From 6ef08ea8c779b64b032ea3657be9f2009ca8a1ce Mon Sep 17 00:00:00 2001
From: Faisal Ahammad <faisalahammad24@gmail.com>
Date: Wed, 29 Apr 2026 21:03:07 +0600
Subject: [PATCH] fix: render line breaks in admin bar upgrade message

The upgrade message text contains a <br> tag which was being escaped by esc_html(), causing it to be visible as literal text. Using wp_kses() with a narrow allowlist fixes the rendering.

Fixes #1033
---
 views/admin/admin-bar-status.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/views/admin/admin-bar-status.php b/views/admin/admin-bar-status.php
index 49f858b1..06fe3592 100644
--- a/views/admin/admin-bar-status.php
+++ b/views/admin/admin-bar-status.php
@@ -39,7 +39,7 @@
 		<?php elseif ( 0 === $data['unconsumed_quota'] ) : ?>
 		<p><i class="dashicons dashicons-warning" aria-hidden="true"></i><strong><?php esc_html_e( 'Oops, It\'s Over!', 'imagify' ); ?></strong></p>
 		<?php endif; ?>
-		<p><?php echo esc_html( $data['text'] ); ?></p>
+		<p><?php echo wp_kses( $data['text'], [ 'br' => [] ] ); ?></p>
 		<p class="center txt-center text-center"><a class="imagify-upsell-admin-bar-button" href="<?php echo esc_url( $data['upgrade_link'] ); ?>" target="_blank"><?php echo esc_html( $data['button_text'] ); ?></a></p>
 		<a href="<?php echo esc_url( get_imagify_admin_url( 'dismiss-notice', 'upsell-admin-bar' ) ); ?>" class="imagify-notice-dismiss imagify-upsell-dismiss notice-dismiss" title="<?php esc_attr_e( 'Dismiss this notice', 'imagify' ); ?>"><span class="screen-reader-text"><?php esc_html_e( 'Dismiss this notice', 'imagify' ); ?></span></a>
 	</div>