From 3a3af72e82e75f18d1404226832a241b12938912 Mon Sep 17 00:00:00 2001
From: Denis Baranov <dbaranov.work@gmail.com>
Date: Thu, 15 Mar 2018 13:28:21 +0200
Subject: [PATCH] - fixed placeholder used 'strip_tags()' for input select

---
 includes/core/class-fields.php       | 27 +++++++++++++++++++++++++++
 includes/core/um-filters-fields.php  |  2 +-
 includes/core/um-filters-members.php |  5 +++++
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/includes/core/class-fields.php b/includes/core/class-fields.php
index fa7e76ca..21abfaab 100644
--- a/includes/core/class-fields.php
+++ b/includes/core/class-fields.php
@@ -1512,6 +1512,29 @@ if ( ! class_exists( 'Fields' ) ) {
 			if (isset( $data ) && is_array( $data )) {
 				$data = $this->get_field( $key );
 				if (is_array( $data )) {
+					/**
+					 * @var string      $in_row
+					 * @var boolean     $in_sub_row
+					 * @var boolean     $in_column
+					 * @var string      $type
+					 * @var string      $metakey
+					 * @var int         $position
+					 * @var string      $title
+					 * @var string      $help
+					 * @var array       $options
+					 * @var string      $visibility
+					 * @var string      $label
+					 * @var string      $placeholder
+					 * @var boolean     $public
+					 * @var boolean     $editable
+					 * @var string      $icon
+					 * @var boolean     $in_group
+					 * @var string      $classes
+					 * @var boolean     $required
+					 * @var string      $validate
+					 * @var string      $default
+                     * @var string      $conditional
+					 */
 					extract( $data );
 				}
 			}
@@ -2377,6 +2400,10 @@ if ( ! class_exists( 'Fields' ) ) {
 
 					}
 
+					if( ! empty( $placeholder ) ) {
+					    $placeholder = strip_tags( $placeholder );
+                    }
+
 					$output .= '<select  ' . $disabled . ' ' . $select_original_option_value . ' ' . $disabled_by_parent_option . '  name="' . $form_key . '" id="' . $form_key . '" data-validate="' . $validate . '" data-key="' . $key . '" class="' . $this->get_class( $key, $data, $class ) . '" style="width: 100%" data-placeholder="' . $placeholder . '" ' . $atts_ajax . '>';
 
 					/**
diff --git a/includes/core/um-filters-fields.php b/includes/core/um-filters-fields.php
index ac1439cc..af8d0e7f 100644
--- a/includes/core/um-filters-fields.php
+++ b/includes/core/um-filters-fields.php
@@ -520,7 +520,7 @@ add_filter( 'um_profile_field_filter_hook__','um_profile_field_filter_xss_valida
 	 * @uses   hook filters: um_edit_url_field_value
 	 */
 	function um_edit_url_field_value( $value, $key ) {
-		$value = esc_attr($value);
+		$value = esc_attr( $value );
 		return $value;
 	}
 	add_filter( 'um_edit_url_field_value', 'um_edit_url_field_value', 10, 2 );
\ No newline at end of file
diff --git a/includes/core/um-filters-members.php b/includes/core/um-filters-members.php
index 75fe3218..cd10449e 100644
--- a/includes/core/um-filters-members.php
+++ b/includes/core/um-filters-members.php
@@ -439,6 +439,11 @@ if ( ! defined( 'ABSPATH' ) ) exit;
             $atts['options'] = UM()->fields()->get_options_from_callback( $atts, $atts['type'] );
         }
 
+        if( isset( $atts['label'] ) ){
+	        $atts['label'] = strip_tags( $atts['label'] );
+        }
+
+
         return $atts;
 	}