message']}</p></div>";
+            echo "<div class=\"notice notice-", esc_attr($notice['type']), "><p>", wp_kses($notice['message'], $allowed_html), "</p></div>";
         }
     }
 }

src/licensing/views/license-form.php

@@ -36,7 +36,7 @@
 
 <?php foreach ($notices as $notice) { ?>
 <div class="notice notice-<?php echo esc_attr($notice['type']); ?> inline">
-    <p><?php echo $notice['message']; ?></p>
+    <p><?php echo wp_kses($notice['message'], ['strong' => [], 'em' => [], 'a' => ['href' => []]]); ?></p>
 </div>
 <?php } ?>