janniclas.loosenandClaude Opus 5.5
7762b76305
DiviSaver/DiviWriter/DiviComposition/DiviChange, WpValueSanitizer (S4), WpMediaResolver, DiviFlags (S11), DynamicContentMap from Divi's live registry (S22), S31 wiring, S35 control strip at apply() entry. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
50 lines
2.0 KiB
PHP
50 lines
2.0 KiB
PHP
<?php
|
||
|
||
declare(strict_types=1);
|
||
|
||
namespace LIT\MCP\Tests\Unit\Integrations\Divi\Pages;
|
||
|
||
use Brain\Monkey\Functions;
|
||
use LIT\MCP\Integrations\Divi\Pages\WpValueSanitizer;
|
||
use LIT\MCP\Tests\Unit\TestCase;
|
||
|
||
final class WpValueSanitizerTest extends TestCase
|
||
{
|
||
protected function setUp(): void
|
||
{
|
||
parent::setUp();
|
||
Functions\when('wp_kses_post')->alias(static fn (string $value): string => 'kses(' . $value . ')');
|
||
Functions\when('esc_url_raw')->alias(static fn (string $value): string => 'url(' . $value . ')');
|
||
}
|
||
|
||
public function testEditorsGetKsesForRichTextAndCode(): void
|
||
{
|
||
Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap !== 'unfiltered_html');
|
||
$sanitizer = new WpValueSanitizer();
|
||
|
||
self::assertSame('kses(<iframe></iframe>)', $sanitizer->html('<iframe></iframe>'));
|
||
self::assertSame('kses(<script>x</script>)', $sanitizer->code('<script>x</script>'));
|
||
self::assertFalse($sanitizer->allowsUnfilteredHtml());
|
||
}
|
||
|
||
public function testAdministratorsKeepRichTextAndCodeUnfiltered(): void
|
||
{
|
||
// Ruling S4: html() depends on unfiltered_html like code() – admin embeds survive updates.
|
||
Functions\when('current_user_can')->alias(static fn (string $cap): bool => $cap === 'unfiltered_html');
|
||
$sanitizer = new WpValueSanitizer();
|
||
|
||
self::assertSame('<iframe src="https://x.test"></iframe>', $sanitizer->html('<iframe src="https://x.test"></iframe>'));
|
||
self::assertSame('<script>x</script>', $sanitizer->code('<script>x</script>'));
|
||
self::assertTrue($sanitizer->allowsUnfilteredHtml());
|
||
}
|
||
|
||
public function testTextAndUrlDoNotDependOnTheRole(): void
|
||
{
|
||
Functions\when('current_user_can')->justReturn(true);
|
||
$sanitizer = new WpValueSanitizer();
|
||
|
||
self::assertSame('Hallo', $sanitizer->text('<b>Hallo</b>'));
|
||
self::assertSame('url(https://x.test/a b)', $sanitizer->url(' https://x.test/a b '));
|
||
}
|
||
}
|