From 06f8d843c17f2880a1f1ad2bf35902a937458e1b Mon Sep 17 00:00:00 2001
From: Mykyta Synelnikov <nsinelnikov.work@gmail.com>
Date: Mon, 12 Jun 2023 15:34:04 +0300
Subject: [PATCH] - fixed #1197;

---
 includes/admin/core/class-admin-dragdrop.php | 28 +++++++++++---------
 includes/core/class-fields.php               | 15 +++++------
 2 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/includes/admin/core/class-admin-dragdrop.php b/includes/admin/core/class-admin-dragdrop.php
index 18504e58..b135b91c 100644
--- a/includes/admin/core/class-admin-dragdrop.php
+++ b/includes/admin/core/class-admin-dragdrop.php
@@ -1,30 +1,37 @@
 <?php
 namespace um\admin\core;
 
-
-if ( ! defined( 'ABSPATH' ) ) exit;
-
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
 
 if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
 
-
 	/**
 	 * Class Admin_DragDrop
 	 * @package um\admin\core
 	 */
 	class Admin_DragDrop {
 
+		/**
+		 * @var array
+		 */
+		public $row_data = array();
+
+		/**
+		 * @var array
+		 */
+		public $exist_rows = array();
 
 		/**
 		 * Admin_DragDrop constructor.
 		 */
-		function __construct() {
+		public function __construct() {
 			add_action( 'admin_footer', array( &$this, 'load_field_order' ), 9 );
 		}
 
-
 		/**
-		 * Update order of fields
+		 * Update order of fields.
 		 */
 		public function update_order() {
 			UM()->admin()->check_ajax_nonce();
@@ -153,12 +160,10 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
 			update_option( 'um_form_rowdata_' . $form_id, $this->row_data );
 
 			UM()->query()->update_attr( 'custom_fields', $form_id, $fields );
-
 		}
 
-
 		/**
-		 * Load form to maintain form order
+		 * Load form to maintain form order.
 		 */
 		public function load_field_order() {
 
@@ -233,7 +238,7 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
 
 				<input type="hidden" name="form_id" id="form_id" value="<?php echo esc_attr( get_the_ID() ); ?>" />
 				<input type="hidden" name="action" value="um_update_order" />
-				<input type="hidden" name="nonce" value="<?php echo esc_attr( wp_create_nonce( 'um-admin-nonce' ) ) ?>" />
+				<input type="hidden" name="nonce" value="<?php echo esc_attr( wp_create_nonce( 'um-admin-nonce' ) ); ?>" />
 
 				<div class="um_update_order_fields">
 
@@ -244,6 +249,5 @@ if ( ! class_exists( 'um\admin\core\Admin_DragDrop' ) ) {
 			<?php
 
 		}
-
 	}
 }
diff --git a/includes/core/class-fields.php b/includes/core/class-fields.php
index 85d454f1..62f56a42 100644
--- a/includes/core/class-fields.php
+++ b/includes/core/class-fields.php
@@ -1,13 +1,12 @@
 <?php
 namespace um\core;
 
-
-if ( ! defined( 'ABSPATH' ) ) exit;
-
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
 
 if ( ! class_exists( 'um\core\Fields' ) ) {
 
-
 	/**
 	 * Class Fields
 	 * @package um\core
@@ -3886,9 +3885,10 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
 
 						$um_field_checkbox_item_title = $v;
 
-						$v = $this->filter_field_non_utf8_value( $v );
+						$v          = $this->filter_field_non_utf8_value( $v );
+						$value_attr = ( ! empty( $v ) && is_string( $v ) ) ? wp_strip_all_tags( $v ) : $v;
 
-						$output .= '<input  ' . $disabled . ' type="checkbox" name="' . esc_attr( $key ) . '[]" value="' . strip_tags( $v ) . '" ';
+						$output .= '<input  ' . $disabled . ' type="checkbox" name="' . esc_attr( $key ) . '[]" value="' . esc_attr( $value_attr ) . '" ';
 
 						if ( $this->is_selected( $key, $v, $data ) ) {
 							$output .= 'checked';
@@ -3897,10 +3897,9 @@ if ( ! class_exists( 'um\core\Fields' ) ) {
 						$output .= ' />';
 
 						if ( ! empty( $disabled ) && $this->is_selected( $key, $v, $data ) ) {
-							$output .= $this->disabled_hidden_field( $key . '[]', strip_tags( $v ) );
+							$output .= $this->disabled_hidden_field( $key . '[]', $value_attr );
 						}
 
-
 						$output .= '<span class="um-field-checkbox-state"><i class="' . esc_attr( $class ) . '"></i></span>';
 						/**
 						 * UM hook