feat: settings sanitization and menu render buffer

class-menu.php

@@ -40,7 +40,7 @@ if (!class_exists('\WPCT_ABSTRACT\Menu')) :
             );
         }
 
-        protected function render_page()
+        protected function render_page($echo = true)
         {
             $page_settings = $this->settings->get_settings();
             $tabs = array_reduce($page_settings, function ($carry, $setting) {
@@ -48,6 +48,7 @@ if (!class_exists('\WPCT_ABSTRACT\Menu')) :
                 return $carry;
             }, []);
             $current_tab = isset($_GET['tab']) ? $_GET['tab'] : array_key_first($tabs);
+            ob_start();
             ?>
 			<div class="wrap">
 			<h1><?= get_admin_page_title() ?></h1>
@@ -67,6 +68,11 @@ if (!class_exists('\WPCT_ABSTRACT\Menu')) :
 				</form>
 			</div>
 			<?php
+            $output = ob_get_clean();
+            if ($echo) {
+                echo $output;
+            }
+            return $output;
         }
 
         public function get_name()

class-settings.php

@@ -2,6 +2,8 @@
 
 namespace WPCT_ABSTRACT;
 
+use Error;
+
 if (!class_exists('\WPCT_ABSTRACT\Settings')) :
 
     class Undefined
@@ -60,6 +62,10 @@ if (!class_exists('\WPCT_ABSTRACT\Settings')) :
         public function __construct($group_name)
         {
             $this->group_name = $group_name;
+
+            add_filter('pre_update_option', function ($value, $option, $from) {
+                return $this->sanitize_option($option, $value);
+            }, 10, 3);
         }
 
         public function get_group_name()
@@ -263,6 +269,70 @@ if (!class_exists('\WPCT_ABSTRACT\Settings')) :
         {
             return $this->group_name . '_' . $setting;
         }
+
+        private function sanitize_option($option, $value)
+        {
+            $settings = $this->get_settings();
+            if (in_array($option, $settings)) {
+                [$group, $setting] = explode('_', $option);
+                $default = Settings::get_default($group, $setting);
+                if (empty($value)) {
+                    return $default;
+                }
+
+                $schema = Settings::get_schema($group, $setting);
+
+                try {
+                    return $this->sanitize_object($schema, $value, $default);
+                } catch (Error) {
+                    return $default;
+                }
+            }
+
+            return $value;
+        }
+
+        private function sanitize_object($schema, $value, $default)
+        {
+            foreach ($schema as $key => $defn) {
+                if (empty($value[$key])) {
+                    $value[$key] = $default[$key];
+                } else {
+                    if ($defn['type'] === 'array') {
+                        $value[$key] = $this->sanitize_array($defn['items'], $value[$key], $default[$key] ?: []);
+                    } elseif ($defn['type'] === 'object') {
+                        $value[$key] = $this->sanitize_object($defn['properties'], $value[$key], $default[$key] ?: []);
+                    } else {
+                        $value[$key] = empty($value[$key]) ? $default[$key] : $value[$key];
+                    }
+                }
+            }
+
+            foreach (array_keys($value) as $key) {
+                if (!in_array($key, array_keys($schema))) {
+                    unset($value[$key]);
+                };
+            }
+
+            return $value;
+        }
+
+        private function sanitize_array($schema, $value, $defaults)
+        {
+            $default = null;
+            for ($i = 0; $i < count($value); $i++) {
+                $default = count($defaults) > $i ? array_shift($defaults) : $default;
+                if ($schema['type'] === 'array') {
+                    $value[$i] = $this->sanitize_array($schema['items'], $value[$i], $default ?: []);
+                } elseif ($schema['type'] === 'object') {
+                    $value[$i] = $this->sanitize_object($schema['properties'], $value[$i], $default ?: []);
+                } else {
+                    $value[$i] = empty($value[$i]) ? $default[0] : $value[$i];
+                }
+            }
+
+            return $value;
+        }
     }
 
 endif;