Fix coupon codes containing apostrophes (#40998)

* Use wp_kses_post to sanitize coupon codes

* Fix notice (php 8)

* Add changefile(s) from automation for the following project(s): woocommerce

* Add changefile(s) from automation for the following project(s): woocommerce

* Remove duplicate changelog entry

* Try alternative wp_kses function

* Account for unfiltered_html

---------

Co-authored-by: github-actions <github-actions@github.com>
Co-authored-by: Thomas Roberts <thomas.roberts@automattic.com>

plugins/woocommerce/changelog/40998-fix-coupon-title-sanitization-39481

@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Fixed coupon errors with coupon codes containing apostrophes.

plugins/woocommerce/includes/class-wc-coupon.php

@@ -81,6 +81,15 @@ class WC_Coupon extends WC_Legacy_Coupon {
 	 */
 	protected $cache_group = 'coupons';
 
+	/**
+	 * Sorting.
+	 *
+	 * Used by `get_coupons_from_cart` to sort coupons.
+	 *
+	 * @var int
+	 */
+	public $sort = 0;
+
 	/**
 	 * Coupon constructor. Loads coupon data.
 	 *

plugins/woocommerce/includes/wc-formatting-functions.php

@@ -371,15 +371,17 @@ function wc_format_coupon_code( $value ) {
 /**
  * Sanitize a coupon code.
  *
- * Uses sanitize_post_field since coupon codes are stored as
- * post_titles - the sanitization and escaping must match.
+ * Uses sanitize_post_field since coupon codes are stored as post_titles - the sanitization and escaping must match.
+ *
+ * Due to the unfiltered_html captability that some (admin) users have, we need to account for slashes.
  *
  * @since  3.6.0
  * @param  string $value Coupon code to format.
  * @return string
  */
 function wc_sanitize_coupon_code( $value ) {
-	return wp_filter_kses( sanitize_post_field( 'post_title', $value ?? '', 0, 'db' ) );
+	$value = wp_kses( sanitize_post_field( 'post_title', $value ?? '', 0, 'db' ), 'entities' );
+	return current_user_can( 'unfiltered_html' ) ? $value : stripslashes( $value );
 }
 
 /**

plugins/woocommerce/tests/php/includes/wc-formatting-functions-test.php

@@ -16,6 +16,7 @@ class WC_Formatting_Functions_Test extends \WC_Unit_Test_Case {
 	public function test_wc_sanitize_coupon_code() {
 		$this->assertEquals( 'DUMMYCOUPON', wc_sanitize_coupon_code( 'DUMMYCOUPON' ) );
 		$this->assertEquals( 'a&a', wc_sanitize_coupon_code( 'a&a' ) );
+		$this->assertEquals( "test's", wc_sanitize_coupon_code( "test's" ) );
 	}
 
 	/**