Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(audit L1): Schleifen-Rechteprüfung auf dem bereinigten Wert (sanitize_text_field-Umgehung) und mit sanitize_key-Lesart von enable/queryType

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-10-20 00:11:11 +02:00
co-authored by Claude Sonnet 5.5
parent bd80ab1394
commit 71c2e03c9b
4 changed files with 59 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Integrations/Divi/Compose/AttrWriter.php
+4 -2
View File
@@ -145,10 +145,12 @@ final class AttrWriter
{
foreach ($normalized as $breakpoint => $states) {
foreach ($states as $state => $value) {
$clean = $this->cleaner->clean($module, $path, $value);
if ($breakpoint === 'desktop' && $state === 'value') {
$this->cleaner->guardLoop($path, $value);
// The cleaned value: sanitizers turn " on" or "user<b></b>_roles" into what Divi acts on.
$this->cleaner->guardLoop($path, $clean);
}
$normalized[$breakpoint][$state] = $this->cleaner->clean($module, $path, $value);
$normalized[$breakpoint][$state] = $clean;
}
}
src/Integrations/Divi/Compose/ValueCleaner.php
+6 -3
View File
@@ -180,12 +180,15 @@ final class ValueCleaner
if ($path !== 'module.advanced.loop' || ! is_array($desktopValue)) {
return;
}
if (($desktopValue['enable'] ?? null) !== 'on') {
// Divi reads enable and queryType through sanitize_key() (LoopUtils.php:725-731): stored values count so.
$key = static fn (mixed $value): string => is_string($value)
? (string) preg_replace('/[^a-z0-9_\-]/', '', strtolower($value))
: '';
if ($key($desktopValue['enable'] ?? null) !== 'on') {
return;
}
$queryType = $desktopValue['queryType'] ?? 'post_types';
$queryType = is_string($queryType) ? preg_replace('/[^a-z0-9_\-]/', '', strtolower($queryType)) : '';
$queryType = array_key_exists('queryType', $desktopValue) ? $key($desktopValue['queryType']) : 'post_types';
if (($queryType === 'user_roles' || $queryType === 'users') && ! $this->sanitizer->canListUsers()) {
throw new InvalidArgumentException(
'Eine Benutzer-Schleife listet Konten und E-Mail-Adressen und braucht das Recht list_users; '