64 lines
2.2 KiB
PHP
64 lines
2.2 KiB
PHP
<?php
|
|
|
|
use Illuminate\Support\Facades\File;
|
|
|
|
/**
|
|
* R23 — confirmation happens in a modal, never in a native browser dialog.
|
|
*
|
|
* The operator console popped a real `window.confirm()` before saving a
|
|
* Stripe key — a system window with the hostname in it, no part of the
|
|
* interface this product draws, and not translatable beyond whatever
|
|
* language the browser happens to be in. `wire:confirm` is exactly that
|
|
* dialog with a Livewire attribute on it; a bare `confirm(` call from
|
|
* hand-written JavaScript is the same dialog under a different name. Both are
|
|
* forbidden repo-wide — the fix is the six confirm-* modals under
|
|
* app/Livewire and app/Livewire/Admin, not a one-off patch where it was
|
|
* first noticed.
|
|
*/
|
|
it('has no wire:confirm attribute anywhere in the repo', function () {
|
|
$offenders = [];
|
|
|
|
foreach (File::allFiles(resource_path('views')) as $file) {
|
|
if (! str_ends_with($file->getFilename(), '.blade.php')) {
|
|
continue;
|
|
}
|
|
|
|
if (str_contains($file->getContents(), 'wire:confirm')) {
|
|
$offenders[] = str_replace(base_path().'/', '', $file->getPathname());
|
|
}
|
|
}
|
|
|
|
expect($offenders)->toBe([]);
|
|
});
|
|
|
|
it('never calls the native confirm() dialog from JavaScript', function () {
|
|
$offenders = [];
|
|
|
|
// Blade views (inline <script> blocks) and the app's own JavaScript —
|
|
// not vendor/node_modules, which ship code this repo does not author.
|
|
$roots = [resource_path('views'), resource_path('js')];
|
|
|
|
foreach ($roots as $root) {
|
|
if (! File::isDirectory($root)) {
|
|
continue;
|
|
}
|
|
|
|
foreach (File::allFiles($root) as $file) {
|
|
$name = $file->getFilename();
|
|
|
|
if (! str_ends_with($name, '.blade.php') && ! str_ends_with($name, '.js')) {
|
|
continue;
|
|
}
|
|
|
|
// window.confirm(...) too: the word boundary catches both, and a
|
|
// PHP method like confirmPassword() has no "(" right after
|
|
// "confirm" so it never matches.
|
|
if (preg_match('/\bconfirm\s*\(/', $file->getContents()) === 1) {
|
|
$offenders[] = str_replace(base_path().'/', '', $file->getPathname());
|
|
}
|
|
}
|
|
}
|
|
|
|
expect($offenders)->toBe([]);
|
|
});
|