lzb/sanitize_block_control_data

Lists the control keys Lazy Blocks runs through wp_kses_post() before anything reads the block list.

A custom control that stores a text setting of its own gets no escaping until its key is on this list. The Message control in Lazy Blocks Pro adds message_text here, which is the pattern to copy.

Attributes

sanitize_block_configs() walks every control of every block and replaces $control[ $key ] with wp_kses_post( $control[ $key ] ) for each key in the list, skipping the ones that are empty. Top-level block keys are handled by the separate lzb/sanitize_block_data list.

Usage

function my_lzb_sanitize_block_control_data( $names ) {
  if ( in_array( 'notice_text', $names, true ) ) {
    return $names;
  }
 
  // Setting of a custom control, printed as markup next to the field.
  $names[] = 'notice_text';
 
  return $names;
}
 
add_filter( 'lzb/sanitize_block_control_data', 'my_lzb_sanitize_block_control_data' );

sanitize_block_configs() is attached to lzb/get_blocks at priority 100, so it runs after every other handler on that filter. The escaping reaches child controls of a Repeater as well, because the control list is flat and a nested control carries a child_of key rather than living inside its parent. Returning anything but an array raises a TypeError at the foreach that follows.

Writing a control with settings of its own is covered in Create Custom Control.