Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(audit L1): Schleifen in module.advanced.loop brauchen list_users (Benutzer) bzw. read_private_posts (any, attachment, leere subTypes), auch beim Kopieren

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-10-20 00:00:59 +02:00
co-authored by Claude Sonnet 5.5
parent 9c1d5fad22
commit 4a8a889f93
10 changed files with 299 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/Divi/Compose/AttrWriterTest.php
+29
View File
@@ -455,4 +455,33 @@ final class AttrWriterTest extends TestCase
self::assertSame([], $adminRemoval['errors']);
self::assertArrayNotHasKey('lottie', $adminRemoval['attrs']);
}
/** Audit L1: the loop state of desktop.value is checked where attrs are written; other writes stay as they are. */
public function testRefusesALoopThatNeedsRightsTheAccountLacks(): void
{
$writer = new AttrWriter(
DiviFixtures::catalog(),
ComposeFixture::placeholders(),
new ValueCleaner(
DiviFixtures::catalog(),
ComposeFixture::references(),
ComposeFixture::sanitizer(false, false, false)
)
);
$loop = static fn (array $value): array => ['module.advanced.loop' => ['desktop' => $value]];
$users = $writer->apply('divi/text', self::TEXT, $loop(['enable' => 'on', 'queryType' => 'user_roles']), 'attrs');
self::assertStringContainsString('list_users', $users['errors']['attrs.module.advanced.loop'] ?? '');
self::assertArrayNotHasKey('module', $users['attrs']);
$posts = $writer->apply('divi/text', self::TEXT, $loop(['enable' => 'on']), 'attrs');
self::assertStringContainsString('read_private_posts', $posts['errors']['attrs.module.advanced.loop'] ?? '');
$off = $writer->apply('divi/text', self::TEXT, $loop(['enable' => 'off']), 'attrs');
self::assertSame([], $off['errors']);
$safe = $writer->apply('divi/text', self::TEXT, $loop(
['enable' => 'on', 'queryType' => 'post_types', 'subTypes' => [['value' => 'post']]]
), 'attrs');
self::assertSame([], $safe['errors']);
}
}