Skip to content

Commit 925d9c8

Browse files
dingo-ddingo-d
committed
Add additional test case
1 parent e7ace16 commit 925d9c8

File tree

2 files changed

+165
-0
lines changed

2 files changed

+165
-0
lines changed

‎Eightshift/Tests/Security/ComponentsEscapeUnitTest.5.inc‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
<?php
2+
3+
/**
4+
* Template for the Forms Block view.
5+
*
6+
* @package EightshiftForms
7+
*/
8+
9+
// phpcs:set Eightshift.Security.ComponentsEscape overriddenClass EightshiftForms\\Helpers\\Components
10+
11+
use EightshiftForms\AdminMenus\FormSettingsAdminSubMenu;
12+
use EightshiftForms\CustomPostType\Forms;
13+
use EightshiftForms\Geolocation\Geolocation;
14+
use EightshiftForms\Geolocation\SettingsGeolocation;
15+
use EightshiftForms\Helpers\Components;
16+
use EightshiftForms\Helpers\Helper;
17+
use EightshiftForms\Manifest\Manifest;
18+
use EightshiftForms\Settings\Settings\SettingsGeneral;
19+
20+
$manifest = Components::getManifest(__DIR__);
21+
$globalManifest = Components::getManifest(dirname(__DIR__, 2));
22+
$manifestInvalid = Components::getManifest(dirname(__DIR__, 2) . '/components/invalid');
23+
24+
if (!$this->isCheckboxOptionChecked(SettingsGeneral::SETTINGS_GENERAL_DISABLE_DEFAULT_ENQUEUE_SCRIPT_KEY, SettingsGeneral::SETTINGS_GENERAL_DISABLE_DEFAULT_ENQUEUE_KEY)) {
25+
echo Components::outputCssVariablesGlobal($globalManifest); // Bad.
26+
}
27+
28+
$blockClass = $attributes['blockClass'] ?? '';
29+
$invalidClass = $manifestInvalid['componentClass'] ?? '';
30+
31+
// Check formPost ID prop.
32+
$formsFormPostId = Components::checkAttr('formsFormPostId', $attributes, $manifest);
33+
$formsStyle = Components::checkAttr('formsStyle', $attributes, $manifest);
34+
$formsServerSideRender = Components::checkAttr('formsServerSideRender', $attributes, $manifest);
35+
$formsFormDataTypeSelector = Components::checkAttr('formsFormDataTypeSelector', $attributes, $manifest);
36+
$formsFormGeolocation = Components::checkAttr('formsFormGeolocation', $attributes, $manifest);
37+
$formsFormGeolocationAlternatives = Components::checkAttr('formsFormGeolocationAlternatives', $attributes, $manifest);
38+
39+
// Override form ID in case we use geolocation but use this feature only on frontend.
40+
if (!$formsServerSideRender) {
41+
$formsFormPostId = \apply_filters(Geolocation::GEOLOCATION_IS_USER_LOCATED, $formsFormPostId, $formsFormGeolocation, $formsFormGeolocationAlternatives);
42+
}
43+
44+
$formsClass = Components::classnames([
45+
Components::selector($blockClass, $blockClass),
46+
Components::selector($formsStyle, $blockClass, '', $formsStyle),
47+
$attributes['className'] ?? '',
48+
]);
49+
50+
// Return nothing if it is on frontend.
51+
if (!$formsServerSideRender && (!$formsFormPostId || get_post_status($formsFormPostId) !== 'publish')) {
52+
return;
53+
}
54+
55+
// Bailout if form post ID is missing.
56+
if ($formsServerSideRender) {
57+
// Missing form ID.
58+
if (!$formsFormPostId) {
59+
$formsClassNotSet = Components::selector($blockClass, $blockClass, '', 'not-set');
60+
?>
61+
<div class="<?php echo esc_attr($formsClass); ?> <?php echo esc_attr($formsClassNotSet); ?>">
62+
<img class="<?php echo esc_attr("{$blockClass}__image") ?>" src="<?php echo esc_url(\apply_filters(Manifest::MANIFEST_ITEM, 'cover.png')); ?>" />
63+
<div class="<?php echo esc_attr("{$blockClass}__text") ?>"><?php esc_html_e('Please select form to show from the blocks sidebar.', 'eightshift-forms'); ?></div>
64+
</div>
65+
<?php
66+
67+
return;
68+
}
69+
70+
// Not published or removed at somepoint.
71+
if (get_post_status($formsFormPostId) !== 'publish') {
72+
$formsClassNotPublished = Components::selector($blockClass, $invalidClass);
73+
?>
74+
<div class="<?php echo esc_attr($formsClass); ?> <?php echo esc_attr($formsClassNotPublished); ?>">
75+
<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
76+
<path d="M4.71991 1.60974C3.11997 2.29956 2 3.89096 2 5.74394C2 7.70327 3.25221 9.37013 5 9.98788V17C5 17.8284 5.67157 18.5 6.5 18.5C7.32843 18.5 8 17.8284 8 17V9.98788C9.74779 9.37013 11 7.70327 11 5.74394C11 3.78461 9.74779 2.11775 8 1.5V5.74394C8 6.57237 7.32843 7.24394 6.5 7.24394C5.67157 7.24394 5 6.57237 5 5.74394V1.5C4.90514 1.53353 4.81173 1.57015 4.71991 1.60974Z" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/>
77+
<path d="M13 13V16C13 17.3807 14.1193 18.5 15.5 18.5V18.5C16.8807 18.5 18 17.3807 18 16V13M13 13V10.5H14M13 13H18M18 13V10.5H17M14 10.5V5.5L13.5 3.5L14 1.5H17L17.5 3.5L17 5.5V10.5M14 10.5H17" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
78+
</svg>
79+
<br />
80+
<b><?php esc_html_e('Form cannot be found', 'eightshift-forms'); ?></b>
81+
<br />
82+
<?php esc_html_e('It might not be published yet or it\'s not available anymore.', 'eightshift-forms'); ?>
83+
</div>
84+
<?php
85+
86+
return;
87+
}
88+
}
89+
90+
?>
91+
92+
<div class="<?php echo esc_attr($formsClass); ?>">
93+
94+
<?php if (is_user_logged_in() && !is_admin()) { ?>
95+
<div class="<?php echo esc_attr("{$blockClass}__edit-wrap") ?>">
96+
<?php if (current_user_can(Forms::POST_CAPABILITY_TYPE)) { ?>
97+
<a class="<?php echo esc_attr("{$blockClass}__edit-link") ?>" href="<?php echo esc_url(Helper::getFormEditPageUrl($formsFormPostId)) ?>">
98+
<span class="<?php echo \esc_attr("{$blockClass}__edit-link-icon dashicons dashicons-edit"); ?> "></span>
99+
<?php esc_html_e('Edit form', 'eightshift-forms'); ?>
100+
</a>
101+
<?php } ?>
102+
103+
<?php if (current_user_can(FormSettingsAdminSubMenu::ADMIN_MENU_CAPABILITY)) { ?>
104+
<a class="<?php echo esc_attr("{$blockClass}__edit-link") ?>" href="<?php echo esc_url(Helper::getSettingsPageUrl($formsFormPostId)) ?>">
105+
<span class="<?php echo \esc_attr("{$blockClass}__edit-link-icon dashicons dashicons-admin-settings"); ?> "></span>
106+
<?php esc_html_e('Edit settings', 'eightshift-forms'); ?>
107+
</a>
108+
<?php } ?>
109+
</div>
110+
<?php } ?>
111+
112+
<?php
113+
// Convert blocks to array.
114+
$blocks = parse_blocks(get_the_content(null, false, $formsFormPostId));
115+
116+
// Bailout if it fails for some reason.
117+
if (!$blocks) {
118+
return;
119+
}
120+
121+
// Iterate blocks an children by passing them form ID.
122+
foreach ($blocks as $key => $block) {
123+
if ($block['blockName'] === $globalManifest['namespace'] . '/form-selector') {
124+
$blocks[$key]['attrs']['formSelectorFormPostId'] = $formsFormPostId;
125+
126+
if (isset($block['innerBlocks'])) {
127+
foreach ($block['innerBlocks'] as $innerKey => $innerBlock) {
128+
$blockName = Components::kebabToCamelCase(explode('/', $innerBlock['blockName'])[1]);
129+
$blocks[$key]['innerBlocks'][$innerKey]['attrs']["{$blockName}FormPostId"] = $formsFormPostId;
130+
$blocks[$key]['innerBlocks'][$innerKey]['attrs']["{$blockName}FormDataTypeSelector"] = $formsFormDataTypeSelector;
131+
$blocks[$key]['innerBlocks'][$innerKey]['attrs']["{$blockName}FormServerSideRender"] = $formsServerSideRender;
132+
133+
if (isset($innerBlock['innerBlocks'])) {
134+
foreach ($innerBlock['innerBlocks'] as $inKey => $inBlock) {
135+
$name = Components::kebabToCamelCase(explode('/', $inBlock['blockName'])[1]);
136+
137+
if ($name === 'submit') {
138+
$blocks[$key]['innerBlocks'][$innerKey]['innerBlocks'][$inKey]['attrs']["{$name}SubmitServerSideRender"] = $formsServerSideRender;
139+
}
140+
}
141+
}
142+
}
143+
}
144+
}
145+
}
146+
147+
// Render blocks.
148+
foreach ($blocks as $block) {
149+
echo \apply_filters('the_content', \render_block($block)); // Bad.
150+
echo Components::render( // Ok.
151+
'accordion',
152+
Components::props('accordion', $attributes, [
153+
'accordionContent' => $innerBlockContent
154+
])
155+
);
156+
}
157+
?>
158+
</div>
159+
160+
// phpcs:set Eightshift.Security.ComponentsEscape overriddenClass

‎Eightshift/Tests/Security/ComponentsEscapeUnitTest.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,11 @@ public function getErrorList($testFile = ''): array
5454
return [
5555
102 => 1,
5656
];
57+
case 'ComponentsEscapeUnitTest.5.inc':
58+
return [
59+
25 => 1,
60+
149 => 1,
61+
];
5762
default:
5863
return [];
5964
}

0 commit comments

Comments
 (0)