Widget removes fields w/ default HTML on initial save in IE8 and 9

[layotte]

Weird problem, testd in IE8/9, Chrome, and Firefox. If you have a widget, with HTML in the default value, IE8/9 will remove the field entirely. However, if you then paste the HTML back into the field and save, it works fine. This ONLY happens after the initial drag/drop then save of the widget. It even happens if you drag/drop the widget, change the field and click save.

Example Plugin: ​http://wordpress.org/extend/plugins/ft-calendar/
Widget: Upcoming Events Widget

The Event Template (event_template) is set by default to:

<a href="%URL">%TITLE%</a>

The event_template source for the Available Widget is:

<input type="text" value="&lt;a href=&quot;%URL%&quot;&gt;%TITLE% (%TIME%)&lt;/a&gt;" name="widget-ft_cal_event_list[__i__][event_template]" id="widget-ft_cal_event_list-__i__-event_template" class="widefat" />  

The event_template source for the widget after it is dragged to a widget area is:

<input type="text" value="&lt;a href=&quot;%URL%&quot;&gt;%TITLE% (%TIME%)&lt;/a&gt;" name="widget-ft_cal_event_list[8][event_template]" id="widget-ft_cal_event_list-8-event_template" class="widefat" /> 

The source for the widget after it is first saved is:

<input type="text" value="&lt;a href=&quot;%URL%&quot;&gt;%TITLE% (%TIME%)&lt;/a&gt;" name="widget-ft_cal_event_list[8][event_template]" id="widget-ft_cal_event_list-8-event_template" class="widefat" />

I setup a test to output $new_instance and $old_instance during the "update" process.

Step 1: Moving widget from Available Widgets to Widget Area (in IE):

NEW INSTANCE:
Array
(
    [title] =>
    [date] =>
    [number_of] => 1
    [date_types] => Month
    [limit] => 0
    [timeformat] => g:i a
    [dateformat] => jS
    [date_template] => %DATE%
    [monthformat] => F Y
    [month_template] => %MONTH%
)
OLD INSTANCE:
Array
(
)

Step 2: Saving widget in Widget Area:

NEW INSTANCE:
Array
(
    [title] =>
    [date] =>
    [number_of] => 1
    [date_types] => Month
    [limit] => 0
    [timeformat] => g:i a
    [dateformat] => jS
    [date_template] => %DATE%
    [monthformat] => F Y
    [month_template] => %MONTH%
)
OLD INSTANCE:
Array
(
    [title] =>
    [show_rss_feed] => off
    [show_ical_feed] => off
    [date] =>
    [span] => +1 Month
    [number_of] => 1
    [date_types] => Month
    [calendars] =>
    [limit] => 0
    [dateformat] => jS
    [timeformat] => g:i a
    [monthformat] => F Y
    [event_template] =>
    [date_template] => %DATE%
    [month_template] => %MONTH%
    [hide_duplicates] =>
)

Step 3: Pasting HTML code back into Event Template and saving Widget:

NEW INSTANCE:
Array
(
    [title] =>
    [date] =>
    [number_of] => 1
    [date_types] => Month
    [limit] => 0
    [timeformat] => g:i a
    [dateformat] => jS
    [date_template] => %DATE%
    [monthformat] => F Y
    [month_template] => %MONTH%
    [event_template] => <a href="%URL%">%TITLE% (%TIME%)</a>
)
OLD INSTANCE:
Array
(
    [title] =>
    [show_rss_feed] => off
    [show_ical_feed] => off
    [date] =>
    [span] => +1 Month
    [number_of] => 1
    [date_types] => Month
    [calendars] =>
    [limit] => 0
    [dateformat] => jS
    [timeformat] => g:i a
    [monthformat] => F Y
    [event_template] =>
    [date_template] => %DATE%
    [month_template] => %MONTH%
    [hide_duplicates] =>
)

Here is a screenr showing the problem not working in IE9 and working in Chrome: ​http://www.screenr.com/mkhs

Apparently IE uses unencoded values in DOM, in spite of esc_attr():

<INPUT value='<a href="%URL%">%TITLE% (%TIME%)</a>' ...

There's a regular expression in widgets.dev.js which replaces __i__ with a proper number:
http://core.trac.wordpress.org/browser/tags/3.2.1/wp-admin/js/widgets.dev.js#L122

In IE, it fails on fields with HTML values, and they end up in a separate array on POST:

[widget-ft_cal_event_list] => Array
    (
        [5] => Array
            (
                [title] => 
                [calendars] => all
                [number_of] => 1
                [date_types] => Month
                [limit] => 0
                [timeformat] => H:i
                [dateformat] => jS
                [date_template] => %DATE%
                [monthformat] => F Y
                [month_template] => %MONTH%
            )

        [__i__] => Array
            (
                [event_template] => <a href="%URL">%TITLE% (%TIME%)</a>
            )

    )

18446.patch​ is an attempt to fix this.

Good find! I'm surprised no one noticed this before.

Thanks.
Lew