GoDAM Record player is mangled on form-plugin entry-details pages

[KMchaudhary]

GoDAM Record player is mangled on form-plugin entry-details pages (WPForms & Everest Forms)

Summary

When a form contains a GoDAM Record field, the recorded video/audio player is broken on the admin entry-details page. Instead of a working player, the page renders the player's markup/CSS as raw text. This affects both the WPForms and Everest Forms integrations, with slightly different symptoms driven by how each plugin sanitizes field output.

Affected areas

• WPForms entry view — wp-admin/admin.php?page=wpforms-entries&view=details&entry_id=<id>
• Everest Forms single-entry view — wp-admin/admin.php?page=evf-entries&form_id=<id>&view-entry=<id>

Steps to reproduce

1. Create a form (WPForms or Everest Forms) with a GoDAM Record field.
2. Submit an entry that includes a recorded video or audio file.
3. Open that entry on the admin entry-details page.
4. Observe the GoDAM Record field.

Expected

The GoDAM video/audio player renders and is playable in the field's value area.

Actual

WPForms: The player renders, but a block of raw CSS text appears above it (the <style id="godam-player-wrapper-inline-css">…</style> tag is stripped while its CSS content leaks onto the page as a string).

Everest Forms: The entire player is shown as an escaped HTML string — <style>, <div>, <a>, <span>, <strong>, player markup, etc. all displayed as literal text instead of rendering.

Root cause

The GoDAM Record entry view renders the player via the [godam_video] shortcode (inc/templates/godam-player.php), which emits its wrapper styles as an inline <style id="godam-player-wrapper-inline-css"> block. Each form plugin sanitizes the field value before output on the entry-details page:

• WPForms passes the field value through wp_kses_post() (print_field_value() in class-entries-single.php). <style> is not in the post allowlist, so the tag is stripped but its inner CSS text is preserved → CSS leaks as a string. GoDAM's existing wp_kses_allowed_html filter (update_allowed_html_on_view) whitelisted source/svg/path but was missing style.
• Everest Forms (recent versions with the "Escaping and sanitization" hardening, ~3.4.0+) routes each field value by field type: wp_kses_post() for types in the everest_forms_entry_view_field_types_allowing_html filter, make_clickable() for file/media types, else esc_html(). godam_record matched none of these and fell through to esc_html(), which escapes the whole player markup.

Environment

• GoDAM plugin (WPForms + Everest Forms integrations)
• WPForms Pro (entry details)
• Everest Forms ~3.4.0+ (escaping/sanitization change) — older EVF versions echo the value unescaped and are not affected
• Reproduced against real recorded entries; both video and audio recordings affected

Proposed fix

• WPForms: add style to the tag whitelist in update_allowed_html_on_view (class-wpforms-field-godam-video.php).
• Everest Forms: hook everest_forms_entry_view_field_types_allowing_html to register godam_record (routes it to wp_kses_post() instead of esc_html()), and add a scoped wp_kses_allowed_html filter whitelisting style/source/svg/path, detached after the view renders (class-everest-forms-field-godam-video.php).

Both are pure PHP changes (no asset rebuild). wp_kses_post's post context already allows <div>/<a>/<video>/<audio> and preserves the player's data-* attributes, so whitelisting style/source (+svg/path for the play-button icon) is sufficient for the player to render and initialize.