fix(audit L1): Schleifen in module.advanced.loop brauchen list_users (Benutzer) bzw. read_private_posts (any, attachment, leere subTypes), auch beim Kopieren

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-20 00:00:59 +02:00
parent 9c1d5fad22
commit 4a8a889f93
10 changed files with 299 additions and 9 deletions
@@ -29,11 +29,33 @@ final class ComposeFixture
    /** A valid content reference as an attachment's alt text (media ids 44 and 45). */
    public const REFERENCE_ALT = '$variable({"type":"content","value":{"name":"post_title","settings":{}}})$';

-    public static function sanitizer(bool $unfiltered = false): ValueSanitizer
-    {
-        return new class ($unfiltered) implements ValueSanitizer {
-            public function __construct(private bool $unfiltered)
+    /** $listUsers / $readPrivate: the rights list_users / read_private_posts (audit L1); post, page, product exist. */
+    public static function sanitizer(
+        bool $unfiltered = false,
+        bool $listUsers = true,
+        bool $readPrivate = true
+    ): ValueSanitizer {
+        return new class ($unfiltered, $listUsers, $readPrivate) implements ValueSanitizer {
+            public function __construct(
+                private bool $unfiltered,
+                private bool $listUsers,
+                private bool $readPrivate
+            ) {
+            }
+
+            public function canListUsers(): bool
            {
+                return $this->listUsers;
+            }
+
+            public function canReadPrivatePosts(): bool
+            {
+                return $this->readPrivate;
+            }
+
+            public function postTypeExists(string $type): bool
+            {
+                return in_array($type, ['post', 'page', 'product', 'attachment'], true);
            }

            /**