fix(audit L1): Schleifen in module.advanced.loop brauchen list_users (Benutzer) bzw. read_private_posts (any, attachment, leere subTypes), auch beim Kopieren

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/Support/ComposeFixture.php

@@ -29,11 +29,33 @@ final class ComposeFixture
     /** A valid content reference as an attachment's alt text (media ids 44 and 45). */
     public const REFERENCE_ALT = '$variable({"type":"content","value":{"name":"post_title","settings":{}}})$';
 
-    public static function sanitizer(bool $unfiltered = false): ValueSanitizer
-    {
-        return new class ($unfiltered) implements ValueSanitizer {
-            public function __construct(private bool $unfiltered)
+    /** $listUsers / $readPrivate: the rights list_users / read_private_posts (audit L1); post, page, product exist. */
+    public static function sanitizer(
+        bool $unfiltered = false,
+        bool $listUsers = true,
+        bool $readPrivate = true
+    ): ValueSanitizer {
+        return new class ($unfiltered, $listUsers, $readPrivate) implements ValueSanitizer {
+            public function __construct(
+                private bool $unfiltered,
+                private bool $listUsers,
+                private bool $readPrivate
+            ) {
+            }
+
+            public function canListUsers(): bool
             {
+                return $this->listUsers;
+            }
+
+            public function canReadPrivatePosts(): bool
+            {
+                return $this->readPrivate;
+            }
+
+            public function postTypeExists(string $type): bool
+            {
+                return in_array($type, ['post', 'page', 'product', 'attachment'], true);
             }
 
             /**