diff --git a/src/classes/repositories/class-tainacan-repository.php b/src/classes/repositories/class-tainacan-repository.php
index dc2df52db..713153b39 100644
--- a/src/classes/repositories/class-tainacan-repository.php
+++ b/src/classes/repositories/class-tainacan-repository.php
@@ -121,8 +121,8 @@ abstract class Repository {
*/
public function insert( $obj ) {
// validate
- $require_validation_statuses = [ 'publish', 'future', 'private'];
- if (in_array( $obj->get_status(), apply_filters( 'tainacan-status-require-validation', $require_validation_statuses) ) && ! $obj->get_validated() ) {
+ $required_validation_statuses = ['publish', 'future', 'private'];
+ if (in_array( $obj->get_status(), apply_filters( 'tainacan-status-require-validation', $required_validation_statuses) ) && ! $obj->get_validated() ) {
throw new \Exception( 'Entities must be validated before you can save them' );
// TODO: Throw Warning saying you must validate object before insert()
}
@@ -144,11 +144,6 @@ abstract class Repository {
}
$obj->WP_Post->post_type = $obj::get_post_type();
- if ( $obj instanceof Entities\Taxonomy ) {
- $sanitized = $this->sanitize_value($obj->get('name'));
- $obj->WP_Post->post_title = $sanitized;
- }
-
if ( $obj instanceof Entities\Log && ! ( isset( $obj->WP_Post->post_status ) && in_array( $obj->WP_Post->post_status, [
'publish',
'pending'
@@ -175,9 +170,11 @@ abstract class Repository {
do_action( "tainacan-pre-insert-$obj_post_type", $obj );
}
- if ($obj instanceof Entities\Collection || $obj instanceof Entities\Metadatum) {
+ if ($obj instanceof Entities\Collection || $obj instanceof Entities\Metadatum || $obj instanceof Entities\Taxonomy) {
$sanitized = $this->sanitize_value($obj->get('name'));
+ $sanitized_desc = $this->sanitize_value($obj->get('description'));
$obj->WP_Post->post_title = $sanitized;
+ $obj->WP_Post->post_content = $sanitized_desc;
}
$id = wp_insert_post( $obj->WP_Post );
diff --git a/tests/test-html-injection.php b/tests/test-html-injection.php
index 8801734e3..3bc45eb2e 100644
--- a/tests/test-html-injection.php
+++ b/tests/test-html-injection.php
@@ -28,16 +28,21 @@ class HTML_Injection extends TAINACAN_UnitTestCase
$css = "my text along with some style ";
$iframe = "";
$text_and_link = "my very interesting name and $link as well";
+ $text_and_iframe = "description item $iframe";
// Accepted formatting
$strong = "I have some info to tell the world. And I can bold it ";
$html = "
Main Info
sub title
My structure description
and another paragraph
";
+ // Expected returns
+ $expected_title = 'my very interesting name and link as well';
+ $expected_desc = 'description item';
+
$collection = $this->tainacan_entity_factory->create_entity(
'collection',
array(
'name' => 'collection name link link2 ',
- 'description' => 'collection description',
+ 'description' => $text_and_iframe,
),
true
);
@@ -45,7 +50,8 @@ class HTML_Injection extends TAINACAN_UnitTestCase
// Test Collection
$this->assertEquals($collection->get_name(), 'collection name link link2');
-
+ $this->assertEquals($collection->get_description(), $expected_desc);
+
$metadatum = $this->tainacan_entity_factory->create_entity(
'metadatum',
array(
@@ -57,23 +63,24 @@ class HTML_Injection extends TAINACAN_UnitTestCase
true
);
$metadatum = $Tainacan_Metadata->fetch($metadatum->get_id());
- $this->assertEquals($metadatum->get_name(), 'my very interesting name and link as well');
+ $this->assertEquals($metadatum->get_name(), $expected_title);
$item = $this->tainacan_entity_factory->create_entity(
'item',
array(
'title' => 'title item ',
- 'description' => 'description item ',
+ 'description' => $text_and_iframe,
'collection' => $collection
),
true
);
- $taxonomy = $this->tainacan_entity_factory->create_entity(
- 'taxonomy',
+ $taxonomy = $this->tainacan_entity_factory->create_entity(
+ 'taxonomy',
array(
'name' => $text_and_link,
'collections' => [$collection],
+ 'description' => $text_and_iframe,
'status' => 'publish'
),
true
@@ -81,9 +88,11 @@ class HTML_Injection extends TAINACAN_UnitTestCase
$item = $Tainacan_Items->fetch($item->get_id());
$this->assertEquals($item->get_title(), 'title item console.log("XSS")');
- $this->assertEquals($item->get_description(), 'description item');
+ $this->assertEquals($item->get_description(), $expected_desc);
- // Test metadata
+ /*
+ * Test metadata
+ */
$item_metadata = new \Tainacan\Entities\Item_Metadata_Entity($item, $metadatum);
$item_metadata->set_value($js);
$item_metadata->validate();
@@ -116,10 +125,15 @@ class HTML_Injection extends TAINACAN_UnitTestCase
$item_metadata = $Tainacan_Item_Metadata->update($item_metadata);
$this->assertEquals($item_metadata->get_value(), $html);
- // Test terms
+ /*
+ * Test terms
+ */
- // Test taxonomies
+ /*
+ * Test taxonomies
+ */
$tx = $Tainacan_Taxonomies->fetch($taxonomy->get_id());
- $this->assertEquals($tx->get_name(), 'my very interesting name and link as well');
+ $this->assertEquals($tx->get_name(), $expected_title);
+ $this->assertEquals($tx->get_description(), $expected_desc);
}
}