fix: the Lottie source is builder-only for users without unfiltered_html (P19)

lottie.innerContent (src → data-lottie-src) makes the frontend load an
animation whose expressions lottie-web runs with eval; it joins the S7 gate
in ValueCleaner, which covers removals and StoredNodeGuard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
2026-09-27 02:06:38 +02:00
co-authored by Claude Opus 5.5
parent 16c6d59725
commit 8fa285a265
6 changed files with 90 additions and 9 deletions
@@ -164,6 +164,13 @@ final class StoredNodeGuardTest extends TestCase
])]]]),
'module.decoration.interactions',
],
'lottie source (P19)' => [
self::node('divi/lottie', ['lottie' => ['innerContent' => self::desktop([
'src' => 'https://probe.example/anim.json',
'trigger' => 'onLoad',
])]]),
'lottie.innerContent',
],
// Code module (E6).
'code module' => [
self::node('divi/code', ['content' => ['innerContent' => self::desktop(self::PROBE_SCRIPT)]]),