← All changes | classes/core.php +56 -73 trunk → 0.5.0 View file →

		@@ -106,9 +106,8 @@
106	106
107	107	//AI
108	108	"ai_suggestions" => false,
109	109	"ai_engine_status"=> false,
110		- "mwai_active" => false,
111	110	"ai_engine_message" => "",
112	111
113	112	//API
114	113	"api_endpoint" => false,
		@@ -115,9 +114,8 @@
115	114	"api_token" => md5( time() . rand() ),
116	115
117	116	//MCP
118	117	"mcp_support" => false,
119		- "mcp_functions" => false,
120	118
121	119	//MAINTENANCE
122	120	"clean_uninstall" => false,
123	121	];
		@@ -191,12 +189,8 @@
191	189
192	190	private function updateAIEngineStatus( &$options ) {
193	191	global $mwai;
194	192
195		- // AI Engine is active (regardless of whether an API key is configured).
196		- // MCP exposure only needs AI Engine present, not a key, so the MCP toggles
197		- // gate on this rather than on mwai_has_ai.
198		- $options['mwai_active'] = !empty( $mwai );
199	193	$options['mwai_has_ai'] = !empty( $mwai ) && method_exists( $mwai, 'hasAI' ) && $mwai->hasAI();
200	194	// Legacy
201	195	$options['ai_engine_status'] = $options['mwai_has_ai'];
202	196
		@@ -230,24 +224,9 @@
230	224
231	225	$this->snippet->validate( $params );
232	226
233	227	$params = $this->snippet->formatParamsForDatabase( $params );
234		-
235		- // Route to UPDATE when an existing snippet id is provided (updateSnippet / the
236		- // MCP mwcode_update_snippet tool). This previously always insert()ed, so an
237		- // update tried to INSERT a row with an already-used primary key: that fails on
238		- // the SQLite backend (Studio/Playground) with "Could not insert the snippet",
239		- // and duplicates or errors elsewhere. The admin UI was unaffected because it
240		- // calls snippet->update() directly.
241		- $existing = !empty( $params['id'] ) ? $this->snippet->select_one( $params['id'] ) : null;
242		- if ( $existing ) {
243		- $this->snippet->update( $params );
244		- $result = $params['id'];
245		- }
246		- else {
247		- unset( $params['id'] );
248		- $result = $this->snippet->insert( $params );
249		- }
	228	+ $result = $this->snippet->insert( $params );
250	229	$snippet = $this->snippet->select_one( $result );
251	230
252	231	if( $result ) {
253	232	$params['id'] = (string)$result;
		@@ -362,17 +341,35 @@
362	341	'values' => $snippet['functionArgsDict'] // Contains the default values of the arguments
363	342	];
364	343	}
365	344
366		- // Arguments used to be sanitized into PHP-literal strings here (quoting,
367		- // esc_sql, var_export) so they could be concatenated into a string of PHP and
368		- // eval-ed. That is gone: the function is now called with call_user_func_array
369		- // (see below), so values are passed as data and need no literal-formatting.
370		- // The old formatting also prefixed argument keys with "$" via sanitize_arg,
371		- // which stored the provided value under "$name" while the call read "name", so
372		- // provided arguments never reached the function. Passing the raw values through
373		- // fixes both issues at once.
	345	+ // Sanitize all the arguments if the option is enabled
	346	+ if ( $this->get_option( 'sanitize_arguments', true ) ) {
374	347
	348	+ if ( $args ) {
	349	+ foreach ( $args as $name => $value ) {
	350	+ list( $sanitizedName, $sanitizedValue ) = $this->sanitize_arg( $name, $value );
	351	+ unset( $args[$name] );
	352	+
	353	+ $args[$sanitizedName] = $sanitizedValue;
	354	+ }
	355	+ }
	356	+
	357	+ foreach ( $params['values'] as $name => $value ) {
	358	+
	359	+ if( array_key_exists( 'input', $value) ) {
	360	+ list( $sanitizedInputName, $sanitizedInputValue ) = $this->sanitize_arg( $name, $value['input'], $value['type'] );
	361	+ $params['values'][$sanitizedInputName]['input'] = $sanitizedInputValue;
	362	+ }
	363	+
	364	+ if( array_key_exists( 'default', $value) ) {
	365	+ list( $sanitizedDefaultValueName, $sanitizedDefaultValue ) = $this->sanitize_arg( $name, $value['default'], $value['type'] );
	366	+ $params['values'][$sanitizedDefaultValueName]['default'] = $sanitizedDefaultValue;
	367	+ }
	368	+ }
	369	+
	370	+ }
	371	+
375	372	// Make sure the function is existing and is the one in the snippet
376	373	if ( empty( $params['code'] ) ) {
377	374	throw new Exception( 'Code Engine: The snippet code appears to be empty.' );
378	375	}
		@@ -380,17 +377,12 @@
380	377	if ( empty( $params['name'] ) || ! str_contains( $params['code'], $params['name'] ) ) {
381	378	throw new Exception( "Code Engine: Function name does not match. The name should be {$params['name']}." );
382	379	}
383	380
384		- // Collect the provided values, keyed by their normalized (dollar-less) name.
385		- // Incoming keys come from the AI/MCP schema, where register_function_tools()
386		- // strips a leading "$" from the declared name. The stored arg names can still
387		- // carry the "$", so we normalize both sides before matching below. Without this
388		- // a value provided as "style" never binds to an argument declared "$style".
389		- $provided = [];
	381	+ // Overwrite the default values with the provided ones
390	382	if ( $args ) {
391	383	foreach ( $args as $name => $value ) {
392		- $provided[ ltrim( $name, '$' ) ] = $value;
	384	+ $params['values'][$name]['input'] = $value;
393	385	}
394	386
395	387	$this->log( '⚡ Arguments provided: ' . json_encode( $args ) );
396	388	}
		@@ -423,58 +415,49 @@
423	415	// If already defined, just prepare to call the function without redefining it
424	416	$params['code'] = '';
425	417	}
426	418
427		- // Resolve the arguments as REAL PHP values, in the function's declared order.
428		- // The previous version concatenated each value into a string of PHP and eval-ed
429		- // the call, which broke on any string or edge-case value with a parse error
430		- // ("syntax error, unexpected token ')'"). call_user_func_array passes them as
431		- // data, so no value can ever corrupt the call syntax.
432		- $callArgs = [];
433		- foreach ( $params['args'] as $arg ) {
434		- $key = ltrim( $arg, '$' ); // Match the normalized name the caller sent.
435		- $value = null; // Not provided and no default -> null.
436		- // array_key_exists, not !empty: a legitimately provided 0, "0", "" or false
437		- // must reach the function instead of silently falling back to the default.
438		- if ( array_key_exists( $key, $provided ) ) {
439		- $value = $provided[ $key ];
440		- } else if ( isset( $params['values'][$arg]['default'] ) && $params['values'][$arg]['default'] !== '' ) {
441		- $value = $params['values'][$arg]['default'];
	419	+ // Prepare the code to be executed
	420	+ $params['code'] .= "\n\$mwcode_result = {$params['name']}(";
	421	+ foreach ( $params['args'] as $index => $arg ) {
	422	+ $value = 'null'; // In case the argument is not provided it will be null
	423	+
	424	+ if ( array_key_exists( $arg, $params['values'] ) ) { // Avoid warnings if the argument is not provided
	425	+
	426	+ // If the argument is provided, use it, if not use the default value
	427	+ if ( !empty( $params['values'][$arg]['input'] ) ) {
	428	+ $value = $params['values'][$arg]['input'];
	429	+
	430	+ } else if ( !empty( $params['values'][$arg]['default'] ) ) {
	431	+ $value = $params['values'][$arg]['default'];
	432	+ }
442	433	}
443		- // An array-typed argument can arrive as a string like "[1, 2, 3]"; turn it
444		- // into a real array so the function receives what its signature expects.
445		- if ( ( $params['values'][$arg]['type'] ?? null ) === 'array' && is_string( $value ) ) {
446		- $decoded = json_decode( $value, true );
447		- $value = is_array( $decoded ) ? $decoded : array_map( 'trim', explode( ',', trim( $value, "[] \t\n\r" ) ) );
	434	+
	435	+ $params['code'] .= "{$value}";
	436	+ if ( $index < count( $params['args'] ) - 1 ) {
	437	+ $params['code'] .= ', ';
448	438	}
449		- $callArgs[] = $value;
450	439	}
451	440
	441	+ $params['code'] .= ");\necho print_r(\$mwcode_result, true);";
	442	+
452	443	$error = null;
453	444	$output = null;
454		-
	445	+
455	446	try {
456	447	ob_start();
457		- // $params['code'] holds the function definition (empty if it was already
458		- // defined earlier this request). Declare it, then invoke it as data.
459		- if ( $params['code'] !== '' ) {
460		- eval( $params['code'] );
461		- }
462		- $mwcode_result = call_user_func_array( $params['name'], $callArgs );
463		- echo print_r( $mwcode_result, true );
	448	+ eval( $params['code'] );
464	449	$output = ob_get_clean();
465		-
466		- if ( $params['test'] ) {
	450	+
	451	+ if ( $params['test'] ){
467	452	$output = explode( "\n", $output );
468	453	}
469		-
	454	+
470	455	} catch ( Throwable $e ) {
471	456	//$this->log('Code Engine: Error executing the function: ' . $e->getMessage());
472	457	$error = new Exception(' Error executing the function, ' . $e->getMessage());
473	458
474		- if ( ob_get_level() > 0 ) {
475		- ob_end_clean();
476		- }
	459	+ ob_clean();
477	460	} finally {
478	461	restore_error_handler();
479	462	}
480	463
		@@ -724,9 +707,9 @@
724	707	*/
725	708	public function execute_active_snippets() {
726	709
727	710	$blocked = false;
728		- $page = isset( $_GET["page"] ) ? sanitize_text_field( $_GET["page"] ) : '';
	711	+ $page = isset( $_GET["page"] ) ? sanitize_text_field( $_GET["page"] ) : null;
729	712
730	713
731	714	if ( $page === 'mwcode_settings' ) {
732	715	// If we blocks global snippets like nonce_life filter, we would block the settings page so let's remove the block for this page