From 6e8413897957f3f348f3e0c29f70edf25733d65f Mon Sep 17 00:00:00 2001 From: Jan-Niclas Loosen Date: Tue, 20 Oct 2026 00:20:09 +0200 Subject: [PATCH] =?UTF-8?q?fix(audit=20L1):=20queryType=20null=20f=C3=A4ll?= =?UTF-8?q?t=20wie=20bei=20Divi=20(isset)=20auf=20post=5Ftypes=20zur=C3=BC?= =?UTF-8?q?ck;=20Skalare=20lesen=20wie=20sanitize=5Fkey?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Sonnet 5.5 --- src/Integrations/Divi/Compose/ValueCleaner.php | 7 ++++--- tests/Unit/Integrations/Divi/Compose/ValueCleanerTest.php | 2 ++ 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/Integrations/Divi/Compose/ValueCleaner.php b/src/Integrations/Divi/Compose/ValueCleaner.php index 99c6921..675daa3 100644 --- a/src/Integrations/Divi/Compose/ValueCleaner.php +++ b/src/Integrations/Divi/Compose/ValueCleaner.php @@ -181,14 +181,15 @@ final class ValueCleaner return; } // Divi reads enable and queryType through sanitize_key() (LoopUtils.php:725-731): stored values count so. - $key = static fn (mixed $value): string => is_string($value) - ? (string) preg_replace('/[^a-z0-9_\-]/', '', strtolower($value)) + $key = static fn (mixed $value): string => is_scalar($value) + ? (string) preg_replace('/[^a-z0-9_\-]/', '', strtolower((string) $value)) : ''; if ($key($desktopValue['enable'] ?? null) !== 'on') { return; } - $queryType = array_key_exists('queryType', $desktopValue) ? $key($desktopValue['queryType']) : 'post_types'; + // isset() like Divi: null falls back to post_types. + $queryType = isset($desktopValue['queryType']) ? $key($desktopValue['queryType']) : 'post_types'; if (($queryType === 'user_roles' || $queryType === 'users') && ! $this->sanitizer->canListUsers()) { throw new InvalidArgumentException( 'Eine Benutzer-Schleife listet Konten und E-Mail-Adressen und braucht das Recht list_users; ' diff --git a/tests/Unit/Integrations/Divi/Compose/ValueCleanerTest.php b/tests/Unit/Integrations/Divi/Compose/ValueCleanerTest.php index 2f0b855..886fd87 100644 --- a/tests/Unit/Integrations/Divi/Compose/ValueCleanerTest.php +++ b/tests/Unit/Integrations/Divi/Compose/ValueCleanerTest.php @@ -40,6 +40,8 @@ final class ValueCleanerTest extends TestCase 'attachment among others' => [$post + ['subTypes' => $types('post', 'attachment')]], 'only unknown types (Divi falls back to any)' => [$post + ['subTypes' => $types('gibtesnicht')]], 'comma string with any' => [$post + ['subTypes' => 'post, ANY']], + 'queryType null (isset: post_types), no subTypes' => [['enable' => 'on', 'queryType' => null]], + 'subTypes null' => [$post + ['subTypes' => null]], 'entries without value' => [$post + ['subTypes' => [['label' => 'x']]]], ]; }