janniclas.loosenandClaude Opus 5.5
b8cb01812e
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
60 lines
2.3 KiB
PHP
60 lines
2.3 KiB
PHP
<?php
|
||
|
||
declare(strict_types=1);
|
||
|
||
namespace LIT\MCP\Tests\Unit\Integrations\Divi\Pages;
|
||
|
||
use Brain\Monkey\Functions;
|
||
use LIT\MCP\Integrations\Divi\Pages\WpValueSanitizer;
|
||
use LIT\MCP\Tests\Unit\TestCase;
|
||
|
||
final class WpValueSanitizerTest extends TestCase
|
||
{
|
||
protected function setUp(): void
|
||
{
|
||
parent::setUp();
|
||
Functions\when('wp_kses_post')->alias(static fn (string $value): string => 'kses(' . $value . ')');
|
||
Functions\when('esc_url_raw')->alias(static fn (string $value): string => 'url(' . $value . ')');
|
||
}
|
||
|
||
public function testEditorsGetKsesForRichTextAndCode(): void
|
||
{
|
||
Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap !== 'unfiltered_html');
|
||
$sanitizer = new WpValueSanitizer();
|
||
|
||
self::assertSame('kses(<iframe></iframe>)', $sanitizer->html('<iframe></iframe>'));
|
||
self::assertSame('kses(<script>x</script>)', $sanitizer->code('<script>x</script>'));
|
||
self::assertFalse($sanitizer->allowsUnfilteredHtml());
|
||
}
|
||
|
||
public function testAdministratorsKeepRichTextAndCodeUnfiltered(): void
|
||
{
|
||
// Ruling S4: html() depends on unfiltered_html like code() – admin embeds survive updates.
|
||
Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap === 'unfiltered_html');
|
||
$sanitizer = new WpValueSanitizer();
|
||
|
||
self::assertSame('<iframe src="https://x.test"></iframe>', $sanitizer->html('<iframe src="https://x.test"></iframe>'));
|
||
self::assertSame('<script>x</script>', $sanitizer->code('<script>x</script>'));
|
||
self::assertTrue($sanitizer->allowsUnfilteredHtml());
|
||
}
|
||
|
||
public function testTextAndUrlDoNotDependOnTheRole(): void
|
||
{
|
||
Functions\when('current_user_can')->justReturn(true);
|
||
$sanitizer = new WpValueSanitizer();
|
||
|
||
self::assertSame('Hallo', $sanitizer->text('<b>Hallo</b>'));
|
||
self::assertSame('url(https://x.test/a b)', $sanitizer->url(' https://x.test/a b '));
|
||
}
|
||
|
||
public function testCanReadPostAsksWordPress(): void
|
||
{
|
||
Functions\when('current_user_can')->alias(static fn (string $cap, int $id = 0): bool => $cap === 'read_post' && $id === 12);
|
||
$sanitizer = new WpValueSanitizer();
|
||
|
||
self::assertTrue($sanitizer->canReadPost(12));
|
||
self::assertFalse($sanitizer->canReadPost(13));
|
||
}
|
||
}
|
||
|