| 1 |
<?php |
| 2 |
|
| 3 |
require __DIR__ . '/../Support/isolated-options.php'; |
| 4 |
|
| 5 |
sa_with_isolated_options(static function () { |
| 6 |
$key = SimpleAnalytics\SettingName::ONLOAD_CALLBACK; |
| 7 |
$hashKey = SimpleAnalytics\SettingName::ONLOAD_CALLBACK_HASH; |
| 8 |
$script = new SimpleAnalytics\Scripts\AnalyticsScript(); |
| 9 |
|
| 10 |
delete_option($hashKey); |
| 11 |
update_option($key, 'legacyCallback()'); |
| 12 |
sa_assert(! isset($script->attributes()['onload']), 'Unverified legacy text must remain inert.'); |
| 13 |
|
| 14 |
$admin = get_user_by('login', 'admin'); |
| 15 |
sa_assert($admin !== false, 'The wp-env admin user must exist.'); |
| 16 |
wp_set_current_user($admin->ID); |
| 17 |
$field = new SimpleAnalytics\Settings\Blocks\Fields\Input($key, 'Onload Callback'); |
| 18 |
register_setting('simpleanalytics-advanced', $key, ['sanitize_callback' => $field->getValueSanitizer()]); |
| 19 |
update_option($key, 'authorizedCallback()'); |
| 20 |
sa_assert(($script->attributes()['onload'] ?? null) === 'authorizedCallback()', 'Authorized saves must enable the callback.'); |
| 21 |
|
| 22 |
// Simulate a multisite administrator (or DISALLOW_UNFILTERED_HTML) through |
| 23 |
// WordPress's real capability mapping, without changing any user records. |
| 24 |
$deny = static function ($caps, $cap) { return $cap === 'unfiltered_html' ? ['do_not_allow'] : $caps; }; |
| 25 |
add_filter('map_meta_cap', $deny, 10, 2); |
| 26 |
$hash = get_option($hashKey); |
| 27 |
update_option($key, 'unauthorizedCallback()'); |
| 28 |
sa_assert(get_option($key) === 'authorizedCallback()', 'Users without unfiltered_html must not replace the callback.'); |
| 29 |
sa_assert(get_option($hashKey) === $hash, 'Unauthorized saves must not change the recorded hash.'); |
| 30 |
remove_filter('map_meta_cap', $deny, 10); |
| 31 |
|
| 32 |
remove_filter('sanitize_option_' . $key, $field->getValueSanitizer()); |
| 33 |
update_option($key, 'changedOutsideSettings()'); |
| 34 |
sa_assert(! isset($script->attributes()['onload']), 'Code that differs from the verified value must remain inert.'); |
| 35 |
register_setting('simpleanalytics-advanced', $key, ['sanitize_callback' => $field->getValueSanitizer()]); |
| 36 |
update_option($key, ''); |
| 37 |
sa_assert(! isset($script->attributes()['onload']), 'Clearing the callback must remove the handler.'); |
| 38 |
}); |
| 39 |
|
