Changeset 41260 for trunk/tests/phpunit/tests/widgets/text-widget.php

Timestamp:

08/17/2017 11:36:53 PM (8 years ago)

Author:

westonruter

Message:

Widgets: Prevent visual Text widget from decoding encoded HTML.

Also apply the_editor_content filters on widget text with format_for_editor() as is done for the post editor.

Amends [40631].
Props westonruter, azaozz.
See #35243.
Fixes #41596.

File:

• trunk/tests/phpunit/tests/widgets/text-widget.php (modified) (5 diffs)

trunk/tests/phpunit/tests/widgets/text-widget.php

@@ -448 +448 @@
      */
     function test_form() {
-        $widget = new WP_Widget_Text();
+        add_filter( 'user_can_richedit', '__return_true' );
+        $widget = new WP_Widget_Text();
+        $widget->_set( 2 );
         $instance = array(
             'title' => 'Title',
@@ -460 +462 @@
         $form = ob_get_clean();
         $this->assertContains( 'class="visual" type="hidden" value=""', $form );
-        $this->assertNotContains( 'class="visual" type="hidden" value="on"', $form );
+        $this->assertNotContains( 'class="visual sync-input" type="hidden" value="on"', $form );
 
         $instance = array(
@@ -471 +473 @@
         $widget->form( $instance );
         $form = ob_get_clean();
-        $this->assertContains( 'class="visual" type="hidden" value="on"', $form );
-        $this->assertNotContains( 'class="visual" type="hidden" value=""', $form );
+        $this->assertContains( 'class="visual sync-input" type="hidden" value="on"', $form );
+        $this->assertNotContains( 'class="visual sync-input" type="hidden" value=""', $form );
 
         $instance = array(
@@ -483 +485 @@
         $widget->form( $instance );
         $form = ob_get_clean();
-        $this->assertContains( 'class="visual" type="hidden" value="on"', $form );
-        $this->assertNotContains( 'class="visual" type="hidden" value=""', $form );
-
-        $instance = array(
-            'title' => 'Title',
-            'text' => 'Text',
+        $this->assertContains( 'class="visual sync-input" type="hidden" value="on"', $form );
+        $this->assertNotContains( 'class="visual sync-input" type="hidden" value=""', $form );
+
+        $instance = array(
+            'title' => 'Title',
+            'text' => 'This is some HTML Code: <code>&lt;strong&gt;BOLD!&lt;/strong&gt;</code>',
             'filter' => true,
             'visual' => true,
@@ -496 +498 @@
         $widget->form( $instance );
         $form = ob_get_clean();
-        $this->assertContains( 'class="visual" type="hidden" value="on"', $form );
-        $this->assertNotContains( 'class="visual" type="hidden" value=""', $form );
+        $this->assertContains( 'class="visual sync-input" type="hidden" value="on"', $form );
+        $this->assertContains( '&lt;code&gt;&amp;lt;strong&amp;gt;BOLD!', $form );
+        $this->assertNotContains( 'class="visual sync-input" type="hidden" value=""', $form );
+
+        remove_filter( 'user_can_richedit', '__return_true' );
+        add_filter( 'user_can_richedit', '__return_false' );
+        $instance = array(
+            'title' => 'Title',
+            'text' => 'Evil:</textarea><script>alert("XSS")</script>',
+            'filter' => true,
+            'visual' => true,
+        );
+        $this->assertFalse( $widget->is_legacy_instance( $instance ) );
+        ob_start();
+        $widget->form( $instance );
+        $form = ob_get_clean();
+        $this->assertNotContains( 'Evil:</textarea>', $form );
+        $this->assertContains( 'Evil:&lt;/textarea>', $form );
     }