Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(security): Pods-Feldrechte fail-closed

Browse Source 
Fehlt pods_has_permissions() oder pods_permission(), gilt kein Pods-Feld mehr als unbeschränkt, sondern als nicht erlaubt (HIDDEN/READONLY).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-11-06 11:30:05 +01:00
co-authored by Claude Opus 5.5
parent 29e73caefb
commit 8f3a4e76eb
2 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/Pods/PodsFieldSourceTest.php
Generated
+14 -1
View File
@@ -32,7 +32,7 @@ final class PodsFieldSourceTest extends TestCase
private function source(?object $pod): PodsFieldSource
{
return new PodsFieldSource(static fn (string $name) => $pod ?? false);
return new PodsFieldSource(static fn (string $name) => $pod ?? false, null, static fn (object $field): ?bool => null);
}
/** @return array<string, array<string, mixed>> */
@@ -79,6 +79,19 @@ final class PodsFieldSourceTest extends TestCase
self::assertSame(FieldDefinition::UNKNOWN, $fields['mystery']['status']);
}
/** Fail-closed: without the Pods permission functions (not loaded in the unit run) no field counts as permitted. */
public function testFieldIsHiddenWhenThePodsPermissionFunctionsAreMissing(): void
{
self::assertFalse(function_exists('pods_has_permissions'));
$pod = Mockery::mock();
$pod->allows('get_type')->andReturn('post_type');
$pod->allows('get_fields')->andReturn(['role' => $this->field('role', 'text')]);
$fields = (new PodsFieldSource(static fn (string $name) => $pod))->fieldsFor('lit_person');
self::assertSame(FieldDefinition::HIDDEN, $fields[0]->status);
}
public function testParsesCustomSimpleChoices(): void
{
self::assertSame(