PluginProbe
MxChat – AI Chatbot & Content Generation for WordPress / 2.3.8
MxChat – AI Chatbot & Content Generation for WordPress v2.3.8
3.2.21 3.2.20 3.2.19 3.2.18 3.2.17 3.2.16 3.2.15 3.2.14 3.2.12 3.2.13 3.2.11 3.2.10 3.2.9 3.2.8 3.2.7 3.2.6 3.2.5 3.2.4 3.2.3 3.2.2 3.2.1 2.0.3 2.0.4 2.0.5 2.0.6 All 152 releases
← All changes | admin/class-ajax-handler.php +44 -1028 3.2.152.3.8 View file →
@@ -29,9 +29,9 @@
29 29 add_action('wp_ajax_mxchat_save_setting', array($this, 'mxchat_save_setting_callback'));
30 30 add_action('wp_ajax_mxchat_save_prompts_setting', array($this, 'mxchat_save_prompts_setting_callback'));
31 31 add_action('wp_ajax_migrate_pinecone_settings', array($this, 'ajax_migrate_pinecone_settings'));
32 32
33 - // License AJAX
33 + // License AJAX - FIXED TO MATCH JAVASCRIPT
34 34 add_action('wp_ajax_mxchat_handle_activate_license', array($this, 'mxchat_handle_activate_license'));
35 35 add_action('wp_ajax_mxchat_check_license_status', array($this, 'mxchat_check_license_status'));
36 36 add_action('wp_ajax_mxchat_deactivate_license', array($this, 'mxchat_deactivate_license'));
37 37
@@ -37,318 +37,10 @@
37 37
38 38 // Actions & Intents AJAX
39 39 add_action('wp_ajax_mxchat_toggle_action', array($this, 'mxchat_toggle_action'));
40 40 add_action('wp_ajax_mxchat_update_intent_threshold', array($this, 'mxchat_update_intent_threshold'));
41 -
42 - add_action('wp_ajax_mxchat_save_selected_bot', array($this, 'mxchat_save_selected_bot'));
43 - add_action('wp_ajax_mxchat_check_api_keys', array($this, 'mxchat_check_api_keys'));
44 -
45 - // Debug & Optimization AJAX
46 - add_action('wp_ajax_mxchat_toggle_debug_mode', array($this, 'mxchat_toggle_debug_mode_callback'));
47 - add_action('wp_ajax_mxchat_get_debug_log', array($this, 'mxchat_get_debug_log_callback'));
48 - add_action('wp_ajax_mxchat_clear_debug_log', array($this, 'mxchat_clear_debug_log_callback'));
49 - add_action('wp_ajax_mxchat_export_settings', array($this, 'mxchat_export_settings_callback'));
50 - add_action('wp_ajax_mxchat_reset_all_settings', array($this, 'mxchat_reset_all_settings_callback'));
51 -
52 - // Global rate-limit usage counter reset (admin-only, nonce-guarded)
53 - add_action('wp_ajax_mxchat_reset_global_rate_limit', array($this, 'mxchat_reset_global_rate_limit_callback'));
54 -
55 - // Custom (OpenAI-compatible) Provider connection test
56 - add_action('wp_ajax_mxchat_test_custom_provider', array($this, 'mxchat_test_custom_provider_callback'));
57 -
58 - // Built-in provider key validation — cheap per-provider auth check (plan-mxchat-20260623-c41f74)
59 - add_action('wp_ajax_mxchat_test_provider_key', array($this, 'mxchat_test_provider_key_callback'));
60 -
61 - // Custom Post Meta discovery scan for the KB whitelist picker (plan-mxchat-20260709-fe8e4e)
62 - add_action('wp_ajax_mxchat_scan_custom_meta_keys', array($this, 'mxchat_scan_custom_meta_keys_callback'));
63 41 }
64 42
65 -/**
66 - * Discover non-ACF custom post-meta keys present on published public content, so the
67 - * KB → Custom Post Meta section can offer a click-to-add picker instead of a blind
68 - * "type the exact key you already know" textarea. plan-mxchat-20260709-fe8e4e.
69 - *
70 - * Bounded + button-triggered only (never on page load). Returns up to 50 keys by
71 - * frequency, each with a short sample value, so the owner can judge relevance before
72 - * whitelisting. Underscore-prefixed (protected/internal) keys are hidden unless the
73 - * caller opts in; ACF-managed keys are excluded so this picker never double-lists the
74 - * sibling ACF discovery picker on the same page.
75 - */
76 -public function mxchat_scan_custom_meta_keys_callback() {
77 - check_ajax_referer('mxchat_prompts_setting_nonce');
78 -
79 - if (!current_user_can('manage_options')) {
80 - wp_send_json_error(['message' => esc_html__('Unauthorized', 'mxchat')]);
81 - }
82 -
83 - global $wpdb;
84 -
85 - $include_internal = isset($_POST['include_internal']) && $_POST['include_internal'] === '1';
86 -
87 - // Restrict discovery to public post types (the content the KB actually embeds).
88 - $post_types = get_post_types(array('public' => true), 'names');
89 - if (empty($post_types)) {
90 - wp_send_json_success(array('keys' => array(), 'scanned' => 0));
91 - }
92 - $pt_placeholders = implode(',', array_fill(0, count($post_types), '%s'));
93 -
94 - // Build the set of ACF-managed meta keys to exclude. ACF stores, alongside each
95 - // value key `foo`, a reference key `_foo` whose value is the ACF field key
96 - // (`field_xxxxx`). Strip the leading underscore from every such reference key to
97 - // get the real meta key, and exclude those — the ACF picker on this page owns them.
98 - $acf_managed = array();
99 - $acf_refs = $wpdb->get_col(
100 - $wpdb->prepare(
101 - "SELECT DISTINCT meta_key FROM {$wpdb->postmeta} WHERE meta_key LIKE %s AND meta_value LIKE %s",
102 - $wpdb->esc_like('_') . '%',
103 - $wpdb->esc_like('field_') . '%'
104 - )
105 - );
106 - foreach ((array) $acf_refs as $ref_key) {
107 - if (strlen($ref_key) > 1 && $ref_key[0] === '_') {
108 - $acf_managed[substr($ref_key, 1)] = true;
109 - }
110 - }
111 -
112 - // Discover keys + counts + a sample value in one bounded aggregate query.
113 - // SUBSTRING(MIN(...)) keeps the sample selection ONLY_FULL_GROUP_BY-safe.
114 - $params = $post_types;
115 - $sql = "SELECT pm.meta_key AS mk, COUNT(*) AS n, SUBSTRING(MIN(pm.meta_value), 1, 200) AS sample
116 - FROM {$wpdb->postmeta} pm
117 - INNER JOIN {$wpdb->posts} p ON p.ID = pm.post_id
118 - WHERE p.post_status = 'publish'
119 - AND p.post_type IN ($pt_placeholders)
120 - AND pm.meta_key <> ''";
121 - if (!$include_internal) {
122 - $sql .= " AND pm.meta_key NOT LIKE %s";
123 - $params[] = $wpdb->esc_like('_') . '%';
124 - }
125 - $sql .= " GROUP BY pm.meta_key ORDER BY n DESC, pm.meta_key ASC LIMIT 200";
126 -
127 - // phpcs:ignore WordPress.DB.PreparedSQL — placeholders assembled above, values in $params.
128 - $rows = $wpdb->get_results($wpdb->prepare($sql, $params));
129 -
130 - $keys = array();
131 - foreach ((array) $rows as $row) {
132 - $mk = $row->mk;
133 - if (isset($acf_managed[$mk])) {
134 - continue; // already offered by the ACF picker
135 - }
136 -
137 - $raw = (string) $row->sample;
138 - if ($raw !== '' && (is_serialized($raw) || preg_match('/^(a:\d+:\{|O:\d+:"|s:\d+:")/', $raw))) {
139 - $sample = esc_html__('[structured value]', 'mxchat');
140 - } else {
141 - $sample = trim(preg_replace('/\s+/', ' ', $raw));
142 - if (function_exists('mb_strlen') ? mb_strlen($sample) > 60 : strlen($sample) > 60) {
143 - $sample = (function_exists('mb_substr') ? mb_substr($sample, 0, 60) : substr($sample, 0, 60)) . '…';
144 - }
145 - if ($sample === '') {
146 - $sample = esc_html__('(empty value)', 'mxchat');
147 - }
148 - }
149 -
150 - $keys[] = array(
151 - 'key' => $mk,
152 - 'count' => (int) $row->n,
153 - 'sample' => $sample,
154 - );
155 -
156 - if (count($keys) >= 50) {
157 - break;
158 - }
159 - }
160 -
161 - wp_send_json_success(array(
162 - 'keys' => $keys,
163 - 'scanned' => is_array($rows) ? count($rows) : 0,
164 - ));
165 -}
166 -
167 -/**
168 - * Test connection to a Custom (OpenAI-compatible) provider by hitting its /models endpoint
169 - * with whichever auth scheme the user configured. Reports model count or a clean error.
170 - */
171 -public function mxchat_test_custom_provider_callback() {
172 - check_ajax_referer('mxchat_test_custom_provider');
173 - if (!current_user_can('manage_options')) {
174 - wp_send_json_error(array('message' => esc_html__('Unauthorized', 'mxchat')));
175 - }
176 -
177 - $options = get_option('mxchat_options', array());
178 - $base_url = isset($options['custom_provider_base_url']) ? trim((string) $options['custom_provider_base_url']) : '';
179 - $api_key = isset($options['custom_provider_api_key']) ? trim((string) $options['custom_provider_api_key']) : '';
180 - $auth = isset($options['custom_provider_auth_scheme']) ? $options['custom_provider_auth_scheme'] : 'bearer';
181 - $api_version = isset($options['custom_provider_api_version']) ? trim((string) $options['custom_provider_api_version']) : '';
182 -
183 - if (empty($base_url)) {
184 - wp_send_json_error(array('message' => esc_html__('Base URL is empty. Save it first.', 'mxchat')));
185 - }
186 -
187 - $url = rtrim($base_url, '/') . '/models';
188 - if (!empty($api_version)) {
189 - $url = add_query_arg('api-version', $api_version, $url);
190 - }
191 -
192 - $headers = array('Content-Type' => 'application/json');
193 - if (!empty($api_key)) {
194 - if ($auth === 'api-key') {
195 - $headers['api-key'] = $api_key;
196 - } else {
197 - $headers['Authorization'] = 'Bearer ' . $api_key;
198 - }
199 - }
200 -
201 - $response = wp_remote_get($url, array(
202 - 'headers' => $headers,
203 - 'timeout' => 10,
204 - ));
205 -
206 - if (is_wp_error($response)) {
207 - wp_send_json_error(array('message' => sprintf(esc_html__('Network error: %s', 'mxchat'), esc_html($response->get_error_message()))));
208 - }
209 -
210 - $code = (int) wp_remote_retrieve_response_code($response);
211 - if ($code === 401 || $code === 403) {
212 - wp_send_json_error(array('message' => sprintf(esc_html__('Auth rejected (HTTP %d). Check API key and auth scheme.', 'mxchat'), $code)));
213 - }
214 - if ($code === 404) {
215 - wp_send_json_error(array('message' => esc_html__('Endpoint not found (HTTP 404). Check the Base URL.', 'mxchat')));
216 - }
217 - if ($code < 200 || $code >= 300) {
218 - wp_send_json_error(array('message' => sprintf(esc_html__('Upstream returned HTTP %d.', 'mxchat'), $code)));
219 - }
220 -
221 - $body = json_decode(wp_remote_retrieve_body($response), true);
222 - $count = 0;
223 - if (is_array($body)) {
224 - if (isset($body['data']) && is_array($body['data'])) {
225 - $count = count($body['data']);
226 - } elseif (isset($body['models']) && is_array($body['models'])) {
227 - $count = count($body['models']);
228 - }
229 - }
230 -
231 - wp_send_json_success(array(
232 - 'message' => sprintf(esc_html__('Connection OK — %d model(s) reported.', 'mxchat'), $count),
233 - 'count' => $count,
234 - ));
235 -}
236 -
237 -/**
238 - * Validate a BUILT-IN provider key with the lightest authenticated call per
239 - * provider (a /models or key-info GET — never a generation). Reads the posted
240 - * key value so the owner can test BEFORE saving; falls back to the saved option
241 - * when the field is empty. Mirrors mxchat_test_custom_provider_callback and the
242 - * add-on test buttons (cf5bd5 veo / 8d16f1 perplexity). The key is never logged.
243 - * plan-mxchat-20260623-c41f74.
244 - */
245 -public function mxchat_test_provider_key_callback() {
246 - check_ajax_referer('mxchat_test_provider_key');
247 - if (!current_user_can('manage_options')) {
248 - wp_send_json_error(array('message' => esc_html__('Unauthorized', 'mxchat')));
249 - }
250 -
251 - $provider = isset($_POST['provider']) ? sanitize_key(wp_unslash($_POST['provider'])) : '';
252 - $posted_key = isset($_POST['key']) ? trim((string) wp_unslash($_POST['key'])) : '';
253 -
254 - $option_map = array(
255 - 'openai' => 'api_key',
256 - 'xai' => 'xai_api_key',
257 - 'claude' => 'claude_api_key',
258 - 'deepseek' => 'deepseek_api_key',
259 - 'gemini' => 'gemini_api_key',
260 - 'openrouter' => 'openrouter_api_key',
261 - );
262 - if (!isset($option_map[$provider])) {
263 - wp_send_json_error(array('message' => esc_html__('Unknown provider.', 'mxchat')));
264 - }
265 -
266 - // Prefer the just-typed value (test-before-save); fall back to the saved key.
267 - $key = $posted_key;
268 - if ($key === '') {
269 - $options = get_option('mxchat_options', array());
270 - $key = isset($options[$option_map[$provider]]) ? trim((string) $options[$option_map[$provider]]) : '';
271 - }
272 - if ($key === '') {
273 - wp_send_json_error(array('message' => esc_html__('No API key entered or saved for this provider.', 'mxchat')));
274 - }
275 -
276 - // Lightest authenticated metadata call per provider — model-agnostic, no generation.
277 - $headers = array();
278 - switch ($provider) {
279 - case 'openai':
280 - $url = 'https://api.openai.com/v1/models';
281 - $headers = array('Authorization' => 'Bearer ' . $key);
282 - break;
283 - case 'xai':
284 - $url = 'https://api.x.ai/v1/models';
285 - $headers = array('Authorization' => 'Bearer ' . $key);
286 - break;
287 - case 'deepseek':
288 - $url = 'https://api.deepseek.com/models';
289 - $headers = array('Authorization' => 'Bearer ' . $key);
290 - break;
291 - case 'openrouter':
292 - // /auth/key validates the key itself (the public /models list does not).
293 - $url = 'https://openrouter.ai/api/v1/auth/key';
294 - $headers = array('Authorization' => 'Bearer ' . $key);
295 - break;
296 - case 'gemini':
297 - $url = add_query_arg(array('pageSize' => 1, 'key' => $key), 'https://generativelanguage.googleapis.com/v1beta/models');
298 - break;
299 - case 'claude':
300 - $url = 'https://api.anthropic.com/v1/models';
301 - $headers = array('x-api-key' => $key, 'anthropic-version' => '2023-06-01');
302 - break;
303 - default:
304 - wp_send_json_error(array('message' => esc_html__('Unknown provider.', 'mxchat')));
305 - }
306 -
307 - $response = wp_remote_get($url, array(
308 - 'headers' => $headers,
309 - 'timeout' => 10,
310 - ));
311 -
312 - if (is_wp_error($response)) {
313 - wp_send_json_error(array('message' => sprintf(esc_html__('Network error: %s', 'mxchat'), esc_html($response->get_error_message()))));
314 - }
315 -
316 - $code = (int) wp_remote_retrieve_response_code($response);
317 - if ($code >= 200 && $code < 300) {
318 - wp_send_json_success(array('message' => esc_html__('Key is valid.', 'mxchat')));
319 - }
320 -
321 - // Surface the provider's own error text when present (trimmed; key never echoed).
322 - $detail = '';
323 - $body = json_decode(wp_remote_retrieve_body($response), true);
324 - if (is_array($body)) {
325 - if (isset($body['error']['message'])) {
326 - $detail = $body['error']['message'];
327 - } elseif (isset($body['error']) && is_string($body['error'])) {
328 - $detail = $body['error'];
329 - } elseif (isset($body['message'])) {
330 - $detail = $body['message'];
331 - }
332 - }
333 - $detail = trim((string) $detail);
334 - if (strlen($detail) > 200) {
335 - $detail = substr($detail, 0, 200) . '…';
336 - }
337 -
338 - if ($code === 401 || $code === 403) {
339 - $msg = ($detail !== '')
340 - ? sprintf(esc_html__('Key rejected (HTTP %1$d): %2$s', 'mxchat'), $code, esc_html($detail))
341 - : sprintf(esc_html__('Key rejected (HTTP %d). Check the API key.', 'mxchat'), $code);
342 - wp_send_json_error(array('message' => $msg));
343 - }
344 -
345 - $msg = ($detail !== '')
346 - ? sprintf(esc_html__('Provider returned HTTP %1$d: %2$s', 'mxchat'), $code, esc_html($detail))
347 - : sprintf(esc_html__('Provider returned HTTP %d.', 'mxchat'), $code);
348 - wp_send_json_error(array('message' => $msg));
349 -}
350 -
351 43 // ========================================
352 44 // SETTINGS AJAX HANDLERS
353 45 // ========================================
354 46
@@ -362,10 +54,10 @@
362 54 wp_send_json_error(['message' => esc_html__('Unauthorized', 'mxchat')]);
363 55 }
364 56
365 57 $name = isset($_POST['name']) ? $_POST['name'] : '';
366 - // Remove WP's added slashes before saving (wp_unslash is the canonical form; plan-3f8158).
367 - $value = isset($_POST['value']) ? wp_unslash($_POST['value']) : '';
58 + // Strip slashes from the value before saving
59 + $value = isset($_POST['value']) ? stripslashes($_POST['value']) : '';
368 60
369 61 //error_log('MXChat Save: Processing field name: ' . $name);
370 62 //error_log('MXChat Save: Field value: ' . $value);
371 63
@@ -377,133 +69,15 @@
377 69 // Load the full options array
378 70 $options = get_option('mxchat_options', []);
379 71 //error_log('MXChat Save: Current options array: ' . print_r($options, true));
380 72
381 - // Extract field name from mxchat_options[field_name] format if present
382 - // But preserve the full name for special cases like rate_limits that need the full path
383 - $field_name = $name;
384 - if (preg_match('/^mxchat_options\[([^\[\]]+)\]$/', $name, $matches)) {
385 - $field_name = $matches[1];
386 - }
387 -
388 73 // Handle special cases
389 - switch ($field_name) {
390 - // Editor Assistant enable toggle (plan-8cb0cb). STANDALONE option — NOT part
391 - // of mxchat_options, so it skips the mxchat_sanitize strip-trap entirely. Save
392 - // it directly and short-circuit (mirrors the mxchat_transcripts_options pattern
393 - // below); never falls through to the generic mxchat_options save. Default OFF.
394 - case 'mxchat_editor_assistant_enabled':
395 - $ea_value = ($value === 'on' || $value === '1') ? 'on' : 'off';
396 - update_option('mxchat_editor_assistant_enabled', $ea_value);
397 - wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
398 - return;
399 -
400 - // Smart asset loading toggle (plan-915355). STANDALONE option, same
401 - // reasoning as the Editor Assistant case above — saved directly and
402 - // short-circuited so it never touches mxchat_options / mxchat_sanitize.
403 - // Default OFF (opt-in performance optimization).
404 - case 'mxchat_smart_asset_loading':
405 - $sal_value = ($value === 'on' || $value === '1') ? 'on' : 'off';
406 - update_option('mxchat_smart_asset_loading', $sal_value);
407 - wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
408 - return;
409 -
410 - // Live-agent availability schedules (plans 8ccaa2 + 99d7a4). STANDALONE
411 - // options, same reasoning as the Editor Assistant case above — nested
412 - // structures that mxchat_sanitize() would strip on the next autosave of any
413 - // other field. Each channel's value arrives as JSON from its own hidden
414 - // input, which that channel's schedule editor keeps in sync; the class owns
415 - // all validation. The bare legacy name is kept as a defense against a
416 - // browser still running pre-split cached admin JS: that UI edited "both
417 - // channels" as one, so its save writes both.
418 - case 'live_agent_schedule_slack':
419 - case 'live_agent_schedule_telegram':
420 - case 'live_agent_schedule':
421 - if (!class_exists('MxChat_Live_Agent_Schedule')) {
422 - wp_send_json_error(['message' => esc_html__('Schedule unavailable', 'mxchat')]);
423 - return;
424 - }
425 - $decoded = json_decode($value, true);
426 - if (!is_array($decoded)) {
427 - wp_send_json_error(['message' => esc_html__('Invalid schedule', 'mxchat')]);
428 - return;
429 - }
430 - $channels = ($field_name === 'live_agent_schedule')
431 - ? array('slack', 'telegram')
432 - : array(substr($field_name, strlen('live_agent_schedule_')));
433 - $saved_schedule = null;
434 - foreach ($channels as $schedule_channel) {
435 - $saved_schedule = MxChat_Live_Agent_Schedule::save($schedule_channel, $decoded);
436 - }
437 - // Echo the normalized result so the editor can reconcile if it ever
438 - // disagrees with the server (e.g. a time the class rejected).
439 - wp_send_json_success([
440 - 'message' => esc_html__('Setting saved', 'mxchat'),
441 - 'schedule' => $saved_schedule,
442 - ]);
443 - return;
444 -
445 - case 'model':
446 - //error_log('MXChat Save: Processing model selection');
447 - //error_log('MXChat Save: Model value received: ' . $value);
448 - //error_log('MXChat Save: Value type: ' . gettype($value));
449 - //error_log('MXChat Save: Value length: ' . strlen($value));
450 - //error_log('MXChat Save: Value === "openrouter": ' . ($value === 'openrouter' ? 'YES' : 'NO'));
451 -
452 - // Allow 'openrouter' or validate against whitelist
453 - if ($value === 'openrouter') {
454 - //error_log('MXChat Save: Setting model to openrouter');
455 - $options['model'] = 'openrouter';
456 - } else {
457 - //error_log('MXChat Save: Checking against whitelist');
458 - // Catalog refactor (plan-d14e89): canonical allowlist lives in
459 - // includes/class-mxchat-model-catalog.php. A new chat model
460 - // added there is automatically accepted by autosave.
461 - if (!class_exists('MxChat_Model_Catalog')) {
462 - require_once plugin_dir_path(dirname(__FILE__)) . 'includes/class-mxchat-model-catalog.php';
463 - }
464 - $allowed_models = MxChat_Model_Catalog::chat_model_ids();
465 -
466 - //error_log('MXChat Save: in_array result: ' . (in_array($value, $allowed_models) ? 'YES' : 'NO'));
467 -
468 - if (in_array($value, $allowed_models)) {
469 - //error_log('MXChat Save: Model is in whitelist, saving');
470 - $options['model'] = sanitize_text_field($value);
471 - } else {
472 - //error_log('MXChat Save: Invalid model rejected: ' . $value);
473 - //error_log('MXChat Save: Allowed models: ' . print_r($allowed_models, true));
474 - wp_send_json_error(['message' => esc_html__('Invalid model selected', 'mxchat')]);
475 - return;
476 - }
477 - }
478 - break;
479 -
480 - case 'openrouter_selected_model':
481 - //error_log('MXChat Save: Processing OpenRouter model: ' . $value);
482 - $options['openrouter_selected_model'] = sanitize_text_field($value);
483 - // Force immediate save for new keys
484 - //error_log('MXChat Save: OpenRouter model saved immediately');
485 - break;
486 -
487 - case 'openrouter_selected_model_name':
488 - //error_log('MXChat Save: Processing OpenRouter model name: ' . $value);
489 - $options['openrouter_selected_model_name'] = sanitize_text_field($value);
490 - // Force immediate save for new keys
491 - //error_log('MXChat Save: OpenRouter model name saved immediately');
492 - break;
493 -
494 - case 'openrouter_api_key':
495 - //error_log('MXChat Save: Processing OpenRouter API key');
496 - $options['openrouter_api_key'] = sanitize_text_field($value);
497 - break;
498 -
499 - // REMOVED DUPLICATE case 'openrouter_selected_model_name' HERE!
500 -
74 + switch ($name) {
501 75 case 'additional_popular_questions':
502 76 //error_log('MXChat Save: Processing additional_popular_questions');
503 77 $questions = json_decode($value, true); // No need for stripslashes here
504 78 if (is_array($questions)) {
505 - $options[$field_name] = $questions;
79 + $options[$name] = $questions;
506 80 // Also update old option for backwards compatibility
507 81 update_option('additional_popular_questions', $questions);
508 82 //error_log('MXChat Save: Saved ' . count($questions) . ' additional questions');
509 83 } else {
@@ -512,197 +86,55 @@
512 86 break;
513 87 case 'email_blocker_header_content':
514 88 //error_log('MXChat Save: Processing email_blocker_header_content');
515 89 // Allow HTML content but sanitize it safely
516 - $options[$field_name] = wp_kses_post($value);
90 + $options[$name] = wp_kses_post($value);
517 91 break;
518 - case 'intro_message':
519 - // Stored-XSS hardening (Wordfence CWE-79, plan-3f8158): sanitize on save as
520 - // defense in depth. wp_kses_post mirrors mxchat_sanitize() (the options.php
521 - // save path) so both save routes treat intro_message identically and strip
522 - // <script>/</textarea> breakout while keeping basic formatting + {visitor_name}.
523 - $options[$field_name] = wp_kses_post($value);
524 - break;
525 92 case 'email_blocker_button_text':
526 93 //error_log('MXChat Save: Processing email_blocker_button_text');
527 - $options[$field_name] = sanitize_text_field($value);
94 + $options[$name] = sanitize_text_field($value);
528 95 break;
529 96 case 'name_field_placeholder':
530 97 //error_log('MXChat Save: Processing name_field_placeholder');
531 - $options[$field_name] = sanitize_text_field($value);
98 + $options[$name] = sanitize_text_field($value);
532 99 break;
533 100 case 'similarity_threshold':
534 101 //error_log('MXChat Save: Processing similarity_threshold');
535 - // Validate and save - enforce min 20, max 85
536 - $threshold = intval($value);
537 - if ($threshold < 20) $threshold = 20;
538 - if ($threshold > 85) $threshold = 85;
539 - $options[$field_name] = $threshold;
102 + // Save to the options array
103 + $options[$name] = $value;
540 104 break;
541 - case 'rag_sources_limit':
542 - //error_log('MXChat Save: Processing rag_sources_limit');
543 - // Validate and save - enforce min 3, max 10, default 6
544 - $rag_limit = intval($value);
545 - if ($rag_limit < 3) $rag_limit = 3;
546 - if ($rag_limit > 10) $rag_limit = 10;
547 - $options[$field_name] = $rag_limit;
105 + case 'user_message_bg_color':
106 + case 'user_message_font_color':
107 + case 'bot_message_bg_color':
108 + case 'bot_message_font_color':
109 + case 'top_bar_bg_color':
110 + case 'send_button_font_color':
111 + case 'chatbot_background_color':
112 + case 'icon_color':
113 + case 'chat_input_font_color':
114 + case 'live_agent_message_bg_color':
115 + case 'live_agent_message_font_color':
116 + case 'mode_indicator_bg_color':
117 + case 'mode_indicator_font_color':
118 + case 'toolbar_icon_color':
119 + case 'quick_questions_toggle_color':
120 + //error_log('MXChat Save: Processing color value: ' . $name);
121 + // Store color values directly
122 + $options[$name] = $value;
548 123 break;
549 - case 'rag_chunks_limit':
550 - // Validate and save - enforce min 8, max 20, default 15
551 - $chunks_limit = intval($value);
552 - if ($chunks_limit < 8) $chunks_limit = 8;
553 - if ($chunks_limit > 20) $chunks_limit = 20;
554 - $options[$field_name] = $chunks_limit;
555 - break;
556 124 case 'live_agent_status':
557 125 //error_log('MXChat Save: Processing live_agent_status');
558 126 // Set the new value
559 - $options[$field_name] = ($value === 'on') ? 'on' : 'off';
127 + $options[$name] = ($value === 'on') ? 'on' : 'off';
560 128 break;
561 - case 'enable_web_search':
562 - //error_log('MXChat Save: Processing enable_web_search');
563 - $options[$field_name] = ($value === 'on') ? 'on' : 'off';
564 - break;
565 129 case 'enable_woocommerce_integration':
566 130 //error_log('MXChat Save: Processing enable_woocommerce_integration');
567 131 // Handle values that used to be 1/0
568 - $options[$field_name] = ($value === 'on' || $value === '1') ? 'on' : 'off';
132 + $options[$name] = ($value === 'on' || $value === '1') ? 'on' : 'off';
569 133 break;
570 - case 'post_type_visibility_mode':
571 - // Validate mode value
572 - $allowed_modes = array('all', 'include', 'exclude');
573 - $options[$field_name] = in_array($value, $allowed_modes) ? $value : 'all';
574 - break;
575 - case 'post_type_visibility_list':
576 - // Handle JSON array of post types
577 - $post_types = json_decode($value, true);
578 - if (is_array($post_types)) {
579 - // Sanitize each post type slug
580 - $options[$field_name] = array_map('sanitize_key', $post_types);
581 - } else {
582 - $options[$field_name] = array();
583 - }
584 - break;
585 - case 'script_loading_strategy':
586 - // Validate script loading strategy value
587 - $allowed_strategies = array('default', 'defer', 'delay_1s', 'delay_3s', 'delay_5s', 'on_interaction');
588 - $options[$field_name] = in_array($value, $allowed_strategies) ? $value : 'default';
589 - break;
590 - case 'auto_retry_on_transient_error':
591 - // Boolean toggle — accept 1/0/on/off, default to '1' if any truthy value.
592 - $options[$field_name] = ($value === '1' || $value === 'on' || $value === 1 || $value === true) ? '1' : '0';
593 - break;
594 134 default:
595 - // Handle transcripts options
596 - if (strpos($name, 'mxchat_transcripts_options') !== false) {
597 - // Extract field name from mxchat_transcripts_options[field_name]
598 - if (preg_match('/mxchat_transcripts_options\[([^\]]+)\]/', $name, $matches)) {
599 - $field_name = $matches[1];
600 -
601 - // Get current transcripts options
602 - $transcripts_options = get_option('mxchat_transcripts_options', array());
603 -
604 - // Ensure it's an array
605 - if (!is_array($transcripts_options)) {
606 - $transcripts_options = array();
607 - }
608 -
609 - // Handle checkbox values (convert 'on'/'off' to 1/0)
610 - if ($value === 'on' || $value === '1') {
611 - $transcripts_options[$field_name] = 1;
612 - } else if ($value === 'off' || $value === '0' || $value === '') {
613 - $transcripts_options[$field_name] = 0;
614 - } else {
615 - // For text/select fields, sanitize appropriately
616 - if ($field_name === 'mxchat_notification_email') {
617 - $transcripts_options[$field_name] = sanitize_email($value);
618 - } else {
619 - $transcripts_options[$field_name] = sanitize_text_field($value);
620 - }
621 - }
622 -
623 - // Use direct database update to bypass any filters
624 - global $wpdb;
625 -
626 - // Serialize the options array
627 - $serialized = maybe_serialize($transcripts_options);
628 -
629 - // Check if the option already exists in the database
630 - $existing = $wpdb->get_var("SELECT option_id FROM {$wpdb->options} WHERE option_name = 'mxchat_transcripts_options'");
631 -
632 - if ($existing) {
633 - // Option exists, do an update
634 - $result = $wpdb->update(
635 - $wpdb->options,
636 - array('option_value' => $serialized),
637 - array('option_name' => 'mxchat_transcripts_options'),
638 - array('%s'),
639 - array('%s')
640 - );
641 - } else {
642 - // Option doesn't exist (new install), do an insert
643 - $result = $wpdb->insert(
644 - $wpdb->options,
645 - array(
646 - 'option_name' => 'mxchat_transcripts_options',
647 - 'option_value' => $serialized,
648 - 'autoload' => 'yes'
649 - ),
650 - array('%s', '%s', '%s')
651 - );
652 - }
653 -
654 - // Clear all caches after direct DB update
655 - wp_cache_delete('mxchat_transcripts_options', 'options');
656 - wp_cache_delete('alloptions', 'options');
657 - wp_cache_flush();
658 -
659 - wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
660 - return;
661 - }
662 - }
663 - // Whole-chatbot global cap (sits in mxchat_options['rate_limits_global']).
664 - // Field names: mxchat_options[rate_limits_global][limit|timeframe|limit_custom]
665 - else if (strpos($name, 'mxchat_options[rate_limits_global]') !== false) {
666 - preg_match('/\[rate_limits_global\]\[(.*?)\]/', $name, $matches);
667 - if (isset($matches[1])) {
668 - $setting_key = $matches[1];
669 - if (!isset($options['rate_limits_global']) || !is_array($options['rate_limits_global'])) {
670 - $options['rate_limits_global'] = array('limit' => 'unlimited', 'timeframe' => 'daily');
671 - }
672 - if ($setting_key === 'limit') {
673 - // Selection from the preset dropdown. If __custom__, resolve from limit_custom; otherwise store directly.
674 - if ($value === '__custom__') {
675 - $custom = isset($options['rate_limits_global']['limit_custom']) ? (string) $options['rate_limits_global']['limit_custom'] : '';
676 - if ($custom !== '' && ctype_digit($custom) && (int) $custom >= 1) {
677 - $options['rate_limits_global']['limit'] = $custom;
678 - }
679 - // else leave existing limit untouched until the custom value arrives
680 - } else {
681 - $options['rate_limits_global']['limit'] = $value;
682 - }
683 - } elseif ($setting_key === 'limit_custom') {
684 - $clean = preg_replace('/[^0-9]/', '', (string) $value);
685 - $options['rate_limits_global']['limit_custom'] = $clean;
686 - // Mirror a valid custom value into limit UNCONDITIONALLY (plan-74eb86).
687 - // The custom number input is only editable when the dropdown is on
688 - // "Custom…" (the toggle JS hides it for presets/unlimited) and autosave
689 - // sends one field per change event, so a limit_custom change only fires
690 - // in custom mode — there is no preset to clobber. The old guard required
691 - // limit to already be non-preset, which it isn't on a first-time custom
692 - // entry (the limit=__custom__ event arrives before limit_custom is set),
693 - // so the value never landed in limit on the first save and reverted on refresh.
694 - if ($clean !== '' && (int) $clean >= 1) {
695 - $options['rate_limits_global']['limit'] = $clean;
696 - }
697 - } elseif ($setting_key === 'timeframe') {
698 - $allowed_tf = array('hourly','daily','weekly','monthly');
699 - $options['rate_limits_global']['timeframe'] = in_array($value, $allowed_tf, true) ? $value : 'daily';
700 - }
701 - }
702 - }
703 135 // First check for rate limits settings
704 - else if (strpos($name, 'mxchat_options[rate_limits]') !== false) {
136 + if (strpos($name, 'mxchat_options[rate_limits]') !== false) {
705 137 //error_log('MXChat Save: Detected rate_limits field: ' . $name);
706 138
707 139 // Extract role ID and setting from the name
708 140 preg_match('/\[rate_limits\]\[(.*?)\]\[(.*?)\]/', $name, $matches);
@@ -709,9 +141,9 @@
709 141 //error_log('MXChat Save: Regex matches: ' . print_r($matches, true));
710 142
711 143 if (isset($matches[1]) && isset($matches[2])) {
712 144 $role_id = $matches[1];
713 - $setting_key = $matches[2]; // limit, timeframe, message, or limit_custom
145 + $setting_key = $matches[2]; // limit, timeframe, or message
714 146
715 147 //error_log('MXChat Save: Role ID = ' . $role_id . ', Setting Key = ' . $setting_key);
716 148
717 149 // Initialize rate_limits if it doesn't exist
@@ -729,32 +161,10 @@
729 161 'message' => 'Rate limit exceeded. Please try again later.'
730 162 ];
731 163 }
732 164
733 - if ($setting_key === 'limit') {
734 - if ($value === '__custom__') {
735 - // Pull the integer from limit_custom that may have arrived (or will arrive).
736 - $custom = isset($options['rate_limits'][$role_id]['limit_custom']) ? (string) $options['rate_limits'][$role_id]['limit_custom'] : '';
737 - if ($custom !== '' && ctype_digit($custom) && (int) $custom >= 1) {
738 - $options['rate_limits'][$role_id]['limit'] = $custom;
739 - }
740 - } else {
741 - $options['rate_limits'][$role_id]['limit'] = $value;
742 - }
743 - } elseif ($setting_key === 'limit_custom') {
744 - $clean = preg_replace('/[^0-9]/', '', (string) $value);
745 - $options['rate_limits'][$role_id]['limit_custom'] = $clean;
746 - // Mirror a valid custom value into limit UNCONDITIONALLY — same reasoning
747 - // as the global branch above (plan-74eb86). The per-role custom input is
748 - // only editable in custom mode and autosave is one-field-per-change, so
749 - // this never clobbers a preset; it fixes the first-time-save revert.
750 - if ($clean !== '' && (int) $clean >= 1) {
751 - $options['rate_limits'][$role_id]['limit'] = $clean;
752 - }
753 - } else {
754 - // Update the specific setting (timeframe, message)
755 - $options['rate_limits'][$role_id][$setting_key] = $value;
756 - }
165 + // Update the specific setting
166 + $options['rate_limits'][$role_id][$setting_key] = $value;
757 167 //error_log('MXChat Save: Updated rate_limits[' . $role_id . '][' . $setting_key . '] = ' . $value);
758 168 } else {
759 169 //error_log('MXChat Save: Failed to parse rate_limits pattern: ' . $name);
760 170 }
@@ -779,10 +189,10 @@
779 189 } else {
780 190 //error_log('MXChat Save: Failed to parse role_rate_limits pattern: ' . $name);
781 191 }
782 192 }
783 - // Handle toggles - check both extracted field_name and original name for toggle detection
784 - else if (strpos($field_name, 'toggle') !== false || in_array($field_name, [
193 + // Handle toggles
194 + else if (strpos($name, 'toggle') !== false || in_array($name, [
785 195 'chat_persistence_toggle',
786 196 'privacy_toggle',
787 197 'complianz_toggle',
788 198 'chat_toolbar_toggle',
@@ -789,22 +199,17 @@
789 199 'show_pdf_upload_button',
790 200 'show_word_upload_button',
791 201 'enable_streaming_toggle',
792 202 'contextual_awareness_toggle',
793 - 'citation_links_toggle',
794 203 'enable_email_block',
795 - 'enable_name_field',
796 - 'custom_provider_for_embeddings',
797 - 'custom_provider_for_images',
798 - 'print_button_enabled',
799 - 'reset_chat_enabled'
204 + 'enable_name_field'
800 205 ])) {
801 - //error_log('MXChat Save: Processing toggle: ' . $field_name);
802 - $options[$field_name] = ($value === 'on') ? 'on' : 'off';
206 + //error_log('MXChat Save: Processing toggle: ' . $name);
207 + $options[$name] = ($value === 'on') ? 'on' : 'off';
803 208 } else {
804 - //error_log('MXChat Save: Processing standard field: ' . $field_name);
805 - // Store all other values directly using the extracted field name
806 - $options[$field_name] = $value;
209 + //error_log('MXChat Save: Processing standard field: ' . $name);
210 + // Store all other values directly
211 + $options[$name] = $value;
807 212 }
808 213 break;
809 214 }
810 215
@@ -812,55 +217,13 @@
812 217 $updated = update_option('mxchat_options', $options);
813 218 //error_log('MXChat Save: Update result: ' . ($updated ? 'success' : 'unchanged') . ' for field: ' . $name);
814 219 //error_log('MXChat Save: Updated options array: ' . print_r($options, true));
815 220
816 - // Log the save action if debug mode is enabled
817 - if ( class_exists( 'MxChat_Admin' ) ) {
818 - MxChat_Admin::mxchat_log_debug(
819 - 'settings_save',
820 - sprintf( 'Field saved: %s', $field_name ),
821 - array(
822 - 'field' => $field_name,
823 - 'updated' => $updated,
824 - )
825 - );
826 - }
827 -
828 221 // Always return success even if WordPress says nothing changed
829 222 // (which happens when the value is the same as before)
830 223 wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
831 224 }
832 225
833 -/**
834 - * Save the selected bot for knowledge base operations
835 - */
836 -public function mxchat_save_selected_bot() {
837 - // Check nonce
838 - if (!wp_verify_nonce($_POST['nonce'] ?? '', 'mxchat_save_setting_nonce')) {
839 - wp_send_json_error('Invalid nonce');
840 - }
841 -
842 - // Check permissions
843 - if (!current_user_can('manage_options')) {
844 - wp_send_json_error('Unauthorized');
845 - }
846 -
847 - $bot_id = isset($_POST['bot_id']) ? sanitize_key($_POST['bot_id']) : 'default';
848 -
849 - // Save as user meta for the current user
850 - $user_id = get_current_user_id();
851 - update_user_meta($user_id, 'mxchat_selected_knowledge_bot', $bot_id);
852 -
853 - // Also save as an option for site-wide default
854 - update_option('mxchat_current_knowledge_bot', $bot_id);
855 -
856 - // No cache clearing needed since we removed caching
857 -
858 - wp_send_json_success(array(
859 - 'message' => 'Bot selection saved',
860 - 'bot_id' => $bot_id
861 - ));
862 -}
863 226
864 227 /**
865 228 * Handles AJAX request for saving chat settings
866 229 */
@@ -1029,123 +392,8 @@
1029 392 wp_send_json_error(['message' => esc_html__('No changes detected', 'mxchat')]);
1030 393 }
1031 394 }
1032 395
1033 - // Handle chunking settings - use direct DB access to bypass WordPress filters
1034 - if (strpos($name, 'mxchat_chunk') === 0 || $name === 'mxchat_chunking_enabled') {
1035 - global $wpdb;
1036 -
1037 - // Get current options directly from database
1038 - $current_options_raw = $wpdb->get_var(
1039 - $wpdb->prepare(
1040 - "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s",
1041 - 'mxchat_options'
1042 - )
1043 - );
1044 -
1045 - $options = $current_options_raw !== null ? maybe_unserialize($current_options_raw) : array();
1046 - if (!is_array($options)) {
1047 - $options = array();
1048 - }
1049 -
1050 - // Update the specific chunking field
1051 - if ($name === 'mxchat_chunking_enabled') {
1052 - $options['chunking_enabled'] = in_array($value, array('on', '1', 'true', true), true);
1053 - } elseif ($name === 'mxchat_chunk_size') {
1054 - $options['chunk_size'] = max(1000, min(10000, intval($value)));
1055 - }
1056 -
1057 - // Save directly to database
1058 - $serialized_options = maybe_serialize($options);
1059 -
1060 - $option_exists = $wpdb->get_var(
1061 - $wpdb->prepare(
1062 - "SELECT COUNT(*) FROM {$wpdb->options} WHERE option_name = %s",
1063 - 'mxchat_options'
1064 - )
1065 - );
1066 -
1067 - if ($option_exists > 0) {
1068 - $save_result = $wpdb->update(
1069 - $wpdb->options,
1070 - array('option_value' => $serialized_options),
1071 - array('option_name' => 'mxchat_options'),
1072 - array('%s'),
1073 - array('%s')
1074 - );
1075 - } else {
1076 - $save_result = $wpdb->insert(
1077 - $wpdb->options,
1078 - array(
1079 - 'option_name' => 'mxchat_options',
1080 - 'option_value' => $serialized_options,
1081 - 'autoload' => 'yes'
1082 - ),
1083 - array('%s', '%s', '%s')
1084 - );
1085 - }
1086 -
1087 - // Clear object cache for this option
1088 - wp_cache_delete('mxchat_options', 'options');
1089 -
1090 - if ($save_result !== false) {
1091 - wp_send_json_success(['message' => esc_html__('Chunking setting saved', 'mxchat')]);
1092 - } else {
1093 - wp_send_json_error(['message' => esc_html__('Failed to save chunking setting', 'mxchat')]);
1094 - }
1095 - return;
1096 - }
1097 -
1098 - // Handle ACF field exclusion toggles
1099 - if (strpos($name, 'mxchat_acf_field_') === 0) {
1100 - // Extract field name from the input name (e.g., mxchat_acf_field_private_notes -> private_notes)
1101 - $field_name = str_replace('mxchat_acf_field_', '', $name);
1102 - $is_enabled = ($value === 'on' || $value === '1');
1103 -
1104 - // Get current excluded fields
1105 - $excluded_fields = get_option('mxchat_acf_excluded_fields', array());
1106 - if (!is_array($excluded_fields)) {
1107 - $excluded_fields = array();
1108 - }
1109 -
1110 - if ($is_enabled) {
1111 - // Remove from exclusion list (field should be included)
1112 - $excluded_fields = array_values(array_diff($excluded_fields, array($field_name)));
1113 - } else {
1114 - // Add to exclusion list (field should be excluded)
1115 - if (!in_array($field_name, $excluded_fields)) {
1116 - $excluded_fields[] = $field_name;
1117 - }
1118 - }
1119 -
1120 - $updated = update_option('mxchat_acf_excluded_fields', $excluded_fields);
1121 -
1122 - if ($updated || true) { // Always report success since the state may already be correct
1123 - wp_send_json_success([
1124 - 'message' => $is_enabled
1125 - ? sprintf(esc_html__('Field "%s" will be included in imports', 'mxchat'), $field_name)
1126 - : sprintf(esc_html__('Field "%s" will be excluded from imports', 'mxchat'), $field_name)
1127 - ]);
1128 - } else {
1129 - wp_send_json_error(['message' => esc_html__('Failed to save ACF field setting', 'mxchat')]);
1130 - }
1131 - return;
1132 - }
1133 -
1134 - // Handle custom post meta whitelist
1135 - if ($name === 'mxchat_custom_meta_whitelist') {
1136 - $updated = update_option('mxchat_custom_meta_whitelist', sanitize_textarea_field($value));
1137 -
1138 - if ($updated || true) { // Always report success since the state may already be correct
1139 - wp_send_json_success([
1140 - 'message' => esc_html__('Custom meta whitelist saved', 'mxchat')
1141 - ]);
1142 - } else {
1143 - wp_send_json_error(['message' => esc_html__('Failed to save custom meta whitelist', 'mxchat')]);
1144 - }
1145 - return;
1146 - }
1147 -
1148 396 // Handle other prompts options
1149 397 $options = get_option('mxchat_prompts_options', []);
1150 398 $options[$name] = $value;
1151 399 $updated = update_option('mxchat_prompts_options', $options);
@@ -1215,9 +463,9 @@
1215 463 // LICENSE AJAX HANDLERS
1216 464 // ========================================
1217 465
1218 466 /**
1219 - * Validates and activates chat license via AJAX
467 + * Validates and activates chat license via AJAX - FIXED VERSION
1220 468 */
1221 469 public function mxchat_handle_activate_license() {
1222 470 // Check nonce
1223 471 if (!check_ajax_referer('mxchat_activate_license_nonce', 'security', false)) {
@@ -1323,9 +571,9 @@
1323 571 /**
1324 572 * Validates license via AJAX with email and key
1325 573 */
1326 574 public function mxchat_check_license_status() {
1327 - // Verify nonce
575 + // Verify nonce - FIXED: Use the correct nonce string
1328 576 if (!check_ajax_referer('mxchat_activate_license_nonce', 'security', false)) {
1329 577 wp_send_json_error('Security check failed');
1330 578 return;
1331 579 }
@@ -1529,240 +777,8 @@
1529 777 */
1530 778 private function mxchat_get_nonce_action() {
1531 779 return 'mxchat_license_nonce';
1532 780 }
1533 -
1534 - /**
1535 - * Check API key status for all providers
1536 - */
1537 - public function mxchat_check_api_keys() {
1538 - // Check nonce
1539 - if (!wp_verify_nonce($_POST['nonce'] ?? '', 'mxchat_save_setting_nonce')) {
1540 - wp_send_json_error('Invalid nonce');
1541 - }
1542 -
1543 - // Check permissions
1544 - if (!current_user_can('manage_options')) {
1545 - wp_send_json_error('Unauthorized');
1546 - }
1547 -
1548 - // Get current options
1549 - $options = get_option('mxchat_options', array());
1550 -
1551 - // Check which API keys are present
1552 - $api_key_status = array(
1553 - 'openai' => !empty($options['api_key']),
1554 - 'claude' => !empty($options['claude_api_key']),
1555 - 'xai' => !empty($options['xai_api_key']),
1556 - 'deepseek' => !empty($options['deepseek_api_key']),
1557 - 'gemini' => !empty($options['gemini_api_key']),
1558 - 'openrouter' => !empty($options['openrouter_api_key']),
1559 - 'voyage' => !empty($options['voyage_api_key'])
1560 - );
1561 -
1562 - wp_send_json_success($api_key_status);
1563 - }
1564 -
1565 - // ========================================
1566 - // DEBUG & OPTIMIZATION AJAX HANDLERS
1567 - // ========================================
1568 -
1569 - /**
1570 - * Toggle debug mode on/off
1571 - */
1572 - public function mxchat_toggle_debug_mode_callback() {
1573 - // Verify nonce
1574 - if ( ! check_ajax_referer( 'mxchat_save_setting_nonce', '_ajax_nonce', false ) ) {
1575 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1576 - }
1577 -
1578 - // Check permissions
1579 - if ( ! current_user_can( 'manage_options' ) ) {
1580 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1581 - }
1582 -
1583 - $enabled = isset( $_POST['enabled'] ) && $_POST['enabled'] === 'on';
1584 -
1585 - $options = get_option( 'mxchat_options', array() );
1586 -
1587 - if ( $enabled ) {
1588 - $options['debug_mode'] = 'on';
1589 - update_option( 'mxchat_options', $options );
1590 - MxChat_Admin::mxchat_log_debug( 'debug_mode', 'Debug mode enabled' );
1591 - } else {
1592 - // Log before disabling
1593 - MxChat_Admin::mxchat_log_debug( 'debug_mode', 'Debug mode disabled' );
1594 - $options['debug_mode'] = 'off';
1595 - update_option( 'mxchat_options', $options );
1596 - }
1597 -
1598 - wp_send_json_success( array(
1599 - 'message' => $enabled ? esc_html__( 'Debug mode enabled', 'mxchat' ) : esc_html__( 'Debug mode disabled', 'mxchat' ),
1600 - 'enabled' => $enabled,
1601 - ) );
1602 - }
1603 -
1604 - /**
1605 - * Get the debug log entries
1606 - */
1607 - public function mxchat_get_debug_log_callback() {
1608 - // Verify nonce
1609 - if ( ! check_ajax_referer( 'mxchat_save_setting_nonce', '_ajax_nonce', false ) ) {
1610 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1611 - }
1612 -
1613 - // Check permissions
1614 - if ( ! current_user_can( 'manage_options' ) ) {
1615 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1616 - }
1617 -
1618 - $log = MxChat_Admin::mxchat_get_debug_log();
1619 -
1620 - wp_send_json_success( array(
1621 - 'log' => $log,
1622 - 'count' => count( $log ),
1623 - ) );
1624 - }
1625 -
1626 - /**
1627 - * Clear the debug log
1628 - */
1629 - public function mxchat_clear_debug_log_callback() {
1630 - // Verify nonce
1631 - if ( ! check_ajax_referer( 'mxchat_save_setting_nonce', '_ajax_nonce', false ) ) {
1632 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1633 - }
1634 -
1635 - // Check permissions
1636 - if ( ! current_user_can( 'manage_options' ) ) {
1637 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1638 - }
1639 -
1640 - MxChat_Admin::mxchat_clear_debug_log();
1641 -
1642 - // Log that the log was cleared (this will be the first entry in the new log)
1643 - MxChat_Admin::mxchat_log_debug( 'debug_log', 'Debug log cleared by user' );
1644 -
1645 - wp_send_json_success( array( 'message' => esc_html__( 'Debug log cleared', 'mxchat' ) ) );
1646 - }
1647 -
1648 - /**
1649 - * Export settings as JSON
1650 - */
1651 - public function mxchat_export_settings_callback() {
1652 - // Verify nonce
1653 - if ( ! check_ajax_referer( 'mxchat_save_setting_nonce', '_ajax_nonce', false ) ) {
1654 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1655 - }
1656 -
1657 - // Check permissions
1658 - if ( ! current_user_can( 'manage_options' ) ) {
1659 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1660 - }
1661 -
1662 - $export = MxChat_Admin::mxchat_export_settings();
1663 -
1664 - // Log the export
1665 - MxChat_Admin::mxchat_log_debug( 'settings_export', 'Settings exported by user' );
1666 -
1667 - wp_send_json_success( array(
1668 - 'settings' => $export,
1669 - 'filename' => 'mxchat-settings-' . gmdate( 'Y-m-d-His' ) . '.json',
1670 - ) );
1671 - }
1672 -
1673 - /**
1674 - * Reset all settings to defaults
1675 - */
1676 - public function mxchat_reset_all_settings_callback() {
1677 - // Verify nonce
1678 - if ( ! check_ajax_referer( 'mxchat_save_setting_nonce', '_ajax_nonce', false ) ) {
1679 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1680 - }
1681 -
1682 - // Check permissions
1683 - if ( ! current_user_can( 'manage_options' ) ) {
1684 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1685 - }
1686 -
1687 - // Require confirmation code
1688 - $confirmation = isset( $_POST['confirmation'] ) ? sanitize_text_field( wp_unslash( $_POST['confirmation'] ) ) : '';
1689 -
1690 - if ( strtoupper( $confirmation ) !== 'RESET' ) {
1691 - wp_send_json_error( array( 'message' => esc_html__( 'Invalid confirmation code. Please type RESET to confirm.', 'mxchat' ) ) );
1692 - }
1693 -
1694 - // Perform the reset
1695 - MxChat_Admin::mxchat_reset_all_settings();
1696 -
1697 - wp_send_json_success( array( 'message' => esc_html__( 'All settings have been reset to defaults. The page will reload.', 'mxchat' ) ) );
1698 - }
1699 -
1700 - /**
1701 - * Reset the global rate-limit usage counter to zero on demand.
1702 - *
1703 - * Zeroes the WP option mxchat_chat_limit_<bot>_global that the integrator
1704 - * increments per message, then returns a freshly-formatted readout string
1705 - * so the settings page can update without a reload. Does NOT change any
1706 - * enforcement config — purely clears the running counter.
1707 - */
1708 - public function mxchat_reset_global_rate_limit_callback() {
1709 - // Verify nonce
1710 - if ( ! check_ajax_referer( 'mxchat_reset_global_usage', '_ajax_nonce', false ) ) {
1711 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1712 - }
1713 -
1714 - // Check permissions
1715 - if ( ! current_user_can( 'manage_options' ) ) {
1716 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1717 - }
1718 -
1719 - // Resolve the per-bot counter key the same way the integrator does.
1720 - $bot_id = isset( $_POST['bot_id'] ) ? sanitize_key( wp_unslash( $_POST['bot_id'] ) ) : 'default';
1721 - $safe_bot = preg_replace( '/[^a-zA-Z0-9_]/', '_', $bot_id );
1722 - if ( $safe_bot === '' ) {
1723 - $safe_bot = 'default';
1724 - }
1725 - $option_key = 'mxchat_chat_limit_' . $safe_bot . '_global';
1726 -
1727 - $now = time();
1728 - update_option( $option_key, array( 'count' => 0, 'timestamp' => $now ) );
1729 -
1730 - // Recompute the display string so the front-end can update in place.
1731 - $all_options = get_option( 'mxchat_options', array() );
1732 - $global_cfg = isset( $all_options['rate_limits_global'] ) && is_array( $all_options['rate_limits_global'] )
1733 - ? $all_options['rate_limits_global']
1734 - : array();
1735 - $limit_raw = isset( $global_cfg['limit'] ) ? (string) $global_cfg['limit'] : 'unlimited';
1736 - // Defensive: if a raw __custom__ ever slips through, fall back to the custom value.
1737 - if ( ! ctype_digit( $limit_raw ) && isset( $global_cfg['limit_custom'] ) && ctype_digit( (string) $global_cfg['limit_custom'] ) ) {
1738 - $limit_raw = (string) $global_cfg['limit_custom'];
1739 - }
1740 - $timeframe = isset( $global_cfg['timeframe'] ) ? (string) $global_cfg['timeframe'] : 'daily';
1741 - $windows = array( 'hourly' => 3600, 'daily' => 86400, 'weekly' => 604800, 'monthly' => 2592000 );
1742 - $window = isset( $windows[ $timeframe ] ) ? $windows[ $timeframe ] : 86400;
1743 - $reset_at = $now + $window;
1744 - $limit_int = ctype_digit( $limit_raw ) ? (int) $limit_raw : 0;
1745 -
1746 - $text = sprintf(
1747 - /* translators: 1: used count, 2: limit, 3: remaining, 4: human-readable time until reset */
1748 - esc_html__( '%1$s of %2$s used · %3$s left · resets in %4$s', 'mxchat' ),
1749 - number_format_i18n( 0 ),
1750 - number_format_i18n( $limit_int ),
1751 - number_format_i18n( $limit_int ),
1752 - human_time_diff( $now, $reset_at )
1753 - );
1754 -
1755 - wp_send_json_success( array(
1756 - 'count' => 0,
1757 - 'limit' => $limit_int,
1758 - 'left' => $limit_int,
1759 - 'reset_at' => $reset_at,
1760 - 'pct' => 0,
1761 - 'text' => $text,
1762 - 'message' => esc_html__( 'Usage counter reset.', 'mxchat' ),
1763 - ) );
1764 - }
1765 781
1766 782 }
1767 783
1768 784 // Initialize the AJAX handler