.
* - Plain multi-line text: each non-empty line becomes one
(only \n split).
@@ -497,21 +497,7 @@ if (!function_exists('aksrt_format_vip_equity_html')) {
return '';
}
- $allowed = [
- 'li' => ['class' => true],
- 'ul' => ['class' => true],
- 'ol' => ['class' => true],
- 'strong' => [],
- 'b' => [],
- 'em' => [],
- 'i' => ['class' => true],
- 'span' => ['class' => true],
- 'br' => [],
- 'p' => ['class' => true],
- 'div' => ['class' => true],
- 'a' => ['href' => true, 'target' => true, 'rel' => true, 'class' => true],
- ];
- $clean = trim(wp_kses($raw, $allowed));
+ $clean = trim(wp_kses_post($raw));
if ($clean === '') {
return '';
}
diff --git a/inc/helpers/user-center-renderers/sidebar-vip.php b/inc/helpers/user-center-renderers/sidebar-vip.php
index 43ec5176..b38cbd5f 100644
--- a/inc/helpers/user-center-renderers/sidebar-vip.php
+++ b/inc/helpers/user-center-renderers/sidebar-vip.php
@@ -29,7 +29,7 @@ if ($status === '') {
}
if ($vip_level > 0) {
- $title = (string) ($vip_levels[$vip_level]['name'] ?? ('VIP' . $vip_level));
+ $title = (string) ($vip_levels[$vip_level]['name_html'] ?? $vip_levels[$vip_level]['name'] ?? ('VIP' . $vip_level));
if ($expires <= 0 && ($vip_state['source'] ?? 'none') !== 'order') {
$status = __('永久会员', 'aksrt');
} else {
@@ -41,7 +41,7 @@ if ($vip_level > 0) {
);
}
} elseif ($expired_level > 0) {
- $title = (string) ($vip_levels[$expired_level]['name'] ?? ('VIP' . $expired_level));
+ $title = (string) ($vip_levels[$expired_level]['name_html'] ?? $vip_levels[$expired_level]['name'] ?? ('VIP' . $expired_level));
$status = __('已过期', 'aksrt');
}
@@ -55,8 +55,8 @@ $sidebar_arrow = aksrt_icon_markup('zibsvg-right', 'uc-sidebar-vip__arrow');
diff --git a/inc/helpers/user-center-renderers/vip-tab.php b/inc/helpers/user-center-renderers/vip-tab.php
index 2f62383d..ca22ca66 100644
--- a/inc/helpers/user-center-renderers/vip-tab.php
+++ b/inc/helpers/user-center-renderers/vip-tab.php
@@ -46,7 +46,7 @@ $btn_type = 'pay';
if ($level > 0) {
$vip_level_number = $level;
- $vip_level_name = (string) ($levels[$level]['name'] ?? ('VIP' . $level));
+ $vip_level_name = (string) ($levels[$level]['name_html'] ?? $levels[$level]['name'] ?? ('VIP' . $level));
$level_desc = (string) ($levels[$level]['desc'] ?? '');
$vip_description = $level_desc !== '' ? $level_desc : __('尊享专属特权', 'aksrt');
@@ -63,7 +63,7 @@ if ($level > 0) {
$vip_state_label = __('生效中', 'aksrt');
$vip_expiry_text = sprintf(__('到期时间：%s', 'aksrt'), wp_date('Y年m月d日', $expires));
if ($base_level > 0 && $base_level < $level) {
- $base_name = (string) ($levels[$base_level]['name'] ?? ('VIP' . $base_level));
+ $base_name = wp_strip_all_tags((string) ($levels[$base_level]['name'] ?? ('VIP' . $base_level)));
$base_expiry_text = $base_expires > 0
? wp_date('Y年m月d日', $base_expires)
: __('永久', 'aksrt');
@@ -75,7 +75,7 @@ if ($level > 0) {
$vip_state = 'expired';
$vip_state_label = __('已过期', 'aksrt');
$vip_level_number = $expired_level;
- $vip_level_name = (string) ($levels[$expired_level]['name'] ?? ('VIP' . $expired_level));
+ $vip_level_name = (string) ($levels[$expired_level]['name_html'] ?? $levels[$expired_level]['name'] ?? ('VIP' . $expired_level));
$expired_desc = (string) ($levels[$expired_level]['desc'] ?? '');
$vip_description = $expired_desc !== ''
? $expired_desc
@@ -97,9 +97,9 @@ $status_html = ''
. '
'
// 未开通（level 0）不输出图标位：名称前不放通用证书图标。
. ($vip_level_number > 0 ? '' . $status_icon . '' : '')
- . '' . esc_html($vip_level_name) . ''
+ . '' . wp_kses_post($vip_level_name) . ''
. '
'
- . '
' . esc_html($vip_description) . '
'
+ . '
' . wp_kses_post($vip_description) . '
'
. ($vip_expiry_text !== '' ? '
' . esc_html($vip_expiry_text) . '
' : '')
. '
';
$cards .= '
';
$cards .= '
';
- $cards .= '
' . $lv_icon . '' . esc_html($lv_name) . '
';
+ $cards .= '
' . $lv_icon . '' . wp_kses_post($lv_name) . '
';
if ($card_desc !== '') {
- $cards .= '
' . esc_html($card_desc) . '
';
+ $cards .= '
' . wp_kses_post($card_desc) . '
';
}
$cards .= '
';
$cards .= $equity;
$cards .= '
'
- . '' . esc_html($cta) . ''
+ . '' . $cta . ''
. ' ';
$cards .= '
购买后不支持退款
VIP权益仅适用于本站
欢迎与站长联系
', 'rows' => 4, 'dependsOn' => ['any' => [['key' => 'pay_user_vip_1_s', 'value' => true], ['key' => 'pay_user_vip_2_s', 'value' => true]]]],
]],
],
@@ -684,9 +684,9 @@ class SchemaPayment {
$dep = ['key' => 'pay_user_vip_' . $level . '_s', 'value' => true];
$equity = '全站资源折扣购买部分内容免费阅读一对一技术指导VIP用户专属QQ群';
return [
- ['key' => 'pay_user_vip_' . $level . '_name', 'label' => '会员显示名称', 'type' => 'input', 'default' => $level === 1 ? '黄金会员' : '钻石会员', 'dependsOn' => $dep, 'help' => '会员名称（例如“黄金会员”、“超级会员”）'],
- ['key' => 'pay_user_vip_' . $level . '_desc', 'label' => '一句话简介', 'type' => 'input', 'default' => '尊享专属特权', 'dependsOn' => $dep],
- ['key' => 'pay_user_vip_' . $level . '_equity', 'label' => '会员权益 HTML', 'type' => 'textarea', 'sanitize_type' => 'html', 'default' => $equity, 'rows' => 4, 'dependsOn' => $dep, 'help' => '建议使用
列表项'],
+ ['key' => 'pay_user_vip_' . $level . '_name', 'label' => '会员显示名称', 'type' => 'input', 'sanitize_type' => 'html', 'default' => $level === 1 ? '黄金会员' : '钻石会员', 'dependsOn' => $dep, 'help' => '会员名称，支持HTML'],
+ ['key' => 'pay_user_vip_' . $level . '_desc', 'label' => '一句话简介', 'type' => 'input', 'sanitize_type' => 'html', 'default' => '尊享专属特权', 'dependsOn' => $dep, 'help' => '支持HTML'],
+ ['key' => 'pay_user_vip_' . $level . '_equity', 'label' => '会员权益 HTML', 'type' => 'textarea', 'sanitize_type' => 'html', 'default' => $equity, 'rows' => 4, 'dependsOn' => $dep, 'help' => '支持安全HTML，建议使用 列表项'],
['key' => 'vip_' . $level . '_product_s', 'label' => '购买会员', 'type' => 'switch', 'default' => true, 'dependsOn' => $dep, 'help' => '关闭后则不能付费购买会员，但可通过积分兑换会员，请确保已开启积分以及积分兑换会员功能'],
[
'key' => 'vip_' . $level . '_product', 'label' => '会员商品', 'type' => 'group', 'max' => 8,
diff --git a/src/Content/VipServiceModal.php b/src/Content/VipServiceModal.php
index a9dd88df..ee809ce6 100644
--- a/src/Content/VipServiceModal.php
+++ b/src/Content/VipServiceModal.php
@@ -38,8 +38,9 @@ trait VipServiceModal {
: wp_kses_post($equity);
$level_view[] = [
'level' => $level,
- 'name' => (string) ($levels[$level]['name'] ?? ('VIP' . $level)),
- 'desc' => (string) ($levels[$level]['desc'] ?? ''),
+ 'name' => wp_kses_post((string) ($levels[$level]['name_html'] ?? $levels[$level]['name'] ?? ('VIP' . $level))),
+ 'name_text' => (string) ($levels[$level]['name'] ?? ('VIP' . $level)),
+ 'desc' => wp_kses_post((string) ($levels[$level]['desc'] ?? '')),
'equity' => $equity,
'img_icon' => esc_url_raw((string) ($levels[$level]['img_icon'] ?? '')),
];
@@ -221,10 +222,10 @@ trait VipServiceModal {
$duration = ($is_permanent || $pkg_time <= 0)
? esc_html__('永久', 'aksrt')
: (string) $pkg_time . '' . esc_html($pkg_unit === 'month' ? __('个月', 'aksrt') : __('天', 'aksrt')) . '';
- $level_name = (string) ($levels[$level]['name'] ?? ('VIP' . $level));
+ $level_name = (string) ($levels[$level]['name_html'] ?? $levels[$level]['name'] ?? ('VIP' . $level));
$cards .= ''
- . '
' . $this->points_exchange_card_icon($levels[$level] ?? []) . esc_html($level_name) . ''
+ . '
' . $this->points_exchange_card_icon($levels[$level] ?? []) . wp_kses_post($level_name) . ''
. '
'
. '
' . $duration . ''
. '
' . $points . '' . esc_html($currency) . ''
@@ -292,14 +293,14 @@ trait VipServiceModal {
* @param array
$level_settings 等级设置（含 name / img_icon）。
*/
private function points_exchange_card_icon(array $level_settings): string {
- $name = (string) ($level_settings['name'] ?? '');
+ $name_text = (string) ($level_settings['name'] ?? '');
$icon_url = (string) ($level_settings['img_icon'] ?? '');
if ($icon_url === '') {
return '';
}
return '';
+ . ' title="' . esc_attr($name_text) . '" alt="' . esc_attr($name_text) . '">';
}
/**
@@ -330,26 +331,27 @@ trait VipServiceModal {
if (empty($levels[$level]['enabled'])) {
return '';
}
- $name = (string) ($levels[$level]['name'] ?? ('VIP' . $level));
+ $name = wp_kses_post((string) ($levels[$level]['name_html'] ?? $levels[$level]['name'] ?? ('VIP' . $level)));
+ $name_text = (string) ($levels[$level]['name'] ?? ('VIP' . $level));
$equity = (string) ($levels[$level]['equity'] ?? '');
$cls = $user_id > 0 ? ' pay-vip' : ' signin-loader';
- $equity_html = $equity !== ''
- ? '' . wp_kses_post($equity) . '
'
- : '';
+ $equity_html = $equity !== '' && function_exists('aksrt_format_vip_equity_html')
+ ? aksrt_format_vip_equity_html($equity, 'mb10 relative')
+ : ($equity !== '' ? '' . wp_kses_post($equity) . '
' : '');
$icon_url = esc_url((string) ($levels[$level]['img_icon'] ?? ''));
$icon = $icon_url !== ''
- ? ''
+ ? ''
: '';
$html = '';
$html .= '
' . $icon . '
';
$html .= '
' . $icon . '
';
$html .= '
购买后不支持退款
VIP权益仅适用于本站
欢迎与站长联系
');
- $allowed_equity = [
- 'li' => [],
- 'ul' => [],
- 'ol' => [],
- 'strong' => [],
- 'b' => [],
- 'em' => [],
- 'i' => ['class' => true],
- 'span' => ['class' => true],
- 'br' => [],
- 'a' => ['href' => true, 'target' => true, 'rel' => true, 'class' => true],
- ];
return [
'enabled' => $enabled,
@@ -215,8 +207,9 @@ class PaymentRuntime {
1 => [
'enabled' => $vip1_enabled,
'name' => $name1,
- 'desc' => sanitize_text_field((string) ($settings['pay_user_vip_1_desc'] ?? __('尊享专属特权', 'aksrt'))),
- 'equity' => wp_kses((string) (($settings['pay_user_vip_1_equity'] ?? '') !== '' ? $settings['pay_user_vip_1_equity'] : '全站资源折扣购买部分内容免费阅读一对一技术指导VIP用户专属QQ群'), $allowed_equity),
+ 'name_html' => $name1_html,
+ 'desc' => wp_kses_post((string) ($settings['pay_user_vip_1_desc'] ?? __('尊享专属特权', 'aksrt'))),
+ 'equity' => wp_kses_post((string) (($settings['pay_user_vip_1_equity'] ?? '') !== '' ? $settings['pay_user_vip_1_equity'] : '全站资源折扣购买部分内容免费阅读一对一技术指导VIP用户专属QQ群')),
'img_icon' => self::get_vip_icon_url(1, (string) ($settings['vip_1_img_icon'] ?? '')),
'product_s' => !isset($settings['vip_1_product_s']) || !empty($settings['vip_1_product_s']),
'products' => self::normalize_vip_product_items($settings['vip_1_product'] ?? null, self::vip_product_defaults()),
@@ -226,8 +219,9 @@ class PaymentRuntime {
2 => [
'enabled' => $vip2_enabled,
'name' => $name2,
- 'desc' => sanitize_text_field((string) ($settings['pay_user_vip_2_desc'] ?? __('尊享专属特权', 'aksrt'))),
- 'equity' => wp_kses((string) (($settings['pay_user_vip_2_equity'] ?? '') !== '' ? $settings['pay_user_vip_2_equity'] : '全站资源折扣购买部分内容免费阅读一对一技术指导VIP用户专属QQ群'), $allowed_equity),
+ 'name_html' => $name2_html,
+ 'desc' => wp_kses_post((string) ($settings['pay_user_vip_2_desc'] ?? __('尊享专属特权', 'aksrt'))),
+ 'equity' => wp_kses_post((string) (($settings['pay_user_vip_2_equity'] ?? '') !== '' ? $settings['pay_user_vip_2_equity'] : '全站资源折扣购买部分内容免费阅读一对一技术指导VIP用户专属QQ群')),
'img_icon' => self::get_vip_icon_url(2, (string) ($settings['vip_2_img_icon'] ?? '')),
'product_s' => !isset($settings['vip_2_product_s']) || !empty($settings['vip_2_product_s']),
'products' => self::normalize_vip_product_items($settings['vip_2_product'] ?? null, self::vip_product_defaults()),
@@ -240,7 +234,7 @@ class PaymentRuntime {
],
'renew' => [
'enabled' => !isset($settings['vip_renew']) || !empty($settings['vip_renew']),
- 'desc' => sanitize_text_field((string) ($settings['vip_renew_desc'] ?? '立即续费会员，畅享VIP权益')),
+ 'desc' => wp_kses_post((string) ($settings['vip_renew_desc'] ?? '立即续费会员，畅享VIP权益')),
'price_type' => $renew_price_type,
'discount' => max(0.1, min(9.9, (float) ($settings['vip_renew_discount'] ?? 8))),
'reduce' => self::money_decimal($settings['vip_renew_reduce'] ?? '20.00', '20.00', 50000),
@@ -834,7 +828,7 @@ class PaymentRuntime {
return [
'enabled' => !isset($settings['vip_upgrade']) || !empty($settings['vip_upgrade']),
- 'desc' => sanitize_text_field((string) ($settings['vip_upgrade_desc'] ?? '升级VIP会员，享更多会员权益')),
+ 'desc' => wp_kses_post((string) ($settings['vip_upgrade_desc'] ?? '升级VIP会员，享更多会员权益')),
'month_to_month_s' => $switch($raw['month_to_month_s'] ?? null, true),
'unit_price' => $money($raw['unit_price'] ?? null, '10.00'),
'unit_tag' => $tag($raw['unit_tag'] ?? null, ' 站长推荐'),
diff --git a/tests/widget-system/page-display-contract.test.cjs b/tests/widget-system/page-display-contract.test.cjs
index 7e11554a..33485941 100644
--- a/tests/widget-system/page-display-contract.test.cjs
+++ b/tests/widget-system/page-display-contract.test.cjs
@@ -156,9 +156,8 @@ test('header VIP hover cards match the legacy markup and style contract', () =>
assert.match(vipCardRenderer, /]*>/)
assert.match(vipCardRenderer, /
/)
assert.match(vipCardRenderer, /
/)
- assert.match(vipCardRenderer, //)
+ assert.match(vipCardRenderer, /aksrt_format_vip_equity_html\(\$equity, 'mb10 relative'\)/)
assert.doesNotMatch(vipCardRenderer, /vip-name__(?:icon|label)/)
- assert.doesNotMatch(vipCardRenderer, /aksrt_format_vip_equity_html\(\$equity, 'mb10 relative'\)/)
assert.doesNotMatch(vipModalCss, /Header hover VIP cards/)
assert.doesNotMatch(vipModalCss, /\.navbar-vip-hover\.hover-show/)
diff --git a/tests/widget-system/vip-modal-copy-fields.test.cjs b/tests/widget-system/vip-modal-copy-fields.test.cjs
index bfd2feba..d724d5d7 100644
--- a/tests/widget-system/vip-modal-copy-fields.test.cjs
+++ b/tests/widget-system/vip-modal-copy-fields.test.cjs
@@ -52,7 +52,7 @@ test('弹窗文案字段更名为会员介绍/开通会员更多内容并改为
// 会员介绍为单行 input（zibll text「一句话简介」）；开通会员更多内容为 rows 4 的 HTML textarea。
assert.match(
vipSchemaJs,
- /key: 'pay_user_vip_desc',\s*\n\s*label: '会员介绍',\s*\n\s*type: 'input',\s*\n\s*default: '开通VIP会员，享受会员专属折扣以及多项特权'/
+ /key: 'pay_user_vip_desc',\s*\n\s*label: '会员介绍',\s*\n\s*type: 'input',\s*\n\s*sanitize_type: 'html',\s*\n\s*default: '开通VIP会员，享受会员专属折扣以及多项特权'/
);
assert.match(
vipSchemaJs,
@@ -60,7 +60,7 @@ test('弹窗文案字段更名为会员介绍/开通会员更多内容并改为
);
assert.match(
schemaPhp,
- /'key' => 'pay_user_vip_desc', 'label' => '会员介绍', 'type' => 'input', 'default' => '开通VIP会员，享受会员专属折扣以及多项特权'/
+ /'key' => 'pay_user_vip_desc', 'label' => '会员介绍', 'type' => 'input', 'sanitize_type' => 'html', 'default' => '开通VIP会员，享受会员专属折扣以及多项特权'/
);
assert.match(
schemaPhp,
@@ -141,7 +141,7 @@ test('文案默认值三处一致并对齐 zibll', () => {
assert.ok(schemaPhp.includes(`'default' => '${DESC_DEFAULT}'`));
assert.ok(schemaPhp.includes(`'default' => '${MORE_DEFAULT}'`));
// PaymentRuntime 运行时回退（get_all 不合并 schema 默认值，回退即实际默认值）。
- assert.ok(paymentRuntime.includes(`$desc = sanitize_text_field((string) ($settings['pay_user_vip_desc'] ?? __('${DESC_DEFAULT}', 'aksrt')))`));
+ assert.ok(paymentRuntime.includes(`$desc = wp_kses_post((string) ($settings['pay_user_vip_desc'] ?? __('${DESC_DEFAULT}', 'aksrt')))`));
assert.ok(paymentRuntime.includes(`$more = (string) ($settings['pay_user_vip_more'] ?? '${MORE_DEFAULT}')`));
assert.ok(paymentRuntime.includes("$name1 = __('黄金会员', 'aksrt');"));
assert.ok(paymentRuntime.includes("$name2 = __('钻石会员', 'aksrt');"));
@@ -154,19 +154,41 @@ test('文案默认值三处一致并对齐 zibll', () => {
}
});
-test('权益与卡密说明字段保存时保留 HTML', () => {
- // 权益字段已并入「会员购买选项」的等级 Tab，标签统一为「会员权益 HTML」。
- assert.ok(vipSchemaJs.includes("key: `pay_user_vip_${level}_equity`, label: '会员权益 HTML', type: 'textarea', sanitize_type: 'html'"));
- assert.ok(schemaPhp.includes("['key' => 'pay_user_vip_' . $level . '_equity', 'label' => '会员权益 HTML', 'type' => 'textarea', 'sanitize_type' => 'html'"));
- assert.ok(rechargeJs.includes("key: 'pay_vip_pass_charge_desc', label: '卡密兑换会员说明', type: 'textarea', sanitize_type: 'html'"));
- assert.ok(schemaPhp.includes("'key' => 'pay_vip_pass_charge_desc', 'label' => '卡密兑换会员说明', 'type' => 'textarea', 'sanitize_type' => 'html'"));
+test('会员等级名称、简介、续费和升级介绍都声明 HTML 净化', () => {
+ const levelFieldsJs = slice(vipSchemaJs, 'function vipLevelTabFields', 'export const vipSchema');
+ const levelFieldsPhp = slice(schemaPhp, 'private static function vip_level_tab_fields', 'private static function vip_product_defaults');
+ assert.match(levelFieldsJs, /pay_user_vip_\$\{level\}_name[^\n]*sanitize_type: 'html'/);
+ assert.match(levelFieldsJs, /pay_user_vip_\$\{level\}_desc[^\n]*sanitize_type: 'html'/);
+ assert.match(levelFieldsPhp, /pay_user_vip_' \. \$level \. '_name'[^\n]*'sanitize_type' => 'html'/);
+ assert.match(levelFieldsPhp, /pay_user_vip_' \. \$level \. '_desc'[^\n]*'sanitize_type' => 'html'/);
+ assert.match(vipSchemaJs, /key: 'vip_renew_desc',[\s\S]*?sanitize_type: 'html'/);
+ assert.match(schemaPhp, /'key' => 'vip_renew_desc'[^\n]*'sanitize_type' => 'html'/);
+ assert.match(vipSchemaJs, /key: 'vip_upgrade_desc',[^\n]*sanitize_type: 'html'/);
+ assert.match(schemaPhp, /'key' => 'vip_upgrade_desc'[^\n]*'sanitize_type' => 'html'/);
+ assert.match(vipSchemaJs, /key: 'pay_user_vip_desc',[\s\S]*?sanitize_type: 'html'/);
+ assert.match(schemaPhp, /'key' => 'pay_user_vip_desc'[^\n]*'sanitize_type' => 'html'/);
});
-test('会员介绍运行时按单行文本净化', () => {
- // 只收敛 VIP 设置函数：充值等其它设置的 $desc 与本文无关。
+test('权益和促销标签 HTML 通过安全净化及 HTML 渲染保留', () => {
const vipSettings = slice(paymentRuntime, 'public static function get_payment_vip_settings', 'public static function get_payment_revenue_settings');
- assert.ok(vipSettings.includes("$desc = sanitize_text_field((string) ($settings['pay_user_vip_desc']"));
- assert.ok(!vipSettings.includes('$desc = sanitize_textarea_field'));
+ assert.match(vipSettings, /'equity'\s*=> wp_kses_post\(/);
+ assert.doesNotMatch(vipSettings, /\$allowed_equity/);
+ const equityHelper = read('inc', 'helpers', 'aksrt-vip.php');
+ assert.match(equityHelper, /\$clean = trim\(wp_kses_post\(\$raw\)\)/);
+ assert.match(payVipJs, /if \(item\.discount_tag\) append\(product, htmlNode\(/);
+ assert.match(payVipJs, /append\(info, htmlNode\("div", "", levelInfo\.equity\)\)/);
+ assert.match(payVipJs, /htmlNode\("div", "v-name", levelInfo\.name \|\| group\.name/);
+ assert.match(payVipJs, /htmlNode\("div", "v-desc em09", levelInfo\.desc/);
+ assert.match(vipTabPhp, /wp_kses_post\(\$card_desc\)/);
+});
+
+test('会员介绍按 post 级 HTML 安全净化并在弹窗与用户中心渲染', () => {
+ const vipSettings = slice(paymentRuntime, 'public static function get_payment_vip_settings', 'public static function get_payment_revenue_settings');
+ assert.match(vipSettings, /\$desc = wp_kses_post\(\(string\) \(\$settings\['pay_user_vip_desc'\]/);
+ assert.match(vipSettings, /'desc'\s+=> wp_kses_post\(\(string\) \(\$settings\['pay_user_vip_1_desc'\]/);
+ assert.match(vipSettings, /'desc'\s+=> wp_kses_post\(\(string\) \(\$settings\['pay_user_vip_2_desc'\]/);
+ assert.match(vipTabPhp, /wp_kses_post\(\$vip_description\)/);
+ assert.match(payVipJs, /htmlNode\("div", "muted-2-color em09", catalog\.desc\)/);
});
test('开通会员更多内容只在弹窗内渲染，不裸露在用户中心页面', () => {
diff --git a/tests/widget-system/vip-settings-structured-contract.test.cjs b/tests/widget-system/vip-settings-structured-contract.test.cjs
index 01c0797a..5698cd44 100644
--- a/tests/widget-system/vip-settings-structured-contract.test.cjs
+++ b/tests/widget-system/vip-settings-structured-contract.test.cjs
@@ -307,9 +307,21 @@ test('积分兑换明细.level 枚举净化后仍能通过校验，非法值依
assert.strictEqual(sanitize.invalid_unit.valid, false);
assert.deepStrictEqual(sanitize.invalid_unit.errors, ['积分兑换明细[0].unit has an invalid value']);
+ // VIP's HTML-capable fields pass the schema save sanitizer intact.
+ assert.strictEqual(sanitize.vip_html.valid, true);
+ assert.strictEqual(sanitize.vip_html.fields.pay_user_vip_1_name, '会员');
+ assert.strictEqual(sanitize.vip_html.fields.pay_user_vip_1_desc, '简介');
+ assert.strictEqual(sanitize.vip_html.fields.pay_user_vip_1_equity, '权益
');
+ assert.strictEqual(sanitize.vip_html.fields.pay_user_vip_desc, '会员介绍');
+ assert.strictEqual(sanitize.vip_html.fields.vip_renew_desc, '续费');
+ assert.strictEqual(sanitize.vip_html.fields.vip_upgrade_desc, '升级');
+ assert.strictEqual(sanitize.vip_html.fields.vip_1_product[0].tag, '推荐');
+
// 字符串型枚举（palette）不受影响。
assert.strictEqual(sanitize.invalid_tag_class.valid, false);
assert.deepStrictEqual(sanitize.invalid_tag_class.errors, ['会员商品[0].tag_class has an invalid value']);
+
+
});
test('运行时归一化：默认值、价格净化、零价与非法行剔除', () => {
@@ -345,7 +357,12 @@ test('运行时归一化：默认值、价格净化、零价与非法行剔除',
// 自定义续费价格类型与折扣。
assert.strictEqual(custom.renew.price_type, 'customize');
assert.strictEqual(custom.renew.discount, 7.5);
- assert.strictEqual(custom.renew.desc, '续费有礼');
+ assert.strictEqual(custom.renew.desc, '续费有礼');
+ assert.strictEqual(custom.upgrade.desc, '升级王者');
+ assert.strictEqual(custom.levels['1'].name, '青铜会员');
+ assert.strictEqual(custom.levels['1'].name_html, '青铜会员');
+ assert.strictEqual(custom.levels['1'].desc, '专属权益');
+ assert.strictEqual(custom.levels['1'].equity, '一对一支持
');
assert.strictEqual(custom.levels['1'].renew_products[0].tag_class, 'b-red');
// 升级三块参数透传。
assert.strictEqual(custom.upgrade.unit_price, '12.50');
diff --git a/tests/widget-system/vip-settings-structured-harness.php b/tests/widget-system/vip-settings-structured-harness.php
index 0de00ada..ada3658e 100644
--- a/tests/widget-system/vip-settings-structured-harness.php
+++ b/tests/widget-system/vip-settings-structured-harness.php
@@ -23,6 +23,7 @@ namespace {
function sanitize_text_field($value): string { return trim(strip_tags((string) $value)); }
function sanitize_textarea_field($value): string { return trim((string) $value); }
function wp_kses_post($value): string { return (string) $value; }
+ function wp_strip_all_tags($value): string { return trim(strip_tags((string) $value)); }
function wp_kses($value, $allowed = null): string { return (string) $value; }
function trailingslashit($value): string { return rtrim((string) $value, '/\\') . '/'; }
function get_template_directory_uri(): string { return 'https://example.test/wp-content/themes/aksrt'; }
@@ -115,15 +116,17 @@ namespace {
Settings::$snapshot = [
'pay_user_vip_1_s' => true,
'pay_user_vip_2_s' => true,
- 'pay_user_vip_1_name' => '青铜会员',
- 'pay_user_vip_2_name' => '王者会员',
+ 'pay_user_vip_1_name' => '青铜会员',
+ 'pay_user_vip_2_name' => '王者会员',
+ 'pay_user_vip_1_desc' => '专属权益',
+ 'pay_user_vip_1_equity' => '一对一支持
',
'vip_renew' => true,
- 'vip_renew_desc' => '续费有礼',
+ 'vip_renew_desc' => '续费有礼',
'vip_renew_price_type' => 'customize',
'vip_renew_discount' => 7.5,
'vip_renew_reduce' => '15.00',
'vip_upgrade' => true,
- 'vip_upgrade_desc' => '升级王者',
+ 'vip_upgrade_desc' => '升级王者',
'vip_upgrade_product' => [
'month_to_month_s' => true,
'unit_price' => '12.50',
@@ -179,6 +182,17 @@ namespace {
$sanitize = (static function (): array {
$provider = \AKSRT\Admin\SchemaProvider::get_instance();
$cases = [
+ 'vip_html' => [
+ 'pay_user_vip_1_name' => '会员',
+ 'pay_user_vip_1_desc' => '简介',
+ 'pay_user_vip_1_equity' => '权益
',
+ 'pay_user_vip_desc' => '会员介绍',
+ 'vip_renew_desc' => '续费',
+ 'vip_upgrade_desc' => '升级',
+ 'vip_1_product' => [
+ ['price' => '88.80', 'show_price' => '99.00', 'tag' => '推荐', 'tag_class' => 'jb-yellow', 'time' => 1, 'unit' => 'month'],
+ ],
+ ],
'default_rows' => [
'pay_vip_points_exchange_s' => true,
'pay_vip_points_exchange_product' => [
@@ -215,6 +229,7 @@ namespace {
$clean = $provider->sanitize_payload('payment', $payload, 'vip');
$result = $provider->validate('payment', $clean, 'vip');
$out[$name] = [
+ 'fields' => $clean,
'points_rows' => $clean['pay_vip_points_exchange_product'] ?? null,
'valid' => $result['valid'],
'errors' => $result['errors'],