Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: Sicherheitstest für Redakteure ohne unfiltered_html prüft einen echten Builder-Pfad

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-10-16 18:03:21 +02:00
co-authored by Claude Opus 5.5
parent 2ed6093f97
commit fe8a01f878
1 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Unit/Integrations/Divi/Design/DiviPresetsSetAbilityTest.php
+12 -7
View File
@@ -145,15 +145,20 @@ final class DiviPresetsSetAbilityTest extends TestCase
self::assertArrayHasKey('items[1]', $result['fields']);
}
public function testEditorWithoutUnfilteredHtmlIsRefusedForRawCss(): void
/** Review Focus 1 (final review I-1): a catalog-known builder-only path, refused for editors only. */
public function testEditorWithoutUnfilteredHtmlIsRefusedForBuilderOnlyFields(): void
{
$result = $this->ability(false)->execute(['items' => [[
'module' => 'button', 'name' => 'Mit CSS',
'attrs' => ['css' => ['desktop' => ['mainElement' => 'color:red']]],
]]]);
$input = ['items' => [[
'module' => 'button', 'name' => 'Mit HTML',
'attrs' => ['module.advanced.html' => ['desktop' => ['elementType' => 'div']]],
]]];
self::assertNotTrue(is_array($result) && ($result['ok'] ?? false));
self::assertContains(Errors::codeOf($result), ['validation_failed', 'invalid_attr_path']);
$editor = self::assertToolError($this->ability(false)->execute($input), 'validation_failed');
self::assertArrayHasKey('items[0].attrs.module.advanced.html', $editor['fields']);
self::assertStringContainsString('Divi-Builder', $editor['fields']['items[0].attrs.module.advanced.html']);
self::assertStringContainsString('unfiltered_html', $editor['fields']['items[0].attrs.module.advanced.html']);
self::assertToolError($this->ability(true)->execute($input), 'confirm_required');
}
public function testFromNodeReadsThePage(): void