PluginProbe
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot / 4.9.5
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot v4.9.5
4.9.5 4.9.4 4.9.3 4.9.2 4.9.1 4.9.0 4.8.2 4.8.1 4.8.0 4.7.0 4.6.2 4.6.1 4.6.0 4.5.6 4.5.5 4.5.4 4.5.3 4.5.2 4.5.1 4.5.0 4.4.1 4.4.0 3.3.4 3.4.0 3.4.1 All 203 releases
← All changes | includes/Core/Admin.php +600 -73 4.5.4 → 4.9.5 View file →
@@ -1,8 +1,12 @@
1 1 <?php
2 +namespace WPDeveloper\BetterDocs\Core;
2 3
3 -namespace WPDeveloper\BetterDocs\Core;
4 +if ( ! defined( 'ABSPATH' ) ) {
5 + exit;
6 +}
4 7
8 +
5 9 use Exception;
6 10 use PriyoMukul\WPNotice\Notices;
7 11 use WPDeveloper\BetterDocs\Admin\NoticePointers;
8 12 use WPDeveloper\BetterDocs\Utils\Base;
@@ -8,9 +12,9 @@
8 12 use WPDeveloper\BetterDocs\Utils\Base;
9 13 use PriyoMukul\WPNotice\Utils\CacheBank;
10 14 use WPDeveloper\BetterDocs\Utils\Helper;
11 15 use WPDeveloper\BetterDocs\Utils\Enqueue;
12 -use WPDeveloper\BetterDocs\Utils\Insights;
16 +use WPDeveloper\BetterDocs\Insights\Insights;
13 17 use PriyoMukul\WPNotice\Utils\NoticeRemover;
14 18 use WPDeveloper\BetterDocs\Core\PluginInstaller;
15 19 use WPDeveloper\BetterDocs\Dependencies\DI\Container;
16 20
@@ -15,8 +19,42 @@
15 19 use WPDeveloper\BetterDocs\Dependencies\DI\Container;
16 20
17 21 class Admin extends Base {
18 22 /**
23 + * Per-user flag recording that this administrator has opened the Content IQ
24 + * screen — the discovery badge (ADR-063) now flags Content Intelligence, the
25 + * headline feature, rather than MCP.
26 + *
27 + * Stores the timestamp of the first visit, but only its **presence** is read:
28 + * absent means "this user has not seen Content IQ yet", which is what puts the
29 + * one-time discovery badge on the menu. Per user on purpose — two administrators
30 + * each get their own first look, and neither clears the other's. A deliberately
31 + * fresh meta key (not the old `betterdocs_mcp_seen`) so a user who already
32 + * dismissed the MCP badge still gets this one for the new feature.
33 + *
34 + * The private `*_mcp_*` helper names below are kept as-is to hold the diff to
35 + * the target slug + this key; they now paint the Content IQ item.
36 + *
37 + * @var string
38 + * @since 4.9.0
39 + */
40 + const MCP_SEEN_META = 'betterdocs_content_iq_seen';
41 +
42 + /**
43 + * Whether this request painted the MCP discovery badge onto the menu.
44 + *
45 + * Decided once in `menus()` (on `admin_menu`) and read again in
46 + * `mcp_badge_styles()` (on `admin_head`), rather than re-deciding, because the
47 + * two must agree: on the request that opens the MCP screen the badge is still
48 + * painted while the meta is already written, and re-deciding at `admin_head`
49 + * would leave that one painted pill unstyled.
50 + *
51 + * @var bool
52 + * @since 4.9.0
53 + */
54 + private $mcp_badge = false;
55 +
56 + /**
19 57 * @var CacheBank
20 58 */
21 59 private static $cache_bank;
22 60 /**
@@ -68,9 +106,8 @@
68 106 *
69 107 * @var FAQBuilder
70 108 */
71 109 private $faq_builder;
72 - private $glossaries;
73 110
74 111 public function __construct( Container $container, PostType $type, Enqueue $assets, Settings $settings, KBMigration $kbmigration ) {
75 112 $this->container = $container;
76 113 $this->assets = $assets;
@@ -84,10 +121,19 @@
84 121 $type->init();
85 122 $type->admin_init();
86 123
87 124 $this->faq_builder = $this->container->get( FAQBuilder::class );
88 - $this->glossaries = $this->container->get( Glossaries::class );
89 125
126 + /**
127 + * Register usage tracking (including the daily `put_do_weekly_action` cron
128 + * handler) on every request — WP-Cron runs with is_admin() === false, so
129 + * this MUST sit above the admin guard or the cron send never fires. The
130 + * admin-only UI hooks inside Insights::init() (deactivation form, footer
131 + * scripts, plugin_action_links) are context-specific and simply never run
132 + * outside wp-admin.
133 + */
134 + $this->plugin_insights();
135 +
90 136 if ( ! is_admin() ) {
91 137 return;
92 138 }
93 139
@@ -92,16 +138,32 @@
92 138 }
93 139
94 140 $this->installer = new PluginInstaller();
95 141
96 - $this->plugin_insights();
97 142 add_action( 'admin_notices', array( $this, 'compatibility_notices' ) );
143 + // The WPNotice CacheBank wipes all admin_notices at priority 10 on BetterDocs
144 + // screens, so the hook above never renders inside the BetterDocs panels.
145 + // Re-add the compatibility notice after that wipe (in_admin_header, priority
146 + // 999) so it shows on the panels like the review / license notices.
147 + add_action( 'in_admin_header', function () {
148 + $screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
149 + if ( $screen && betterdocs()->is_betterdocs_screen( $screen->id ) ) {
150 + add_action( 'admin_notices', array( $this, 'compatibility_notices' ) );
151 + }
152 + }, 999 );
98 153 // add_action( 'admin_init', [$this, 'notices'], 9 );
99 154 add_filter( 'admin_init', array( $this, 'save_admin_page' ), 99 );
100 155
101 156 add_action( 'admin_menu', array( $this, 'menus' ) );
157 + // The badge's clear runs on `admin_init` — a hook that fires for every
158 + // admin request — and identifies the screen by its page slug, rather
159 + // than on `load-{$hook_suffix}` (ADR-065). `admin_init` fires *after*
160 + // `admin_menu`, measured on the rig, so the badge is still painted on
161 + // the request that opens the screen exactly as before.
162 + add_action( 'admin_init', array( $this, 'mark_mcp_seen' ) );
102 163 add_action( 'admin_menu', array( $this, 'reset_submenu' ) );
103 164 add_action( 'admin_head', array( $this, 'add_custom_classes_to_menu_items' ) );
165 + add_action( 'admin_head', array( $this, 'mcp_badge_styles' ) );
104 166 add_filter( 'plugin_action_links_' . BETTERDOCS_PLUGIN_BASENAME, array( $this, 'insert_plugin_links' ) );
105 167
106 168 // $this->container->get( SetupWizard::class )->init();
107 169
@@ -113,8 +175,10 @@
113 175 add_filter( 'admin_body_class', array( $this, 'body_classes' ) );
114 176 add_filter( 'parent_file', array( $type, 'highlight_admin_menu' ) );
115 177 add_filter( 'submenu_file', array( $type, 'highlight_admin_submenu' ), 10, 2 );
116 178 add_filter( 'betterdocs_admin_menu', array( $this, 'quick_setup_menu' ), 10, 1 );
179 + // Runs last so it also orders items Pro/add-ons append through this filter.
180 + add_filter( 'betterdocs_admin_menu', array( $this, 'order_admin_menu' ), 999, 1 );
117 181
118 182 /**
119 183 * Remove Comments Column from List Table.
120 184 */
@@ -236,9 +300,11 @@
236 300 if ( betterdocs()->is_pro_active() ) {
237 301 $plugins = Helper::get_plugins();
238 302 $plugin_data = $plugins['betterdocs-pro/betterdocs-pro.php'];
239 303
240 - if ( isset( $plugin_data['Version'] ) && version_compare( $plugin_data['Version'], '2.5.0', '>=' ) ) {
304 + // Require the paired Pro release: the Analytics UI is version-coupled to
305 + // Pro's advanced modules, so an older Pro renders a broken/partial panel.
306 + if ( isset( $plugin_data['Version'] ) && version_compare( $plugin_data['Version'], '4.0.0', '>=' ) ) {
241 307 return;
242 308 }
243 309
244 310 betterdocs()->views->get( 'admin/notices/compatibility', array( 'version' => $plugin_data['Version'] ) );
@@ -417,8 +483,26 @@
417 483 )
418 484 );
419 485 }
420 486
487 + // BetterDocs' own admin screens. Promotional notices are limited to these
488 + // (WP.org guideline 11), never the whole of wp-admin.
489 + $betterdocs_screens = array(
490 + 'toplevel_page_betterdocs-dashboard',
491 + 'admin_page_betterdocs-admin',
492 + 'betterdocs_page_betterdocs-admin',
493 + 'betterdocs_page_betterdocs-settings',
494 + 'betterdocs_page_betterdocs-faq',
495 + 'betterdocs_page_betterdocs-analytics',
496 + 'betterdocs_page_betterdocs-glossaries',
497 + 'betterdocs_page_betterdocs-ai-chatbot',
498 + 'betterdocs_page_betterdocs-api-docs',
499 + 'betterdocs_page_betterdocs-doc-categories',
500 + 'betterdocs_page_betterdocs-doc-tags',
501 + 'edit-doc_category',
502 + 'edit-doc_tag',
503 + );
504 +
421 505 $summer_campaign_message = '<div class="betterdocs-summer-notice-body"><p style="margin-top: 0; margin-bottom: 0;">🏖️ <strong>Summer Savings:</strong> Build AI-powered Knowledge Bases & FAQs to cut support tickets and improve user experience – now <strong>up to $100 OFF!</strong></p></div>';
422 506 $_summer_campaign_notice = array(
423 507 'thumbnail' => $this->assets->icon( 'betterdocs-logo.svg', true ),
424 508 'html' => $summer_campaign_message,
@@ -433,10 +517,11 @@
433 517 ),
434 518 'maybe_later' => array(
435 519 'label' => __( 'I’ll Grab It Later', 'betterdocs' ),
436 520 'attributes' => array(
437 - 'target' => '_blank',
438 - 'data-later' => true,
521 + 'target' => '_blank',
522 + // A promo dismissal is permanent: no 15-day re-show.
523 + 'data-dismiss' => true,
439 524 'class' => 'dismiss-btn',
440 525 ),
441 526 ),
442 527 ),
@@ -448,11 +533,11 @@
448 533 array(
449 534 'start' => $notices->time(),
450 535 'recurrence' => false,
451 536 'dismissible' => true,
452 - 'refresh' => BETTERDOCS_VERSION,
453 537 'expire' => strtotime( '11:59:59pm June 25, 2026' ),
454 538 'display_if' => ! is_plugin_active( 'betterdocs-pro/betterdocs-pro.php' ),
539 + 'screens' => $betterdocs_screens,
455 540 )
456 541 );
457 542
458 543 self::$cache_bank->create_account( $notices );
@@ -458,20 +543,9 @@
458 543 self::$cache_bank->create_account( $notices );
459 544 self::$cache_bank->calculate_deposits( $notices );
460 545 if ( method_exists( self::$cache_bank, 'clear_notices_in_' ) ) {
461 546 self::$cache_bank->clear_notices_in_(
462 - array(
463 - 'toplevel_page_betterdocs-dashboard',
464 - 'admin_page_betterdocs-admin',
465 - 'betterdocs_page_betterdocs-admin',
466 - 'betterdocs_page_betterdocs-settings',
467 - 'betterdocs_page_betterdocs-faq',
468 - 'betterdocs_page_betterdocs-analytics',
469 - 'betterdocs_page_betterdocs-glossaries',
470 - 'betterdocs_page_betterdocs-ai-chatbot',
471 - 'edit-doc_category',
472 - 'edit-doc_tag',
473 - ),
547 + $betterdocs_screens,
474 548 $notices,
475 549 true
476 550 );
477 551 }
@@ -476,31 +550,93 @@
476 550 );
477 551 }
478 552 }
479 553
554 + /**
555 + * Resolve the admin dark-mode preference.
556 + *
557 + * The mode switcher stores the choice in a client cookie (no DB write, shared
558 + * across every admin screen). Fall back to the legacy
559 + * `betterdocs_settings['dark_mode']` value for installs that set it before this
560 + * change and haven't toggled since.
561 + *
562 + * @return bool
563 + */
564 + public function is_dark_mode() {
565 + if ( isset( $_COOKIE['betterdocs_admin_dark_mode'] ) ) {
566 + return '1' === $_COOKIE['betterdocs_admin_dark_mode']; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
567 + }
568 +
569 + $saved = get_option( 'betterdocs_settings', array() );
570 + return ! empty( $saved['dark_mode'] );
571 + }
572 +
573 + /**
574 + * Whether the knowledge base is genuinely empty (no doc categories and no
575 + * non-trash docs). Localized to the admin so the All Docs panel can render a
576 + * skeleton shaped like the "No Category Found" empty card on first paint —
577 + * instead of a category/docs skeleton it would immediately replace — without
578 + * waiting for the REST fetch to reveal the count.
579 + *
580 + * @return bool
581 + */
582 + public function kb_is_empty() {
583 + $cats = wp_count_terms( array( 'taxonomy' => 'doc_category', 'hide_empty' => false ) );
584 + $cats = is_wp_error( $cats ) ? 0 : (int) $cats;
585 + if ( $cats > 0 ) {
586 + return false;
587 + }
588 +
589 + $counts = (array) wp_count_posts( 'docs' );
590 + $total = 0;
591 + foreach ( array( 'publish', 'future', 'draft', 'pending', 'private' ) as $status ) {
592 + $total += isset( $counts[ $status ] ) ? (int) $counts[ $status ] : 0;
593 + }
594 +
595 + return 0 === $total;
596 + }
597 +
480 598 public function body_classes( $classes ) {
481 - $saved_settings = get_option( 'betterdocs_settings', false );
482 - $dark_mode = isset( $saved_settings['dark_mode'] ) ? $saved_settings['dark_mode'] : false;
483 - $dark_mode = ! empty( $dark_mode ) ? boolval( $dark_mode ) : false;
599 + $dark_mode = $this->is_dark_mode();
484 600 $current_screen_id = get_current_screen() != null ? str_replace( 'betterdocs_page_', '', str_replace( 'toplevel_page_', '', str_replace( 'admin_page_', '', get_current_screen()->id ) ) ) : '';
485 - $registered_screens = array(
601 + /**
602 + * Filter the list of (prefix-stripped) screen ids that receive the
603 + * `betterdocs-admin` body class (and dark-mode class). Pro/add-ons can
604 + * register their own React admin pages, e.g. the Knowledge Base page.
605 + *
606 + * @param string[] $registered_screens Screen ids with the page prefix removed.
607 + */
608 + $registered_screens = apply_filters( 'betterdocs_admin_screen_slugs', array(
486 609 'betterdocs-settings',
487 610 'betterdocs-admin',
488 611 'betterdocs-dashboard',
489 612 'betterdocs-analytics',
613 + 'betterdocs-content-iq',
490 614 'betterdocs-glossaries',
491 615 'betterdocs-faq',
616 + 'betterdocs-doc-categories',
617 + 'betterdocs-doc-tags',
492 618 'edit-doc_category',
493 619 'edit-doc_tag',
494 620 'edit-knowledge_base',
495 621 'betterdocs-ai-chatbot',
496 - );
622 + 'betterdocs-api-docs',
623 + // Without this the MCP screen never receives `betterdocs-admin`, and
624 + // the design tokens' dark-mode overrides — which are declared on
625 + // `.betterdocs-admin.betterdocs-dark-mode` — can never apply there:
626 + // the switcher in the header flips the cookie and the page stays
627 + // light. @since 4.9.0
628 + 'betterdocs-mcp',
629 + ) );
497 630
498 631 if ( in_array( $current_screen_id, $registered_screens ) ) {
499 632 $classes .= ' betterdocs-admin ';
500 633 }
501 634
502 - if ( true === $dark_mode && in_array( $current_screen_id, $registered_screens ) ) {
635 + // Dark mode also applies on the Quick Setup wizard, whose self-scoped chrome
636 + // keys off `.betterdocs_page_betterdocs-setup.betterdocs-dark-mode`.
637 + $dark_screens = array_merge( $registered_screens, array( 'betterdocs-setup' ) );
638 + if ( $dark_mode && in_array( $current_screen_id, $dark_screens, true ) ) {
503 639 $classes .= ' betterdocs-dark-mode ';
504 640 }
505 641
506 642 return $classes;
@@ -531,9 +667,9 @@
531 667 public function manage_custom_columns( $column, $post_id ) {
532 668 global $wpdb;
533 669 switch ( $column ) {
534 670 case 'betterdocs_word_count':
535 - $content_without_html_tags = trim( strip_tags( get_post_field( 'post_content', $post_id ) ) );
671 + $content_without_html_tags = trim( wp_strip_all_tags( get_post_field( 'post_content', $post_id ) ) );
536 672 preg_match_all( '/<[^>]*>|[\p{L}\p{M}]+/u', $content_without_html_tags, $matches );
537 673 $total_words = ! empty( $matches[0] ) ? count( $matches[0] ) : count( array() );
538 674 $word_count = $total_words;
539 675 echo '<span>' . esc_html( intval( $word_count ) ) . '</span>';
@@ -538,19 +674,22 @@
538 674 $word_count = $total_words;
539 675 echo '<span>' . esc_html( intval( $word_count ) ) . '</span>';
540 676 break;
541 677 case 'betterdocs_reaction':
542 - $where = "WHERE post_id='" . esc_sql( $post_id ) . "'";
678 + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- per-post analytics aggregation rendered in admin list table; cache would mask live reactions.
543 679 $analytics = $wpdb->get_results(
544 - "SELECT
545 - sum(impressions) as totalViews,
546 - sum(unique_visit) as totalUniqueViews,
547 - sum(happy + sad + normal) as totalReactions,
548 - sum(happy) as totalHappy,
549 - sum(normal) as totalNormal,
550 - sum(sad) as totalSad
551 - FROM {$wpdb->prefix}betterdocs_analytics
552 - $where"
680 + $wpdb->prepare(
681 + "SELECT
682 + sum(impressions) as totalViews,
683 + sum(unique_visit) as totalUniqueViews,
684 + sum(happy + sad + normal) as totalReactions,
685 + sum(happy) as totalHappy,
686 + sum(normal) as totalNormal,
687 + sum(sad) as totalSad
688 + FROM {$wpdb->prefix}betterdocs_analytics
689 + WHERE post_id = %d",
690 + $post_id
691 + )
553 692 );
554 693
555 694 echo '<ul class="reactions-count">
556 695 <li>
@@ -632,9 +771,48 @@
632 771 * @return void
633 772 * @since 1.0.0
634 773 */
635 774 public function scripts( $hook ) {
636 - if ( ( 'edit.php' === $hook ) && get_post_type() == 'docs' ) {
775 + // Classic-UI screens that should offer a "Switch to BetterDocs UI"
776 + // button: All Docs, FAQ list, FAQ groups, Product FAQ groups,
777 + // Doc Categories, Doc Tags. Maps each to the React admin page to
778 + // return to; $switch_args carries extra query args (e.g. the FAQ
779 + // Builder tab) appended to the React page URL.
780 + $switch_page = '';
781 + $switch_args = array();
782 + if ( 'edit.php' === $hook && 'docs' === get_post_type() ) {
783 + $switch_page = 'betterdocs-admin';
784 + } elseif ( 'edit.php' === $hook && 'betterdocs_faq' === get_post_type() ) {
785 + $switch_page = 'betterdocs-faq';
786 + } elseif ( 'edit-tags.php' === $hook ) {
787 + $screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
788 + $taxonomy = $screen && ! empty( $screen->taxonomy )
789 + ? $screen->taxonomy
790 + : ( isset( $_GET['taxonomy'] ) ? sanitize_key( wp_unslash( $_GET['taxonomy'] ) ) : '' ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
791 + if ( 'betterdocs_faq_category' === $taxonomy ) {
792 + $switch_page = 'betterdocs-faq';
793 + } elseif ( 'betterdocs_product_faq_category' === $taxonomy ) {
794 + // Product FAQ groups live on the FAQ Builder's WooCommerce tab.
795 + $switch_page = 'betterdocs-faq';
796 + $switch_args = array( 'faq_tab' => 'woocommerce' );
797 + } elseif ( 'doc_category' === $taxonomy ) {
798 + $switch_page = 'betterdocs-doc-categories';
799 + } elseif ( 'doc_tag' === $taxonomy ) {
800 + $switch_page = 'betterdocs-doc-tags';
801 + }
802 + }
803 +
804 + /**
805 + * Allow Pro/add-ons to map their own classic-UI taxonomy screens to a
806 + * React admin page for the "Switch to BetterDocs UI" button — e.g. the
807 + * Knowledge Base taxonomy, which only exists when Pro is active.
808 + *
809 + * @param string $switch_page React page slug, or '' for no switcher.
810 + * @param string $hook Current admin page hook.
811 + */
812 + $switch_page = apply_filters( 'betterdocs_classic_switch_page', $switch_page, $hook );
813 +
814 + if ( $switch_page ) {
637 815 $this->assets->enqueue(
638 816 'betterdocs-switcher',
639 817 'admin/js/switcher.js',
640 818 array(
@@ -646,8 +824,13 @@
646 824 'betterdocs-switcher',
647 825 'betterdocsSwitcher',
648 826 array(
649 827 'menu_title' => __( 'Switch to BetterDocs UI', 'betterdocs' ),
828 + 'page' => $switch_page,
829 + 'url' => add_query_arg(
830 + array_merge( array( 'page' => $switch_page ), $switch_args ),
831 + admin_url( 'admin.php' )
832 + ),
650 833 'site_address' => get_bloginfo( 'url' ),
651 834 'betterdocs_pro_plugin' => betterdocs()->is_pro_active(),
652 835 'betterdocs_pro_version' => betterdocs()->pro_version(),
653 836 )
@@ -665,10 +848,9 @@
665 848 wp_enqueue_media(); // load early to fix problems with media upload issues on settings for WordPress 6.0.9
666 849 $this->assets->register( 'betterdocs-admin', 'admin/js/dashboard.js' );
667 850
668 851 $saved_settings = get_option( 'betterdocs_settings', false );
669 - $dark_mode = $saved_settings['dark_mode'] ?? false;
670 - $dark_mode = ! empty( $dark_mode ) && boolval( $dark_mode );
852 + $dark_mode = $this->is_dark_mode();
671 853 $this->assets->localize(
672 854 'betterdocs-admin',
673 855 'betterdocs_admin',
674 856 array(
@@ -674,12 +856,13 @@
674 856 array(
675 857 'ajaxurl' => admin_url( 'admin-ajax.php' ),
676 858 'doc_cat_order_nonce' => wp_create_nonce( 'doc_cat_order_nonce' ),
677 859 'knowledge_base_order_nonce' => wp_create_nonce( 'knowledge_base_order_nonce' ),
678 - 'paged' => isset( $_GET['paged'] ) ? absint( wp_unslash( $_GET['paged'] ) ) : 0, // phpcs:ignore WordPress.Security.NonceVerification.Missing
860 + 'paged' => isset( $_GET['paged'] ) ? absint( wp_unslash( $_GET['paged'] ) ) : 0, // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- pagination read from URL.
679 861 'per_page_id' => 'edit_doc_category_per_page',
680 862 'menu_title' => __( 'Switch to BetterDocs UI', 'betterdocs' ),
681 863 'dark_mode' => $dark_mode,
864 + 'kb_is_empty' => $this->kb_is_empty(),
682 865 'text' => __( 'Copied!', 'betterdocs' ),
683 866 'test_report' => __( 'Test Report!', 'betterdocs' ),
684 867 'sending' => __( 'Sending...', 'betterdocs' ),
685 868 'dir_url' => BETTERDOCS_ABSURL,
@@ -685,12 +868,17 @@
685 868 'dir_url' => BETTERDOCS_ABSURL,
686 869 'rest_url' => esc_url_raw( rest_url() ),
687 870 'free_version' => betterdocs()->version,
688 871 'generate_data_url' => get_rest_url( null, '/betterdocs/v1/create-sample-docs' ),
872 + 'ai_sample_docs' => array(
873 + 'enabled' => (bool) betterdocs()->settings->get( 'enable_ai_sample_docs', true ),
874 + 'rest_base' => esc_url_raw( get_rest_url( null, '/betterdocs/v1/sample-docs' ) ),
875 + ),
689 876 'nonce' => wp_create_nonce( 'wp_rest' ),
690 877 'sync_nonce' => wp_create_nonce( 'ai_chatbot_embed' ),
691 878 'count_all_docs' => array_sum( (array) wp_count_posts( 'docs' ) ),
692 879 'count_all_faq' => array_sum( (array) wp_count_posts( 'betterdocs_faq' ) ),
880 + 'faq_order' => get_option( 'betterdocs_faq_order', 'default' ),
693 881 'count_new_docs' => $this->get_not_synced_docs_count(),
694 882 'admin_url' => admin_url(),
695 883 'ia_preview' => betterdocs()->settings->get( 'ia_enable_preview', false ),
696 884 'multiple_kb' => betterdocs()->settings->get( 'multiple_kb' ),
@@ -698,13 +886,34 @@
698 886 'dashboard_mode' => get_option( 'dashboard_mode' ),
699 887 'betterdocs_pro_plugin' => betterdocs()->is_pro_active(),
700 888 'betterdocs_pro_version' => betterdocs()->pro_version(),
701 889 'analytics_older' => version_compare( betterdocs()->pro_version(), '3.3.4', '<=' ),
702 - 'disabled_embed_model_option' => get_option( 'disabled_embed_model_option' ),
703 890 'betterdocs_ChatBot_plugin' => is_plugin_active( 'betterdocs-ai-chatbot/betterdocs-ai-chatbot.php' ),
891 + 'api_docs_teaser' => betterdocs()->show_api_docs_teaser(),
892 + 'glossaries_teaser' => betterdocs()->show_glossary_teaser(),
893 + 'glossaries_needs_pro_update' => betterdocs()->glossaries_needs_pro_update(),
894 + 'glossaries_min_pro_version' => betterdocs()->glossaries_min_pro_version(),
895 + 'glossaries_pro_update_url' => self_admin_url( 'plugins.php' ),
896 + 'content_intelligence_teaser' => betterdocs()->show_content_intelligence_teaser(),
897 + 'is_woocommerce_active' => class_exists( 'WooCommerce' ),
704 898 'total_doc_category_terms' => wp_count_terms( 'doc_category' ),
705 899 'current_admin_language' => Helper::get_current_admin_language(),
706 900 'is_multilingual' => Helper::is_multilingual_active(),
901 + 'languages' => Helper::get_admin_languages(),
902 + /**
903 + * MCP page bootstrap. `abilities_api_available` decides whether the
904 + * page offers a connection at all: without the Abilities API there
905 + * is no tool catalog, so an AI client would connect and find
906 + * nothing. `enabled` is only the initial paint — the toggle owns
907 + * the value from then on.
908 + *
909 + * @since 4.9.0
910 + */
911 + 'mcp' => array(
912 + 'abilities_api_available' => function_exists( 'wp_register_ability' ),
913 + 'enabled' => (bool) betterdocs()->settings->get( 'enable_mcp', false ),
914 + 'rest' => 'betterdocs/v1',
915 + ),
707 916 )
708 917 );
709 918
710 919 // If wp-date (which includes moment.js) is not registered, enqueue your custom moment.js
@@ -720,8 +929,16 @@
720 929 // FAQ Builder Related Localization
721 930 betterdocs()->assets->enqueue( 'betterdocs-admin-faq', 'admin/css/faq.css' );
722 931 betterdocs()->assets->enqueue( 'betterdocs-admin-faq', 'admin/js/faq.js' );
723 932
933 + // Load the classic editor (TinyMCE + QuickTags) so the FAQ rich-text editor can mount via wp.editor.initialize().
934 + if ( function_exists( 'wp_enqueue_editor' ) ) {
935 + wp_enqueue_editor();
936 + }
937 + if ( function_exists( 'wp_enqueue_media' ) ) {
938 + wp_enqueue_media();
939 + }
940 +
724 941 // removing emoji support
725 942 remove_action( 'wp_head', 'print_emoji_detection_script', 7 );
726 943 remove_action( 'admin_print_scripts', 'print_emoji_detection_script' );
727 944
@@ -727,10 +944,11 @@
727 944
728 945 // Get settings and remove unnecessary keys
729 946 $betterdocs_settings = get_option( 'betterdocs_settings', false );
730 947 if ( is_array( $betterdocs_settings ) && ! current_user_can( 'edit_docs_settings' ) ) {
731 - unset( $betterdocs_settings['ai_autowrite_api_key'] );
732 - unset( $betterdocs_settings['ai_chatbot_api_key'] );
948 + foreach ( Settings::sensitive_api_key_fields() as $sensitive_key ) {
949 + unset( $betterdocs_settings[ $sensitive_key ] );
950 + }
733 951 }
734 952
735 953 betterdocs()->assets->localize(
736 954 'betterdocs-admin-faq',
@@ -743,24 +961,10 @@
743 961 'betterdocs_settings' => $betterdocs_settings,
744 962 )
745 963 );
746 964
747 - // Glossaries Related Localization
748 - betterdocs()->assets->enqueue( 'betterdocs-admin-glossaries', 'admin/css/faq.css' );
749 -
750 - betterdocs()->assets->enqueue( 'betterdocs-admin-glossaries', 'admin/js/glossaries.js' );
751 -
752 - betterdocs()->assets->localize(
753 - 'betterdocs-admin-glossaries',
754 - 'betterdocsGlossary',
755 - array(
756 - 'dir_url' => BETTERDOCS_ABSURL,
757 - 'rest_url' => esc_url_raw( rest_url() ),
758 - 'free_version' => betterdocs()->version,
759 - 'nonce' => wp_create_nonce( 'wp_rest' ),
760 - 'betterdocs_settings' => $betterdocs_settings,
761 - )
762 - );
965 + // Glossaries is Pro — Pro's Core\Glossaries::enqueue() owns that bundle
966 + // and both of its localized objects (`betterdocs`, `betterdocsGlossary`).
763 967 }
764 968
765 969 /**
766 970 * All admin pages header
@@ -817,8 +1021,13 @@
817 1021
818 1022 // Always register both UI endpoints
819 1023 $this->register_modern_ui_fallback();
820 1024
1025 + // The one-time MCP discovery badge (ADR-063). Decided once, here, and
1026 + // remembered for `mcp_badge_styles()`: the pill's markup and the pill's
1027 + // stylesheet have to be printed on the same requests as each other.
1028 + $this->mcp_badge = self::should_flag_mcp();
1029 +
821 1030 foreach ( $this->menu_list() as $key => $value ) {
822 1031 if ( 'betterdocs' === $key ) {
823 1032 $callable = 'add_menu_page';
824 1033 $value = wp_parse_args( $value, $default_args );
@@ -847,10 +1056,203 @@
847 1056 }
848 1057 ++$_menu_position;
849 1058 }
850 1059 }
1060 +
1061 + $this->paint_mcp_badge();
851 1062 }
852 1063
1064 + /**
1065 + * Append the discovery badge to the registered menu titles.
1066 + *
1067 + * **After** registration, editing `$menu` / `$submenu` in place — the same
1068 + * shape `add_custom_classes_to_menu_items()` uses — and never by passing a
1069 + * decorated title to `add_menu_page()`. That distinction is not cosmetic:
1070 + * core stores `sanitize_title( $menu_title )` as `$admin_page_hooks[ $slug ]`
1071 + * (`wp-admin/includes/plugin.php:1397`) and builds every child page's hook
1072 + * suffix from it (`get_plugin_page_hookname()`), so markup in the parent's
1073 + * title renames `betterdocs_page_betterdocs-mcp` — and the MCP screen, whose
1074 + * asset enqueue is keyed on that exact suffix, silently loads no React
1075 + * bundle at all. Measured: the first visit came back 102,513 bytes with no
1076 + * `dashboard.js`, against 489,272 bytes once the badge had cleared.
1077 + *
1078 + * Titles are only ever appended to, never rebuilt: the menu list is filtered
1079 + * (`betterdocs_admin_menu`), so whatever a filter put in a title survives.
1080 + *
1081 + * @return void
1082 + * @since 4.9.0
1083 + */
1084 + private function paint_mcp_badge() {
1085 + if ( ! $this->mcp_badge ) {
1086 + return;
1087 + }
1088 +
1089 + global $menu, $submenu;
1090 +
1091 + if ( is_array( $menu ) ) {
1092 + foreach ( $menu as &$item ) {
1093 + if ( isset( $item[2] ) && $this->slug === $item[2] ) {
1094 + $item[0] .= self::mcp_parent_bubble();
1095 + break;
1096 + }
1097 + }
1098 + unset( $item );
1099 + }
1100 +
1101 + if ( isset( $submenu[ $this->slug ] ) && is_array( $submenu[ $this->slug ] ) ) {
1102 + foreach ( $submenu[ $this->slug ] as &$sub_item ) {
1103 + if ( isset( $sub_item[2] ) && 'betterdocs-content-iq' === $sub_item[2] ) {
1104 + $sub_item[0] .= self::mcp_submenu_pill();
1105 + break;
1106 + }
1107 + }
1108 + unset( $sub_item );
1109 + }
1110 + }
1111 +
1112 + /**
1113 + * Whether the current user should see the one-time MCP discovery badge.
1114 + *
1115 + * True only for a user who can actually reach the screen and has never
1116 + * opened it. The capability is the one the MCP menu item is already
1117 + * registered with (`manage_options`) rather than a second, re-derived rule —
1118 + * so the badge can never advertise a page its reader cannot open.
1119 + *
1120 + * @return bool
1121 + * @since 4.9.0
1122 + */
1123 + public static function should_flag_mcp() {
1124 + if ( ! current_user_can( 'manage_options' ) ) {
1125 + return false;
1126 + }
1127 +
1128 + $user_id = get_current_user_id();
1129 +
1130 + if ( ! $user_id ) {
1131 + return false;
1132 + }
1133 +
1134 + // `get_user_meta( …, true )` answers '' for a key that is not there, and
1135 + // the value written is always `time()` — so an empty string is the only
1136 + // shape "never opened" takes.
1137 + return '' === get_user_meta( $user_id, self::MCP_SEEN_META, true );
1138 + }
1139 +
1140 + /**
1141 + * WordPress' own update-count bubble, for the BetterDocs parent menu item.
1142 + *
1143 + * Core's markup on purpose: the red bubble, its position and its dark-mode
1144 + * colours are already in `wp-admin`'s stylesheet, so this needs no CSS of
1145 + * ours and cannot drift from the Plugins/Updates bubbles beside it.
1146 + *
1147 + * @return string
1148 + * @since 4.9.0
1149 + */
1150 + private static function mcp_parent_bubble() {
1151 + return ' <span class="update-plugins count-1"><span class="update-count">1</span></span>';
1152 + }
1153 +
1154 + /**
1155 + * The green "New" pill for the MCP submenu item.
1156 + *
1157 + * Core has no submenu-badge markup, so this one is ours — styled by
1158 + * `mcp_badge_styles()`.
1159 + *
1160 + * @return string
1161 + * @since 4.9.0
1162 + */
1163 + private static function mcp_submenu_pill() {
1164 + return ' <span class="bd-menu-pill">' . esc_html__( 'New', 'betterdocs' ) . '</span>';
1165 + }
1166 +
1167 + /**
1168 + * Whether this request is the MCP screen being opened by someone who can
1169 + * open it.
1170 + *
1171 + * The whole of the clearing decision, in one static so it can be pinned by
1172 + * a test. It reads the **page slug** rather than an admin hook suffix
1173 + * because the suffix is derived state: core builds it from
1174 + * `sanitize_title()` of the *parent* menu title (`get_plugin_page_hookname()`),
1175 + * that title is filtered (`betterdocs_admin_menu`), and the parent slug is
1176 + * spelled two ways in this class already. `?page=betterdocs-mcp` is the one
1177 + * thing that identifies this screen on every install (ADR-065).
1178 + *
1179 + * The capability is `manage_options`, the same one the MCP menu item is
1180 + * registered with and the same one {@see self::should_flag_mcp()} gates on:
1181 + * nothing may be written for a user who cannot reach the page.
1182 + *
1183 + * @return bool
1184 + * @since 4.9.0
1185 + */
1186 + public static function is_mcp_screen_request() {
1187 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only screen detection; see mark_mcp_seen().
1188 + $page = isset( $_GET['page'] ) ? sanitize_key( wp_unslash( $_GET['page'] ) ) : '';
1189 +
1190 + if ( 'betterdocs-content-iq' !== $page ) {
1191 + return false;
1192 + }
1193 +
1194 + return current_user_can( 'manage_options' );
1195 + }
1196 +
1197 + /**
1198 + * Record that this user has now seen the MCP screen.
1199 + *
1200 + * Bound to `admin_init` — which fires for every admin request — and gated on
1201 + * the page slug, rather than to `load-{$hook_suffix}` for the one suffix
1202 + * `add_submenu_page()` happened to return. `admin_menu` has already run by
1203 + * the time `admin_init` fires (measured), so the badge is still painted on
1204 + * *this* request and is gone from the next admin page — that is expected and
1205 + * correct. Do not add JavaScript to strip it mid-request.
1206 + *
1207 + * **No nonce, on purpose.** A nonce protects a state change an attacker
1208 + * could make a logged-in administrator perform unknowingly. The only state
1209 + * here is "this administrator has now been shown the MCP screen once", it is
1210 + * written for the current user alone, it holds no attacker-chosen value, and
1211 + * the worst a forged request can achieve is hiding a discovery badge from
1212 + * the person it was drawn for. A nonce on a plain page view would also have
1213 + * to survive the menu link, which carries none.
1214 + *
1215 + * @return void
1216 + * @since 4.9.0
1217 + */
1218 + public function mark_mcp_seen() {
1219 + if ( ! self::is_mcp_screen_request() ) {
1220 + return;
1221 + }
1222 +
1223 + $user_id = get_current_user_id();
1224 +
1225 + if ( ! $user_id ) {
1226 + return;
1227 + }
1228 +
1229 + update_user_meta( $user_id, self::MCP_SEEN_META, time() );
1230 + }
1231 +
1232 + /**
1233 + * The handful of declarations the "New" pill needs, inline, and only while
1234 + * it is being shown.
1235 + *
1236 + * The menu is read from the WordPress Dashboard, and `styles()` above
1237 + * early-returns on non-BetterDocs screens — so `admin/css/dashboard.css` is
1238 + * not loaded where this pill is seen. Loading the whole BetterDocs admin
1239 + * stylesheet globally, or shipping a stylesheet file for nine declarations,
1240 + * both cost far more than printing them here. The accent is written out
1241 + * rather than taken from `--base-color-700`: that token lives in
1242 + * `dashboard.css`, which is exactly the file that is not loaded here.
1243 + *
1244 + * @return void
1245 + * @since 4.9.0
1246 + */
1247 + public function mcp_badge_styles() {
1248 + if ( ! $this->mcp_badge ) {
1249 + return;
1250 + }
1251 +
1252 + echo '<style id="betterdocs-menu-pill">#adminmenu .bd-menu-pill{display:inline-block;background:#00b884;color:#fff;font-size:10px;text-transform:uppercase;line-height:1.6;padding:1px 6px;margin-left:6px;border-radius:9px;}</style>' . "\n";
1253 + }
1254 +
853 1255 private function register_modern_ui_fallback() {
854 1256 // Add the submenu with valid parent slug
855 1257 add_submenu_page(
856 1258 'betterdocs', // Valid parent slug
@@ -949,15 +1351,19 @@
949 1351 'post-new.php?post_type=docs'
950 1352 ),
951 1353 'categories' => $this->normalize_menu(
952 1354 __( 'Categories', 'betterdocs' ),
953 - 'edit-tags.php?taxonomy=doc_category&post_type=docs',
954 - 'manage_doc_terms'
1355 + 'betterdocs-doc-categories',
1356 + 'manage_doc_terms',
1357 + array( $this, 'output' ),
1358 + $parent_slug
955 1359 ),
956 1360 'tags' => $this->normalize_menu(
957 1361 __( 'Tags', 'betterdocs' ),
958 - 'edit-tags.php?taxonomy=doc_tag&post_type=docs',
959 - 'manage_doc_terms'
1362 + 'betterdocs-doc-tags',
1363 + 'manage_doc_terms',
1364 + array( $this, 'output' ),
1365 + $parent_slug
960 1366 ),
961 1367 'settings' => $this->normalize_menu(
962 1368 __( 'Settings', 'betterdocs' ),
963 1369 'betterdocs-settings',
@@ -967,8 +1373,18 @@
967 1373 'output',
968 1374 ),
969 1375 $parent_slug
970 1376 ),
1377 + 'mcp' => $this->normalize_menu(
1378 + __( 'MCP', 'betterdocs' ),
1379 + 'betterdocs-mcp',
1380 + 'manage_options',
1381 + array(
1382 + $this,
1383 + 'output',
1384 + ),
1385 + $parent_slug
1386 + ),
971 1387 'analytics' => $this->normalize_menu(
972 1388 __( 'Analytics', 'betterdocs' ),
973 1389 'betterdocs-analytics',
974 1390 'read_docs_analytics',
@@ -977,8 +1393,18 @@
977 1393 'output',
978 1394 ),
979 1395 $parent_slug
980 1396 ),
1397 + 'content_intelligence' => $this->normalize_menu(
1398 + __( 'Content IQ', 'betterdocs' ),
1399 + 'betterdocs-content-iq',
1400 + 'read_docs_analytics',
1401 + array(
1402 + $this,
1403 + 'output',
1404 + ),
1405 + $parent_slug
1406 + ),
981 1407 'faq' => $this->normalize_menu(
982 1408 __( 'FAQ Builder', 'betterdocs' ),
983 1409 'betterdocs-faq',
984 1410 'read_faq_builder',
@@ -989,13 +1415,25 @@
989 1415 $parent_slug
990 1416 ),
991 1417 );
992 1418
993 - if ( betterdocs()->is_pro_active() && betterdocs()->settings->get( 'enable_glossaries' ) == true ) {
1419 + // Content Intelligence ships in Pro, which overwrites that same key in place.
1420 + // Unlike API Docs it has to sit directly after Analytics, and `menus()` walks
1421 + // this array in insertion order — so the slot is declared inside the literal
1422 + // above and only withdrawn here. Appending it after the fact, api_docs-style,
1423 + // would park it at the bottom of the menu.
1424 + if ( ! ( betterdocs()->show_content_intelligence_teaser() || betterdocs()->has_content_intelligence() ) ) {
1425 + unset( $betterdocs_admin_pages['content_intelligence'] );
1426 + }
1427 +
1428 + // Glossaries is Pro. Reserve this same 'glossaries' slot for Free's locked
1429 + // teaser so the item keeps this position; once Pro is active the real
1430 + // screen overwrites the key in place (same pattern as API Docs below).
1431 + if ( betterdocs()->show_glossary_teaser() || ( betterdocs()->is_pro_active() && betterdocs()->settings->get( 'enable_glossaries' ) == true ) ) {
994 1432 $betterdocs_admin_pages['glossaries'] = $this->normalize_menu(
995 1433 __( 'Glossaries', 'betterdocs' ),
996 1434 'betterdocs-glossaries',
997 - 'read_docs_analytics',
1435 + betterdocs()->show_glossary_teaser() ? 'manage_options' : 'read_docs_analytics',
998 1436 array(
999 1437 $this,
1000 1438 'output',
1001 1439 ),
@@ -1002,8 +1440,24 @@
1002 1440 $parent_slug
1003 1441 );
1004 1442 }
1005 1443
1444 + // API Docs ships in Pro, which overwrites this same key in place — declaring
1445 + // the slot here is what keeps the item in this position. Without Pro it
1446 + // holds Free's locked teaser instead.
1447 + if ( betterdocs()->show_api_docs_teaser() || betterdocs()->has_api_docs() ) {
1448 + $betterdocs_admin_pages['api_docs'] = $this->normalize_menu(
1449 + __( 'API Docs', 'betterdocs' ),
1450 + 'betterdocs-api-docs',
1451 + apply_filters( 'betterdocs_api_ref_capability', 'manage_options' ),
1452 + array(
1453 + $this,
1454 + 'output',
1455 + ),
1456 + $parent_slug
1457 + );
1458 + }
1459 +
1006 1460 if ( ! betterdocs()->is_chatbot_active() ) {
1007 1461 $betterdocs_admin_pages['ai_chatbot'] = $this->normalize_menu(
1008 1462 __( 'AI Chatbot', 'betterdocs' ),
1009 1463 'betterdocs-ai-chatbot',
@@ -1018,8 +1472,70 @@
1018 1472
1019 1473 return apply_filters( 'betterdocs_admin_menu', $betterdocs_admin_pages, array( $this, 'output' ), $parent_slug );
1020 1474 }
1021 1475
1476 + /**
1477 + * Put the BetterDocs submenu in a deliberate order.
1478 + *
1479 + * Order used to be an accident of *when* each item was added: Free declares
1480 + * most of them inline, and reserves in-place slots for `glossaries` /
1481 + * `api_docs` so Pro can overwrite the key without moving it. Anything added
1482 + * purely through this filter, though, could only land at the end — which is
1483 + * why Multiple KB (Pro, priority 100) and AI Chatbot Logs sat after
1484 + * everything else regardless of where they belong.
1485 + *
1486 + * Sorting here, at priority 999, fixes that for every source at once: Free's
1487 + * own entries, Pro's, and any add-on's. Knowledge Base now follows Tags (it
1488 + * is the third taxonomy-ish thing, so it belongs with Categories and Tags
1489 + * rather than past Analytics), and API Docs follows Knowledge Base.
1490 + *
1491 + * Keys not listed keep their relative order and are appended, so an add-on
1492 + * that registers something unknown to this list is never dropped.
1493 + *
1494 + * @param array $pages Menu pages keyed by slug id.
1495 + * @return array
1496 + */
1497 + public function order_admin_menu( $pages ) {
1498 + if ( ! is_array( $pages ) ) {
1499 + return $pages;
1500 + }
1501 +
1502 + $order = array(
1503 + 'betterdocs',
1504 + 'dashboard',
1505 + 'all_docs',
1506 + 'add_new',
1507 + 'categories',
1508 + 'tags',
1509 + 'multiple_kb',
1510 + 'api_docs',
1511 + 'settings',
1512 + 'mcp',
1513 + 'analytics',
1514 + // Content IQ reads as a second Analytics screen, so it has to stay
1515 + // pinned directly behind it. Without this entry it would fall into
1516 + // the unknown-key bucket below and be appended to the bottom of the
1517 + // menu — the exact placement the menu literal avoids by declaring
1518 + // the slot inline rather than filtering it in api_docs-style.
1519 + 'content_intelligence',
1520 + 'faq',
1521 + 'glossaries',
1522 + 'ai_chatbot',
1523 + 'ai_chatbot_logs',
1524 + );
1525 +
1526 + $ordered = array();
1527 + foreach ( $order as $key ) {
1528 + if ( array_key_exists( $key, $pages ) ) {
1529 + $ordered[ $key ] = $pages[ $key ];
1530 + unset( $pages[ $key ] );
1531 + }
1532 + }
1533 +
1534 + // `$pages` now holds only unknown keys, still in their original order.
1535 + return array_merge( $ordered, $pages );
1536 + }
1537 +
1022 1538 public function add_custom_classes_to_menu_items() {
1023 1539 global $menu, $submenu;
1024 1540
1025 1541 $menu_items = array(
@@ -1025,15 +1541,18 @@
1025 1541 $menu_items = array(
1026 1542 'betterdocs' => 'betterdocs',
1027 1543 'betterdocs_page_all_docs' => 'betterdocs-all-docs',
1028 1544 'betterdocs_page_add_new' => 'betterdocs-add-new',
1029 - 'edit-tags.php?taxonomy=doc_category&post_type=docs' => 'betterdocs-categories',
1030 - 'edit-tags.php?taxonomy=doc_tag&post_type=docs' => 'betterdocs-tags',
1545 + 'betterdocs-doc-categories' => 'betterdocs-categories',
1546 + 'betterdocs-doc-tags' => 'betterdocs-tags',
1031 1547 'betterdocs-settings' => 'betterdocs-settings',
1548 + 'betterdocs-mcp' => 'betterdocs-mcp',
1032 1549 'betterdocs-analytics' => 'betterdocs-analytics',
1550 + 'betterdocs-content-iq' => 'betterdocs-content-iq',
1033 1551 'betterdocs-faq' => 'betterdocs-faq',
1034 1552 'betterdocs-glossaries' => 'betterdocs-glossaries',
1035 1553 'betterdocs-ai-chatbot' => 'betterdocs-ai-chatbot',
1554 + 'betterdocs-api-docs' => 'betterdocs-api-docs',
1036 1555 'edit-tags.php?taxonomy=knowledge_base&post_type=docs' => 'betterdocs-multiplekb',
1037 1556 );
1038 1557
1039 1558 foreach ( $menu as &$item ) {
@@ -1146,11 +1665,18 @@
1146 1665 *
1147 1666 * @since 3.0.1
1148 1667 */
1149 1668 public function save_admin_page() {
1150 - if ( isset( $_GET['post_type'] ) && 'docs' === $_GET['post_type'] && isset( $_GET['bdocs_view'] ) && 'classic' === $_GET['bdocs_view'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
1669 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only screen detection.
1670 + $post_type = isset( $_GET['post_type'] ) ? sanitize_text_field( wp_unslash( $_GET['post_type'] ) ) : '';
1671 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only screen detection.
1672 + $bdocs_view = isset( $_GET['bdocs_view'] ) ? sanitize_text_field( wp_unslash( $_GET['bdocs_view'] ) ) : '';
1673 + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only screen detection.
1674 + $page = isset( $_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : '';
1675 +
1676 + if ( 'docs' === $post_type && 'classic' === $bdocs_view ) {
1151 1677 update_user_meta( get_current_user_id(), 'last_visited_docs_admin_page', 'classic_ui' );
1152 - } elseif ( isset( $_GET['page'] ) && 'betterdocs-admin' === $_GET['page'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
1678 + } elseif ( 'betterdocs-admin' === $page ) {
1153 1679 update_user_meta( get_current_user_id(), 'last_visited_docs_admin_page', 'modern_ui' );
1154 1680 }
1155 1681 }
1156 1682
@@ -1217,9 +1743,10 @@
1217 1743 * @since 3.7.0
1218 1744 */
1219 1745 public function ajax_dismiss_black_friday_pointer() {
1220 1746 // Verify nonce
1221 - if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'betterdocs_dismiss_pointer' ) ) {
1747 + $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
1748 + if ( ! wp_verify_nonce( $nonce, 'betterdocs_dismiss_pointer' ) ) {
1222 1749 wp_send_json_error( array( 'message' => __( 'Invalid nonce', 'betterdocs' ) ) );
1223 1750 }
1224 1751
1225 1752 // Check if user has permission
@@ -1227,9 +1754,9 @@
1227 1754 wp_send_json_error( array( 'message' => __( 'Permission denied', 'betterdocs' ) ) );
1228 1755 }
1229 1756
1230 1757 // Get the introduction key
1231 - $introduction_key = isset( $_POST['introduction_key'] ) ? sanitize_text_field( $_POST['introduction_key'] ) : '';
1758 + $introduction_key = isset( $_POST['introduction_key'] ) ? sanitize_text_field( wp_unslash( $_POST['introduction_key'] ) ) : '';
1232 1759
1233 1760 if ( empty( $introduction_key ) ) {
1234 1761 wp_send_json_error( array( 'message' => __( 'Invalid introduction key', 'betterdocs' ) ) );
1235 1762 }