Changeset 46915 for branches/5.0/tests/phpunit/tests/blocks/block-type.php

Timestamp:

12/12/2019 06:51:11 PM (6 years ago)

Author:

whyisjake

Message:

Ensure that a user can publish_posts before making a post sticky.
Props: danielbachhuber, whyisjake, peterwilson, xknown.
Prevent stored XSS through wp_targeted_link_rel().
Props: vortfu, whyisjake, peterwilsoncc, xknown, SergeyBiryukov, flaviozavan.
Update wp_kses_bad_protocol() to recognize : on uri attributes,
wp_kses_bad_protocol() makes sure to validate that uri attributes don't contain invalid/or not allowed protocols. While this works fine in most cases, there's a risk that by using the colon html5 named entity, one is able to bypass this function.
Brings r46895 to the 5.3 branch.
Props: xknown, nickdaugherty, peterwilsoncc.
Prevent stored XSS in the block editor.
Brings r46896 to the 5.3 branch.
Prevent escaped unicode characters become unescaped in unsafe HTML during JSON decoding.
Props: aduth, epiqueras.

Location:

branches/5.0

Files:

• . (modified) (1 prop)
• tests/phpunit/tests/blocks/block-type.php (modified) (1 diff)

branches/5.0/tests/phpunit/tests/blocks/block-type.php

@@ -303 +303 @@
         // even if it detects a proper $post global it should still be false for a missing block.
         $this->assertFalse( has_block( 'core/fake' ) );
+    }
+
+    public function test_post_has_block_serialized_name() {
+        $content = '<!-- wp:serialized /--><!-- wp:core/normalized /--><!-- wp:plugin/third-party /-->';
+
+        $this->assertTrue( has_block( 'core/serialized', $content ) );
+
+        /*
+         * Technically, `has_block` should receive a "full" (normalized, parsed)
+         * block name. But this test conforms to expected pre-5.3.1 behavior.
+         */
+        $this->assertTrue( has_block( 'serialized', $content ) );
+        $this->assertTrue( has_block( 'core/normalized', $content ) );
+        $this->assertTrue( has_block( 'normalized', $content ) );
+        $this->assertFalse( has_block( 'plugin/normalized', $content ) );
+        $this->assertFalse( has_block( 'plugin/serialized', $content ) );
+        $this->assertFalse( has_block( 'third-party', $content ) );
+        $this->assertFalse( has_block( 'core/third-party', $content ) );
     }