Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(audit L1): queryType null fällt wie bei Divi (isset) auf post_types zurück; Skalare lesen wie sanitize_key

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-10-20 00:20:09 +02:00
co-authored by Claude Sonnet 5.5
parent f754772beb
commit 6e84138979
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Integrations/Divi/Compose/ValueCleaner.php
+4 -3
View File
@@ -181,14 +181,15 @@ final class ValueCleaner
return; return;
} }
// Divi reads enable and queryType through sanitize_key() (LoopUtils.php:725-731): stored values count so. // Divi reads enable and queryType through sanitize_key() (LoopUtils.php:725-731): stored values count so.
$key = static fn (mixed $value): string => is_string($value) $key = static fn (mixed $value): string => is_scalar($value)
? (string) preg_replace('/[^a-z0-9_\-]/', '', strtolower($value)) ? (string) preg_replace('/[^a-z0-9_\-]/', '', strtolower((string) $value))
: ''; : '';
if ($key($desktopValue['enable'] ?? null) !== 'on') { if ($key($desktopValue['enable'] ?? null) !== 'on') {
return; return;
} }
$queryType = array_key_exists('queryType', $desktopValue) ? $key($desktopValue['queryType']) : 'post_types'; // isset() like Divi: null falls back to post_types.
$queryType = isset($desktopValue['queryType']) ? $key($desktopValue['queryType']) : 'post_types';
if (($queryType === 'user_roles' || $queryType === 'users') && ! $this->sanitizer->canListUsers()) { if (($queryType === 'user_roles' || $queryType === 'users') && ! $this->sanitizer->canListUsers()) {
throw new InvalidArgumentException( throw new InvalidArgumentException(
'Eine Benutzer-Schleife listet Konten und E-Mail-Adressen und braucht das Recht list_users; ' 'Eine Benutzer-Schleife listet Konten und E-Mail-Adressen und braucht das Recht list_users; '
tests/Unit/Integrations/Divi/Compose/ValueCleanerTest.php
+2
View File
@@ -40,6 +40,8 @@ final class ValueCleanerTest extends TestCase
'attachment among others' => [$post + ['subTypes' => $types('post', 'attachment')]], 'attachment among others' => [$post + ['subTypes' => $types('post', 'attachment')]],
'only unknown types (Divi falls back to any)' => [$post + ['subTypes' => $types('gibtesnicht')]], 'only unknown types (Divi falls back to any)' => [$post + ['subTypes' => $types('gibtesnicht')]],
'comma string with any' => [$post + ['subTypes' => 'post, ANY']], 'comma string with any' => [$post + ['subTypes' => 'post, ANY']],
'queryType null (isset: post_types), no subTypes' => [['enable' => 'on', 'queryType' => null]],
'subTypes null' => [$post + ['subTypes' => null]],
'entries without value' => [$post + ['subTypes' => [['label' => 'x']]]], 'entries without value' => [$post + ['subTypes' => [['label' => 'x']]]],
]; ];
} }