Improve legend tag rendering in forms

The legend html was not escaped and was ignoring block settings coming
from the form editor.
This commit adds a new helper function for rendering legend that respects
applies block settings and also escapes the output.
[MAILPOET-4471]

mailpoet/lib/Form/Block/BlockRendererHelper.php

@@ -153,6 +153,37 @@ class BlockRendererHelper {
     return $html;
   }
 
+  public function renderLegend(array $block, array $formSettings): string {
+    $html = '';
+
+    if (
+      isset($block['params']['hide_label'])
+      && $block['params']['hide_label']
+    ) {
+      return $html;
+    }
+
+    if (
+      isset($block['params']['label'])
+      && strlen(trim($block['params']['label'])) > 0
+    ) {
+      // Use _label suffix for backward compatibility
+      $labelClass = 'class="mailpoet_' . $block['type'] . '_label" ';
+      $html .= '<legend '
+        . $labelClass
+        . $this->renderFontStyle($formSettings, $block['styles'] ?? [])
+        . '>';
+      $html .= htmlspecialchars($block['params']['label']);
+
+      if (isset($block['params']['required']) && $block['params']['required']) {
+        $html .= ' <span class="mailpoet_required">*</span>';
+      }
+
+      $html .= '</legend>';
+    }
+    return $html;
+  }
+
   public function renderFontStyle(array $formSettings, array $styles = []) {
     $rules = [];
     if (isset($formSettings['fontSize'])) {

mailpoet/lib/Form/Block/Checkbox.php

@@ -33,7 +33,7 @@ class Checkbox {
     $fieldValidation = $this->rendererHelper->getInputValidation($block, [], $formId);
 
     $html .= '<fieldset>';
-    $html .= '<legend>' . $block['params']['label'] . '</legend>';
+    $html .= $this->rendererHelper->renderLegend($block, $formSettings);
 
     $options = (!empty($block['params']['values'])
       ? $block['params']['values']

mailpoet/lib/Form/Block/Radio.php

@@ -33,7 +33,7 @@ class Radio {
     $fieldValidation = $this->rendererHelper->getInputValidation($block, [], $formId);
 
     $html .= '<fieldset>';
-    $html .= '<legend>' . $block['params']['label'] . '</legend>';
+    $html .= $this->rendererHelper->renderLegend($block, $formSettings);
 
     $options = (!empty($block['params']['values'])
       ? $block['params']['values']

mailpoet/lib/Form/Block/Segment.php

@@ -40,8 +40,7 @@ class Segment {
 
     // Add fieldset around the checkboxes
     $html .= '<fieldset>';
-
+    $html .= $this->rendererHelper->renderLegend($block, $formSettings);
-    $html .= '<legend>' . $block['params']['label'] . '</legend>';
 
     $options = (!empty($block['params']['values'])
       ? $block['params']['values']

mailpoet/tests/unit/Form/Block/BlockRendererHelperTest.php

@@ -60,6 +60,25 @@ class BlockRendererHelperTest extends \MailPoetUnitTest {
     expect($label)->equals('');
   }
 
+  public function testItShouldRenderLegend() {
+    $block = $this->block;
+    $label = $this->rendererHelper->renderLegend($block, []);
+    expect($label)->regExp('#<legend.*class="mailpoet_text_label".*>Input label</legend>#m');
+
+    $block['styles'] = ['bold' => '1'];
+    $label = $this->rendererHelper->renderLegend($block, []);
+    expect($label)->equals('<legend class="mailpoet_text_label" style="font-weight: bold;">Input label</legend>');
+
+    $block['params']['required'] = '1';
+    $block['styles'] = [];
+    $label = $this->rendererHelper->renderLegend($block, []);
+    expect($label)->equals('<legend class="mailpoet_text_label" >Input label <span class="mailpoet_required">*</span></legend>');
+
+    $block['params']['hide_label'] = '1';
+    $label = $this->rendererHelper->renderLegend($block, []);
+    expect($label)->equals('');
+  }
+
   public function testItShouldRenderPlaceholder() {
     $block = $this->block;
     $placeholder = $this->rendererHelper->renderInputPlaceholder($block);