Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: interactions are builder-only for users without unfiltered_html (P16)

Browse Source 
Divi's frontend applies the interaction effect "Attribute" with setAttribute
(e.g. an onclick handler) and sets cookies; *.decoration.interactions joins
the S7 gate in ValueCleaner, which also covers removals and StoredNodeGuard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
janniclas.loosen
2026-09-27 01:54:25 +02:00
co-authored by Claude Opus 5.5
parent f8275ad325
commit 9d92808918
7 changed files with 107 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/Divi/Compose/ValueCleanerTest.php
+34
View File
@@ -198,4 +198,38 @@ final class ValueCleanerTest extends TestCase
self::assertNull(($cleaner->textReplacementFor('divi/button'))('button.innerContent', 'linkUrl', 'https://x.test'));
self::assertNull(($cleaner->textReplacementFor('divi/code'))('content.innerContent', null, 'x'));
}
/**
* Ruling P16: Divi's interactions ("Attribute" effect → setAttribute on the frontend, Cookie,
* Preset) are builder-only like HTML attributes, at every depth.
*/
public function testInteractionPathsNeedUnfilteredHtml(): void
{
$value = ['interactions' => [[
'trigger' => 'click',
'effect' => 'addAttribute',
'attributeName' => 'data-probe',
'attributeValue' => '1',
]]];
$paths = [
'module.decoration.interactions',
'module.decoration.interactions.desktop',
'title.decoration.interactions',
'decoration.interactions',
];
foreach ($paths as $path) {
try {
ComposeFixture::cleaner()->clean('divi/text', $path, $value);
self::fail('Accepted for an editor: ' . $path);
} catch (InvalidArgumentException $e) {
self::assertStringContainsString('nur im Divi-Builder', $e->getMessage());
}
self::assertSame($value, ComposeFixture::cleaner(true)->clean('divi/text', $path, $value));
}
// Only a whole "interactions" segment below "decoration" counts.
self::assertSame('x', ComposeFixture::cleaner()->clean('divi/text', 'module.decoration.interactionsish', 'x'));
self::assertSame('x', ComposeFixture::cleaner()->clean('divi/text', 'module.advanced.interactions', 'x'));
}
}