Allow heading tags (h1-h6) in ContentSanitizer so news editor headings render

2026-06-04 07:52:57 +02:00
parent 0b33a1b074
commit 15870ddb1f
191 changed files with 15453 additions and 1786 deletions
--- a/tests/Feature/Uploads/UploadAutosaveTest.php
+++ b/tests/Feature/Uploads/UploadAutosaveTest.php
@@ -163,3 +163,16 @@ it('invalid category rejected', function () {

    $response->assertStatus(422)->assertJsonValidationErrors(['category_id']);
 });
+
+it('rejects autosave descriptions with raw html', function () {
+    Storage::fake('local');
+
+    $owner = User::factory()->create();
+    $uploadId = createDraftUploadForAutosave($owner->id);
+
+    $response = $this->actingAs($owner)->postJson("/api/uploads/{$uploadId}/autosave", [
+        'description' => '<img src="https://spam.example/test.jpg" alt="">',
+    ]);
+
+    $response->assertStatus(422)->assertJsonValidationErrors(['description']);
+});