kate522/wordpress-theme-aksrt
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(admin): keep enum values in their declared type when sanitizing

Browse Source 
The 积分兑换明细.level radio declares its options as the integers 1 and 2, but sanitize_field_value() ran every radio value through sanitize_text_field(), so the sanitized payload held the string 1. validate() then compared with in_array(..., true) and rejected both default rows, which made the VIP payment section impossible to save.

Resolve enum values to the value declared by their option during sanitization, covering select, radio, palette and image_select. A value that matches no option still falls through to the previous string coercion, so invalid input keeps producing a precise validation error. This also keeps the stored type aligned with the schema, which the naive-ui radio group compares with === when it re-renders a saved setting.

Verified with an end-to-end sanitize, validate, write and read round-trip, and locked in with a contract test in the VIP structured-settings suite. The widget-system, admin, front-submit and navigation suites all pass (658 tests).
This commit is contained in:
kate522 committed 2026-10-18 19:45:57 +08:00
1 parent 4b5098a753
commit 064f4e0955
3 files changed
+127
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/widget-system/vip-settings-structured-harness.php
+53
View File
@@ -61,6 +61,7 @@ namespace {
require dirname(__DIR__, 2) . '/src/Ledger/AssetAmount.php';
require dirname(__DIR__, 2) . '/src/Settings/PaymentRuntime.php';
require dirname(__DIR__, 2) . '/src/Admin/Schema/SchemaPayment.php';
require dirname(__DIR__, 2) . '/src/Admin/SchemaProvider.php';
require dirname(__DIR__, 2) . '/src/Content/VipServicePackages.php';
/** Exposes the trait's private renew-pricing math for contract assertions. */
@@ -171,6 +172,57 @@ namespace {
];
$legacy = PaymentRuntime::get_payment_vip_settings();
// ---- sanitize -> validate round-trip -----------------------------------
// 复现并锁定：积分兑换明细.level 的选项值为整数，而 SPA 提交的可能是数字
// 或字符串；净化必须把值收敛回选项声明的类型，否则严格 in_array 校验会以
// "has an invalid value" 拒绝一次完全合法的保存。
$sanitize = (static function (): array {
$provider = \AKSRT\Admin\SchemaProvider::get_instance();
$cases = [
'default_rows' => [
'pay_vip_points_exchange_s' => true,
'pay_vip_points_exchange_product' => [
['points' => 500, 'level' => 1, 'time' => 30, 'unit' => 'day'],
['points' => 5000, 'level' => 1, 'time' => 'Permanent'],
],
],
'string_level' => [
'pay_vip_points_exchange_s' => true,
'pay_vip_points_exchange_product' => [
['points' => 800, 'level' => '2', 'time' => 3, 'unit' => 'month'],
],
],
'invalid_level' => [
'pay_vip_points_exchange_s' => true,
'pay_vip_points_exchange_product' => [
['points' => 500, 'level' => 9, 'time' => 30, 'unit' => 'day'],
],
],
'invalid_unit' => [
'pay_vip_points_exchange_s' => true,
'pay_vip_points_exchange_product' => [
['points' => 500, 'level' => 1, 'time' => 30, 'unit' => 'year'],
],
],
'invalid_tag_class' => [
'vip_1_product' => [
['price' => '88.80', 'show_price' => '99', 'tag' => 'x', 'tag_class' => 'nope', 'time' => 1, 'unit' => 'month'],
],
],
];
$out = [];
foreach ($cases as $name => $payload) {
$clean = $provider->sanitize_payload('payment', $payload, 'vip');
$result = $provider->validate('payment', $clean, 'vip');
$out[$name] = [
'points_rows' => $clean['pay_vip_points_exchange_product'] ?? null,
'valid' => $result['valid'],
'errors' => $result['errors'],
];
}
return $out;
})();
echo wp_json_encode([
'schema' => [
'version' => $vip['version'],
@@ -187,6 +239,7 @@ namespace {
'custom' => $custom,
'legacy' => $legacy,
],
'sanitize' => $sanitize,
'accordion' => (static function (array $groups): array {
$out = ['groups' => [], 'sections' => []];
foreach ($groups as $group) {