Widgets editor: HTML entities appear in Legacy Widget's description

[ramonopoly]

HTML entities appear in Legacy Widget's description. For example:

A monthly archive of your site’s Posts.

How to reproduce

1. Head over to /wp-admin/themes.php?page=gutenberg-widgets and select a widget block.
2. Check out the description in the inspector controls.

What I expected

The widget description in the block inspector should say "A monthly archive of your site’s Posts."

That is, with no encoded entities.

This is a duplicate report of ​GB31023, which was fixed in the plugin for sites running WP 5.7 in ​GB32503

cc @TimothyBJacobs @noisysocks 

[ramonopoly]

HTML entities appear in the Legacy Widget block's description.

[spacedmonkey]

Might be related to #53138

Trac ticket: https://core.trac.wordpress.org/ticket/53407

## Description

HTML entities appear in Legacy Widget's description. For example:

A monthly archive of your site’s Posts. 😱

This commit converts widget name and description HTML entities to their corresponding characters in the REST API response using ​html_entity_decode.

The decoding occurs before the call to prepare_item_for_response which sanitizes the value.

### Before

<img width="324" alt="Screen Shot 2021-06-15 at 3 56 34 pm" src="​https://user-images.githubusercontent.com/6458278/122031674-435f8a00-ce12-11eb-9034-66bdb2b3eadb.png">

### After
<img width="344" alt="Screen Shot 2021-06-15 at 3 57 04 pm" src="​https://user-images.githubusercontent.com/6458278/122031708-48bcd480-ce12-11eb-9434-f294c1359f51.png">

## Testing

1. Head over to /wp-admin/themes.php?page=gutenberg-widgets and select a widget block.
2. Check out the description in the inspector controls.

[ramonopoly]

Replying to spacedmonkey:

Might be related to #53138

Oh, I didn't see that. Thanks for pointing it out.

#53138 looks like it targets the source strings, whereas ​Github #1371 will decode all titles/description for the API response.

I'm happy to close this ticket if folks prefer. Cheers!

[noisysocks]

Thanks @ramonopoly! The fix looks good to me. I think it's a more suitable alternative to #53138 as it is permitted that HTML entities can be in the title and description.

[SergeyBiryukov]

#53138 was marked as a duplicate.

[SergeyBiryukov]

In 51174:

REST API: Decode HTML entities in widget names and descriptions in widget types controller.

Follow-up to [50995].

Props ramonopoly, noisysocks, spacedmonkey, justinahinon, audrasjb, SergeyBiryukov.
Fixes #53407.

[SergeyBiryukov]

In 51175:

Coding Standards: Fix WPCS issue in [51174].

See #53407.

[ramonopoly]

Coding Standards: Fix WPCS issue in [51174].

Thanks for spotting the extra spaces I'd left in there @SergeyBiryukov !

[ocean90]

Is there a reason why single-quotes should not be decoded? For consistency with similar calls we should pass ENT_QUOTES as the second argument and also set the encoding to the value of get_bloginfo( 'charset' ).

[ramonopoly]

Is there a reason why single-quotes should not be decoded?

Ah, this was an oversight. Good spotting, thank you @ocean90

Just to confirm, we should change it to something like:

$widget['description'] = html_entity_decode( $widget['description'], ENT_QUOTES, get_bloginfo( 'charset' ) )

Thanks for the PR! Merged in https://core.trac.wordpress.org/changeset/51174.

[SergeyBiryukov]

In 51183:

REST API: Decode single and double quote entities in widget names and descriptions.

Follow-up to [51174], [51175].

Props ocean90, ramonopoly.
Fixes #53407.

The latest commits are now also merged in https://core.trac.wordpress.org/changeset/51183.