diff --git a/src/classes/repositories/class-tainacan-repository.php b/src/classes/repositories/class-tainacan-repository.php index dc2df52db..713153b39 100644 --- a/src/classes/repositories/class-tainacan-repository.php +++ b/src/classes/repositories/class-tainacan-repository.php @@ -121,8 +121,8 @@ abstract class Repository { */ public function insert( $obj ) { // validate - $require_validation_statuses = [ 'publish', 'future', 'private']; - if (in_array( $obj->get_status(), apply_filters( 'tainacan-status-require-validation', $require_validation_statuses) ) && ! $obj->get_validated() ) { + $required_validation_statuses = ['publish', 'future', 'private']; + if (in_array( $obj->get_status(), apply_filters( 'tainacan-status-require-validation', $required_validation_statuses) ) && ! $obj->get_validated() ) { throw new \Exception( 'Entities must be validated before you can save them' ); // TODO: Throw Warning saying you must validate object before insert() } @@ -144,11 +144,6 @@ abstract class Repository { } $obj->WP_Post->post_type = $obj::get_post_type(); - if ( $obj instanceof Entities\Taxonomy ) { - $sanitized = $this->sanitize_value($obj->get('name')); - $obj->WP_Post->post_title = $sanitized; - } - if ( $obj instanceof Entities\Log && ! ( isset( $obj->WP_Post->post_status ) && in_array( $obj->WP_Post->post_status, [ 'publish', 'pending' @@ -175,9 +170,11 @@ abstract class Repository { do_action( "tainacan-pre-insert-$obj_post_type", $obj ); } - if ($obj instanceof Entities\Collection || $obj instanceof Entities\Metadatum) { + if ($obj instanceof Entities\Collection || $obj instanceof Entities\Metadatum || $obj instanceof Entities\Taxonomy) { $sanitized = $this->sanitize_value($obj->get('name')); + $sanitized_desc = $this->sanitize_value($obj->get('description')); $obj->WP_Post->post_title = $sanitized; + $obj->WP_Post->post_content = $sanitized_desc; } $id = wp_insert_post( $obj->WP_Post ); diff --git a/tests/test-html-injection.php b/tests/test-html-injection.php index 8801734e3..3bc45eb2e 100644 --- a/tests/test-html-injection.php +++ b/tests/test-html-injection.php @@ -28,16 +28,21 @@ class HTML_Injection extends TAINACAN_UnitTestCase $css = "my text along with some style "; $iframe = ""; $text_and_link = "my very interesting name and $link as well"; + $text_and_iframe = "description item $iframe"; // Accepted formatting $strong = "I have some info to tell the world. And I can bold it "; $html = "

Main Info

sub title

My structure description

and another paragraph

"; + // Expected returns + $expected_title = 'my very interesting name and link as well'; + $expected_desc = 'description item'; + $collection = $this->tainacan_entity_factory->create_entity( 'collection', array( 'name' => 'collection name link link2 ', - 'description' => 'collection description', + 'description' => $text_and_iframe, ), true ); @@ -45,7 +50,8 @@ class HTML_Injection extends TAINACAN_UnitTestCase // Test Collection $this->assertEquals($collection->get_name(), 'collection name link link2'); - + $this->assertEquals($collection->get_description(), $expected_desc); + $metadatum = $this->tainacan_entity_factory->create_entity( 'metadatum', array( @@ -57,23 +63,24 @@ class HTML_Injection extends TAINACAN_UnitTestCase true ); $metadatum = $Tainacan_Metadata->fetch($metadatum->get_id()); - $this->assertEquals($metadatum->get_name(), 'my very interesting name and link as well'); + $this->assertEquals($metadatum->get_name(), $expected_title); $item = $this->tainacan_entity_factory->create_entity( 'item', array( 'title' => 'title item ', - 'description' => 'description item ', + 'description' => $text_and_iframe, 'collection' => $collection ), true ); - $taxonomy = $this->tainacan_entity_factory->create_entity( - 'taxonomy', + $taxonomy = $this->tainacan_entity_factory->create_entity( + 'taxonomy', array( 'name' => $text_and_link, 'collections' => [$collection], + 'description' => $text_and_iframe, 'status' => 'publish' ), true @@ -81,9 +88,11 @@ class HTML_Injection extends TAINACAN_UnitTestCase $item = $Tainacan_Items->fetch($item->get_id()); $this->assertEquals($item->get_title(), 'title item console.log("XSS")'); - $this->assertEquals($item->get_description(), 'description item'); + $this->assertEquals($item->get_description(), $expected_desc); - // Test metadata + /* + * Test metadata + */ $item_metadata = new \Tainacan\Entities\Item_Metadata_Entity($item, $metadatum); $item_metadata->set_value($js); $item_metadata->validate(); @@ -116,10 +125,15 @@ class HTML_Injection extends TAINACAN_UnitTestCase $item_metadata = $Tainacan_Item_Metadata->update($item_metadata); $this->assertEquals($item_metadata->get_value(), $html); - // Test terms + /* + * Test terms + */ - // Test taxonomies + /* + * Test taxonomies + */ $tx = $Tainacan_Taxonomies->fetch($taxonomy->get_id()); - $this->assertEquals($tx->get_name(), 'my very interesting name and link as well'); + $this->assertEquals($tx->get_name(), $expected_title); + $this->assertEquals($tx->get_description(), $expected_desc); } }