| @@ -313,9 +313,9 @@ | ||
| 313 | 313 | public function render_editor_page() |
| 314 | 314 | { |
| 315 | 315 | // Check permissions |
| 316 | 316 | if (!current_user_can('edit_pages')) { |
| 317 | - wp_die(__('You do not have sufficient permissions to access this page.', 'metasync')); | |
| 317 | + wp_die(esc_html__('You do not have sufficient permissions to access this page.', 'metasync')); | |
| 318 | 318 | } |
| 319 | 319 | |
| 320 | 320 | // Get post ID |
| 321 | 321 | $post_id = isset($_GET['post_id']) ? intval($_GET['post_id']) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only post ID, capability checked, view only |
| @@ -320,13 +320,13 @@ | ||
| 320 | 320 | // Get post ID |
| 321 | 321 | $post_id = isset($_GET['post_id']) ? intval($_GET['post_id']) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only post ID, capability checked, view only |
| 322 | 322 | |
| 323 | 323 | if (!$post_id) { |
| 324 | - wp_die(__('Invalid page ID.', 'metasync')); | |
| 324 | + wp_die(esc_html__('Invalid page ID.', 'metasync')); | |
| 325 | 325 | } |
| 326 | 326 | |
| 327 | 327 | if (!current_user_can('edit_post', $post_id)) { |
| 328 | - wp_die(__('You do not have sufficient permissions to access this page.', 'metasync')); | |
| 328 | + wp_die(esc_html__('You do not have sufficient permissions to access this page.', 'metasync')); | |
| 329 | 329 | } |
| 330 | 330 | |
| 331 | 331 | // Get post |
| 332 | 332 | $post = get_post($post_id); |
| @@ -331,9 +331,9 @@ | ||
| 331 | 331 | // Get post |
| 332 | 332 | $post = get_post($post_id); |
| 333 | 333 | |
| 334 | 334 | if (!$post) { |
| 335 | - wp_die(__('Page not found.', 'metasync')); | |
| 335 | + wp_die(esc_html__('Page not found.', 'metasync')); | |
| 336 | 336 | } |
| 337 | 337 | |
| 338 | 338 | // Check if raw HTML is enabled |
| 339 | 339 | $has_raw_html = get_post_meta($post_id, '_metasync_raw_html_enabled', true); |
| @@ -338,9 +338,9 @@ | ||
| 338 | 338 | // Check if raw HTML is enabled |
| 339 | 339 | $has_raw_html = get_post_meta($post_id, '_metasync_raw_html_enabled', true); |
| 340 | 340 | |
| 341 | 341 | if (!$has_raw_html) { |
| 342 | - wp_die(__('This page is not a raw HTML page.', 'metasync')); | |
| 342 | + wp_die(esc_html__('This page is not a raw HTML page.', 'metasync')); | |
| 343 | 343 | } |
| 344 | 344 | |
| 345 | 345 | // LPS pages are owned by the importer and are always complete |
| 346 | 346 | // documents, so the canvas is refused outright rather than opened in a |
| @@ -582,8 +582,9 @@ | ||
| 582 | 582 | // the browser did. Both checks read the value already in the database, |
| 583 | 583 | // not the payload: what matters is whether the page being overwritten |
| 584 | 584 | // is one the canvas could have represented faithfully. |
| 585 | 585 | if (self::is_lps_page($post_id)) { |
| 586 | + Metasync_PostHog::rollup('visual_editor_saved', array('blocked_lps' => 1)); | |
| 586 | 587 | wp_send_json_error( |
| 587 | 588 | array('message' => __('This page was imported from Website Studio and cannot be saved from the visual editor.', 'metasync')), |
| 588 | 589 | 409 |
| 589 | 590 | ); |
| @@ -591,8 +592,9 @@ | ||
| 591 | 592 | |
| 592 | 593 | $stored = get_post_meta($post_id, '_metasync_raw_html_content', true); |
| 593 | 594 | |
| 594 | 595 | if (self::is_unsafe_for_visual_editor($stored)) { |
| 596 | + Metasync_PostHog::rollup('visual_editor_saved', array('blocked_full_document' => 1)); | |
| 595 | 597 | wp_send_json_error( |
| 596 | 598 | array('message' => __('This page is a complete HTML document, so saving it from the visual editor would discard its doctype, head and scripts. Use Edit HTML Directly on the page editor instead.', 'metasync')), |
| 597 | 599 | 409 |
| 598 | 600 | ); |
| @@ -619,8 +621,11 @@ | ||
| 619 | 621 | 'ID' => $post_id, |
| 620 | 622 | 'post_modified' => current_time('mysql'), |
| 621 | 623 | 'post_modified_gmt' => current_time('mysql', 1) |
| 622 | 624 | )); |
| 625 | + | |
| 626 | + // Consent-gated analytics: daily counts, not one event per save. | |
| 627 | + Metasync_PostHog::rollup('visual_editor_saved', array('saved' => 1)); | |
| 623 | 628 | |
| 624 | 629 | wp_send_json_success(array( |
| 625 | 630 | 'message' => __('Page saved successfully', 'metasync'), |
| 626 | 631 | 'preview_url' => get_permalink($post_id) |
