Handle sanitization as early as possible per best practices

Per WP security best practices, sanitization should be handled as early
as possible. So this commit move updates the calls to sanitize the
segment name and description to the part of the code where the user
input is first processed, instead of when the data is saved to the
database.

[MAILPOET-5232]

mailpoet/lib/API/JSON/v1/DynamicSegments.php

@@ -105,6 +105,8 @@ class DynamicSegments extends APIEndpoint {
 
   public function save($data) {
     try {
+      $data['name'] = isset($data['name']) ? sanitize_text_field($data['name']) : '';
+      $data['description'] = isset($data['description']) ? sanitize_textarea_field($data['description']) : '';
       $segment = $this->saveController->save($data);
       return $this->successResponse($this->segmentsResponseBuilder->build($segment));
     } catch (InvalidFilterException $e) {

mailpoet/lib/API/JSON/v1/ImportExport.php

@@ -108,6 +108,8 @@ class ImportExport extends APIEndpoint {
 
   public function addSegment($data) {
     try {
+      $data['name'] = isset($data['name']) ? sanitize_text_field($data['name']) : '';
+      $data['description'] = isset($data['description']) ? sanitize_textarea_field($data['description']) : '';
       $segment = $this->segmentSavecontroller->save($data);
       $response = $this->segmentsResponseBuilder->build($segment);
       return $this->successResponse($response);

mailpoet/lib/API/JSON/v1/Segments.php

@@ -119,6 +119,8 @@ class Segments extends APIEndpoint {
 
   public function save($data = []) {
     try {
+      $data['name'] = isset($data['name']) ? sanitize_text_field($data['name']) : '';
+      $data['description'] = isset($data['description']) ? sanitize_textarea_field($data['description']) : '';
       $segment = $this->segmentSavecontroller->save($data);
     } catch (ValidationException $exception) {
       return $this->badRequest([

mailpoet/lib/API/MP/v1/Segments.php

@@ -42,7 +42,7 @@ class Segments {
     $this->validateSegmentName($data);
 
     try {
-      $name = sanitize_text_field($data['name']);
+      $name = isset($data['name']) ? sanitize_text_field($data['name']) : '';
       $description = isset($data['description']) ? sanitize_textarea_field($data['description']) : '';
       $segment = $this->segmentsRepository->createOrUpdate($name, $description);
     } catch (\Exception $e) {
@@ -65,10 +65,13 @@ class Segments {
     // update is supported only for default segment type
     $this->validateSegmentType((string)$data['id']);
 
+    $name = isset($data['name']) ? sanitize_text_field($data['name']) : '';
+    $description = isset($data['description']) ? sanitize_textarea_field($data['description']) : '';
+
     try {
       $segment = $this->segmentsRepository->createOrUpdate(
-        $data['name'],
+        $name,
-        $data['description'] ?? '',
+        $description,
         SegmentEntity::TYPE_DEFAULT,
         [],
         (int)$data['id']

mailpoet/lib/Segments/SegmentsRepository.php

@@ -139,9 +139,6 @@ class SegmentsRepository extends Repository {
   ): SegmentEntity {
     $displayInManageSubPage = $type === SegmentEntity::TYPE_DEFAULT ? $displayInManageSubscriptionPage : false;
 
-    $name = sanitize_text_field($name);
-    $description = sanitize_textarea_field($description);
-
     if ($id) {
       $segment = $this->findOneById($id);
       if (!$segment instanceof SegmentEntity) {