new updates

tests/Feature/BlockEditEncodingTest.php

@@ -2,6 +2,7 @@
 
 use Illuminate\Support\Facades\View;
 use Klevze\ControlPanel\Facades\ActiveLanguage;
+use Klevze\ControlPanel\Core\SecurityHelper;
 use cPad\Plugins\Blocks\Controllers\BlockController;
 
 it('renders decoded html in the block editor form', function () {
@@ -78,3 +79,13 @@ it('renders frontend language tabs in the block editor', function () {
     expect($html)->toContain('English');
     expect($html)->toContain('Slovenian');
 });
+
+it('preserves iframe query parameters while removing actual event attributes', function () {
+    $html = '<iframe src="https://player.mediadelivery.net/embed/641915/946cd284-5122-47b9-8817-831463b78829?autoplay=true&loop=true&muted=true&preload=true&responsive=true" onload="alert(1)"></iframe>';
+
+    $sanitized = SecurityHelper::sanitizeInput($html);
+
+    expect($sanitized)->toContain('responsive=true');
+    expect($sanitized)->not->toContain('resptrue');
+    expect($sanitized)->not->toContain('onload=');
+});

tests/Feature/ContactFormSubmissionTest.php

@@ -0,0 +1,69 @@
+<?php
+
+use App\Mail\ContactFormSubmission;
+use Carbon\Carbon;
+use Illuminate\Support\Facades\Mail;
+use function Pest\Laravel\post;
+
+afterEach(function () {
+    Carbon::setTestNow();
+});
+
+it('sends the contact form submission email and redirects to the localized thank-you page', function () {
+    Mail::fake();
+
+    Carbon::setTestNow('2026-05-21 12:00:00');
+
+    $this->withSession(['contact_form_started_at' => now()->subSeconds(10)->timestamp]);
+
+    post('/sl/contact', [
+        'name' => 'Gregor Test',
+        'email' => 'gregor@example.com',
+        'message' => "Hello from the website\nSecond line",
+        'website' => '',
+    ])->assertRedirect('/sl/thankyou');
+
+    Mail::assertSent(ContactFormSubmission::class, function (ContactFormSubmission $mail) {
+        return $mail->hasTo('office@aritmija.si')
+            && $mail->hasReplyTo('gregor@example.com')
+            && $mail->contactDetails['name'] === 'Gregor Test'
+            && $mail->contactDetails['email'] === 'gregor@example.com'
+            && $mail->contactDetails['message'] === "Hello from the website\nSecond line";
+    });
+});
+
+it('blocks submissions that arrive too quickly', function () {
+    Mail::fake();
+
+    Carbon::setTestNow('2026-05-21 12:00:00');
+
+    $this->withSession(['contact_form_started_at' => now()->timestamp]);
+
+    post('/sl/contact', [
+        'name' => 'Gregor Test',
+        'email' => 'gregor@example.com',
+        'message' => 'Fast bot message',
+        'website' => '',
+    ])
+        ->assertSessionHasErrors('form');
+
+    Mail::assertNothingSent();
+});
+
+it('blocks submissions that fill the honeypot field', function () {
+    Mail::fake();
+
+    Carbon::setTestNow('2026-05-21 12:00:00');
+
+    $this->withSession(['contact_form_started_at' => now()->subSeconds(10)->timestamp]);
+
+    post('/sl/contact', [
+        'name' => 'Gregor Test',
+        'email' => 'gregor@example.com',
+        'message' => 'Bot payload',
+        'website' => 'https://spam.example',
+    ])
+        ->assertSessionHasErrors('website');
+
+    Mail::assertNothingSent();
+});