Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: interactions are builder-only for users without unfiltered_html (P16)

Browse Source 
Divi's frontend applies the interaction effect "Attribute" with setAttribute
(e.g. an onclick handler) and sets cookies; *.decoration.interactions joins
the S7 gate in ValueCleaner, which also covers removals and StoredNodeGuard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
janniclas.loosen
2026-09-27 01:54:25 +02:00
co-authored by Claude Opus 5.5
parent f8275ad325
commit 9d92808918
7 changed files with 107 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/Divi/Compose/ShortformWriterTest.php
+23
View File
@@ -10,6 +10,7 @@ use LIT\MCP\Integrations\Divi\Compose\ShortformWriter;
use LIT\MCP\Integrations\Divi\Compose\ValueCleaner;
use LIT\MCP\Integrations\Divi\Compose\VariableRef;
use LIT\MCP\Integrations\Divi\Pages\DynamicContentMap;
use LIT\MCP\Integrations\Divi\Schema\ShortformMap;
use LIT\MCP\Tests\Support\ComposeFixture;
use LIT\MCP\Tests\Support\DiviFixtures;
use PHPUnit\Framework\TestCase;
@@ -426,4 +427,26 @@ final class ShortformWriterTest extends TestCase
return new ShortformWriter(new Placeholders($design, ComposeFixture::links()), ComposeFixture::media(), $cleaner);
}
/** Ruling P16: no curated short field reaches interactions, and a field that did would be gated. */
public function testInteractionsAreBuilderOnlyInTheShortForm(): void
{
foreach (ShortformMap::types() as $type) {
foreach (ShortformMap::fields($type) as $name => $field) {
self::assertStringNotContainsString('interactions', $field['path'], $type . '.' . $name);
}
}
$modules = ['raw' => [
'effects' => ['path' => 'module.decoration.interactions', 'sub' => 'interactions', 'kind' => 'text', 'description' => 'x'],
]];
foreach (['data-probe', null] as $value) {
$result = ComposeFixture::shortform(false, $modules)->apply('raw', self::BASE, ['effects' => $value], 'n');
self::assertStringContainsString('nur im Divi-Builder', $result['errors']['n.effects']);
self::assertSame(self::BASE, $result['attrs']);
}
$admin = ComposeFixture::shortform(true, $modules)->apply('raw', [], ['effects' => 'x'], 'n');
self::assertSame([], $admin['errors']);
}
}