tmdinosaurcenter
/
tainacan
mirror of https://github.com/tainacan/tainacan
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Adds more texts and sanitized fields

This commit is contained in:
Rodrigo de Oliveira 2021-03-12 02:58:06 -03:00
parent 5fe6c41546
commit 566292eebd
2 changed files with 30 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/classes/repositories/class-tainacan-repository.php
View File

@ -121,8 +121,8 @@ abstract class Repository {
*/
public function insert( $obj ) {
// validate
$require_validation_statuses = [ 'publish', 'future', 'private'];
if (in_array( $obj->get_status(), apply_filters( 'tainacan-status-require-validation', $require_validation_statuses) ) && ! $obj->get_validated() ) {
$required_validation_statuses = ['publish', 'future', 'private'];
if (in_array( $obj->get_status(), apply_filters( 'tainacan-status-require-validation', $required_validation_statuses) ) && ! $obj->get_validated() ) {
throw new \Exception( 'Entities must be validated before you can save them' );
// TODO: Throw Warning saying you must validate object before insert()
}
@ -144,11 +144,6 @@ abstract class Repository {
}
$obj->WP_Post->post_type = $obj::get_post_type();
if ( $obj instanceof Entities\Taxonomy ) {
$sanitized = $this->sanitize_value($obj->get('name'));
$obj->WP_Post->post_title = $sanitized;
}
if ( $obj instanceof Entities\Log && ! ( isset( $obj->WP_Post->post_status ) && in_array( $obj->WP_Post->post_status, [
'publish',
'pending'
@ -175,9 +170,11 @@ abstract class Repository {
do_action( "tainacan-pre-insert-$obj_post_type", $obj );
}
if ($obj instanceof Entities\Collection || $obj instanceof Entities\Metadatum) {
if ($obj instanceof Entities\Collection || $obj instanceof Entities\Metadatum || $obj instanceof Entities\Taxonomy) {
$sanitized = $this->sanitize_value($obj->get('name'));
$sanitized_desc = $this->sanitize_value($obj->get('description'));
$obj->WP_Post->post_title = $sanitized;
$obj->WP_Post->post_content = $sanitized_desc;
}
$id = wp_insert_post( $obj->WP_Post );

36
tests/test-html-injection.php
View File

@ -28,16 +28,21 @@ class HTML_Injection extends TAINACAN_UnitTestCase
$css = "my text along with some style <style>a { display: none }</style>";
$iframe = "<iframe src='www.tainacan.org' title='Taiancan'></iframe>";
$text_and_link = "my very interesting name and $link as well";
$text_and_iframe = "description item $iframe";
// Accepted formatting
$strong = "I have some info to tell the world. And I can <strong> bold it </strong>";
$html = "<div><h1>Main Info</h1><h3>sub title</h3><p>My structure description<p></p>and another paragraph</p></div>";
// Expected returns
$expected_title = 'my very interesting name and link as well';
$expected_desc = 'description item';
$collection = $this->tainacan_entity_factory->create_entity(
'collection',
array(
'name' => 'collection name <a href="www.tainacan.org">link <a href="link2.com.br"> link2 </a> </a>',
'description' => 'collection description',
'description' => $text_and_iframe,
),
true
);
@ -45,7 +50,8 @@ class HTML_Injection extends TAINACAN_UnitTestCase
// Test Collection
$this->assertEquals($collection->get_name(), 'collection name link link2');
$this->assertEquals($collection->get_description(), $expected_desc);
$metadatum = $this->tainacan_entity_factory->create_entity(
'metadatum',
array(
@ -57,23 +63,24 @@ class HTML_Injection extends TAINACAN_UnitTestCase
true
);
$metadatum = $Tainacan_Metadata->fetch($metadatum->get_id());
$this->assertEquals($metadatum->get_name(), 'my very interesting name and link as well');
$this->assertEquals($metadatum->get_name(), $expected_title);
$item = $this->tainacan_entity_factory->create_entity(
'item',
array(
'title' => 'title item <script>console.log("XSS")</script>',
'description' => 'description item <iframe src="www.tainacan.org" title="Taiancan"></iframe>',
'description' => $text_and_iframe,
'collection' => $collection
),
true
);
$taxonomy = $this->tainacan_entity_factory->create_entity(
'taxonomy',
$taxonomy = $this->tainacan_entity_factory->create_entity(
'taxonomy',
array(
'name' => $text_and_link,
'collections' => [$collection],
'description' => $text_and_iframe,
'status' => 'publish'
),
true
@ -81,9 +88,11 @@ class HTML_Injection extends TAINACAN_UnitTestCase
$item = $Tainacan_Items->fetch($item->get_id());
$this->assertEquals($item->get_title(), 'title item console.log("XSS")');
$this->assertEquals($item->get_description(), 'description item');
$this->assertEquals($item->get_description(), $expected_desc);
// Test metadata
/*
* Test metadata
*/
$item_metadata = new \Tainacan\Entities\Item_Metadata_Entity($item, $metadatum);
$item_metadata->set_value($js);
$item_metadata->validate();
@ -116,10 +125,15 @@ class HTML_Injection extends TAINACAN_UnitTestCase
$item_metadata = $Tainacan_Item_Metadata->update($item_metadata);
$this->assertEquals($item_metadata->get_value(), $html);
// Test terms
/*
* Test terms
*/
// Test taxonomies
/*
* Test taxonomies
*/
$tx = $Tainacan_Taxonomies->fetch($taxonomy->get_id());
$this->assertEquals($tx->get_name(), 'my very interesting name and link as well');
$this->assertEquals($tx->get_name(), $expected_title);
$this->assertEquals($tx->get_description(), $expected_desc);
}
}