PluginProbe
MxChat – AI Chatbot & Content Generation for WordPress / 2.4.6
MxChat – AI Chatbot & Content Generation for WordPress v2.4.6
3.2.21 3.2.20 3.2.19 3.2.18 3.2.17 3.2.16 3.2.15 3.2.14 3.2.12 3.2.13 3.2.11 3.2.10 3.2.9 3.2.8 3.2.7 3.2.6 3.2.5 3.2.4 3.2.3 3.2.2 3.2.1 2.0.3 2.0.4 2.0.5 2.0.6 All 152 releases
← All changes | admin/class-ajax-handler.php +42 -834 3.2.112.4.6 View file →
@@ -37,213 +37,12 @@
37 37
38 38 // Actions & Intents AJAX
39 39 add_action('wp_ajax_mxchat_toggle_action', array($this, 'mxchat_toggle_action'));
40 40 add_action('wp_ajax_mxchat_update_intent_threshold', array($this, 'mxchat_update_intent_threshold'));
41 -
41 +
42 42 add_action('wp_ajax_mxchat_save_selected_bot', array($this, 'mxchat_save_selected_bot'));
43 - add_action('wp_ajax_mxchat_check_api_keys', array($this, 'mxchat_check_api_keys'));
44 -
45 - // Debug & Optimization AJAX
46 - add_action('wp_ajax_mxchat_toggle_debug_mode', array($this, 'mxchat_toggle_debug_mode_callback'));
47 - add_action('wp_ajax_mxchat_get_debug_log', array($this, 'mxchat_get_debug_log_callback'));
48 - add_action('wp_ajax_mxchat_clear_debug_log', array($this, 'mxchat_clear_debug_log_callback'));
49 - add_action('wp_ajax_mxchat_export_settings', array($this, 'mxchat_export_settings_callback'));
50 - add_action('wp_ajax_mxchat_reset_all_settings', array($this, 'mxchat_reset_all_settings_callback'));
51 -
52 - // Global rate-limit usage counter reset (admin-only, nonce-guarded)
53 - add_action('wp_ajax_mxchat_reset_global_rate_limit', array($this, 'mxchat_reset_global_rate_limit_callback'));
54 -
55 - // Custom (OpenAI-compatible) Provider connection test
56 - add_action('wp_ajax_mxchat_test_custom_provider', array($this, 'mxchat_test_custom_provider_callback'));
57 -
58 - // Built-in provider key validation — cheap per-provider auth check (plan-mxchat-20260623-c41f74)
59 - add_action('wp_ajax_mxchat_test_provider_key', array($this, 'mxchat_test_provider_key_callback'));
60 43 }
61 44
62 -/**
63 - * Test connection to a Custom (OpenAI-compatible) provider by hitting its /models endpoint
64 - * with whichever auth scheme the user configured. Reports model count or a clean error.
65 - */
66 -public function mxchat_test_custom_provider_callback() {
67 - check_ajax_referer('mxchat_test_custom_provider');
68 - if (!current_user_can('manage_options')) {
69 - wp_send_json_error(array('message' => esc_html__('Unauthorized', 'mxchat')));
70 - }
71 -
72 - $options = get_option('mxchat_options', array());
73 - $base_url = isset($options['custom_provider_base_url']) ? trim((string) $options['custom_provider_base_url']) : '';
74 - $api_key = isset($options['custom_provider_api_key']) ? trim((string) $options['custom_provider_api_key']) : '';
75 - $auth = isset($options['custom_provider_auth_scheme']) ? $options['custom_provider_auth_scheme'] : 'bearer';
76 - $api_version = isset($options['custom_provider_api_version']) ? trim((string) $options['custom_provider_api_version']) : '';
77 -
78 - if (empty($base_url)) {
79 - wp_send_json_error(array('message' => esc_html__('Base URL is empty. Save it first.', 'mxchat')));
80 - }
81 -
82 - $url = rtrim($base_url, '/') . '/models';
83 - if (!empty($api_version)) {
84 - $url = add_query_arg('api-version', $api_version, $url);
85 - }
86 -
87 - $headers = array('Content-Type' => 'application/json');
88 - if (!empty($api_key)) {
89 - if ($auth === 'api-key') {
90 - $headers['api-key'] = $api_key;
91 - } else {
92 - $headers['Authorization'] = 'Bearer ' . $api_key;
93 - }
94 - }
95 -
96 - $response = wp_remote_get($url, array(
97 - 'headers' => $headers,
98 - 'timeout' => 10,
99 - ));
100 -
101 - if (is_wp_error($response)) {
102 - wp_send_json_error(array('message' => sprintf(esc_html__('Network error: %s', 'mxchat'), esc_html($response->get_error_message()))));
103 - }
104 -
105 - $code = (int) wp_remote_retrieve_response_code($response);
106 - if ($code === 401 || $code === 403) {
107 - wp_send_json_error(array('message' => sprintf(esc_html__('Auth rejected (HTTP %d). Check API key and auth scheme.', 'mxchat'), $code)));
108 - }
109 - if ($code === 404) {
110 - wp_send_json_error(array('message' => esc_html__('Endpoint not found (HTTP 404). Check the Base URL.', 'mxchat')));
111 - }
112 - if ($code < 200 || $code >= 300) {
113 - wp_send_json_error(array('message' => sprintf(esc_html__('Upstream returned HTTP %d.', 'mxchat'), $code)));
114 - }
115 -
116 - $body = json_decode(wp_remote_retrieve_body($response), true);
117 - $count = 0;
118 - if (is_array($body)) {
119 - if (isset($body['data']) && is_array($body['data'])) {
120 - $count = count($body['data']);
121 - } elseif (isset($body['models']) && is_array($body['models'])) {
122 - $count = count($body['models']);
123 - }
124 - }
125 -
126 - wp_send_json_success(array(
127 - 'message' => sprintf(esc_html__('Connection OK — %d model(s) reported.', 'mxchat'), $count),
128 - 'count' => $count,
129 - ));
130 -}
131 -
132 -/**
133 - * Validate a BUILT-IN provider key with the lightest authenticated call per
134 - * provider (a /models or key-info GET — never a generation). Reads the posted
135 - * key value so the owner can test BEFORE saving; falls back to the saved option
136 - * when the field is empty. Mirrors mxchat_test_custom_provider_callback and the
137 - * add-on test buttons (cf5bd5 veo / 8d16f1 perplexity). The key is never logged.
138 - * plan-mxchat-20260623-c41f74.
139 - */
140 -public function mxchat_test_provider_key_callback() {
141 - check_ajax_referer('mxchat_test_provider_key');
142 - if (!current_user_can('manage_options')) {
143 - wp_send_json_error(array('message' => esc_html__('Unauthorized', 'mxchat')));
144 - }
145 -
146 - $provider = isset($_POST['provider']) ? sanitize_key(wp_unslash($_POST['provider'])) : '';
147 - $posted_key = isset($_POST['key']) ? trim((string) wp_unslash($_POST['key'])) : '';
148 -
149 - $option_map = array(
150 - 'openai' => 'api_key',
151 - 'xai' => 'xai_api_key',
152 - 'claude' => 'claude_api_key',
153 - 'deepseek' => 'deepseek_api_key',
154 - 'gemini' => 'gemini_api_key',
155 - 'openrouter' => 'openrouter_api_key',
156 - );
157 - if (!isset($option_map[$provider])) {
158 - wp_send_json_error(array('message' => esc_html__('Unknown provider.', 'mxchat')));
159 - }
160 -
161 - // Prefer the just-typed value (test-before-save); fall back to the saved key.
162 - $key = $posted_key;
163 - if ($key === '') {
164 - $options = get_option('mxchat_options', array());
165 - $key = isset($options[$option_map[$provider]]) ? trim((string) $options[$option_map[$provider]]) : '';
166 - }
167 - if ($key === '') {
168 - wp_send_json_error(array('message' => esc_html__('No API key entered or saved for this provider.', 'mxchat')));
169 - }
170 -
171 - // Lightest authenticated metadata call per provider — model-agnostic, no generation.
172 - $headers = array();
173 - switch ($provider) {
174 - case 'openai':
175 - $url = 'https://api.openai.com/v1/models';
176 - $headers = array('Authorization' => 'Bearer ' . $key);
177 - break;
178 - case 'xai':
179 - $url = 'https://api.x.ai/v1/models';
180 - $headers = array('Authorization' => 'Bearer ' . $key);
181 - break;
182 - case 'deepseek':
183 - $url = 'https://api.deepseek.com/models';
184 - $headers = array('Authorization' => 'Bearer ' . $key);
185 - break;
186 - case 'openrouter':
187 - // /auth/key validates the key itself (the public /models list does not).
188 - $url = 'https://openrouter.ai/api/v1/auth/key';
189 - $headers = array('Authorization' => 'Bearer ' . $key);
190 - break;
191 - case 'gemini':
192 - $url = add_query_arg(array('pageSize' => 1, 'key' => $key), 'https://generativelanguage.googleapis.com/v1beta/models');
193 - break;
194 - case 'claude':
195 - $url = 'https://api.anthropic.com/v1/models';
196 - $headers = array('x-api-key' => $key, 'anthropic-version' => '2023-06-01');
197 - break;
198 - default:
199 - wp_send_json_error(array('message' => esc_html__('Unknown provider.', 'mxchat')));
200 - }
201 -
202 - $response = wp_remote_get($url, array(
203 - 'headers' => $headers,
204 - 'timeout' => 10,
205 - ));
206 -
207 - if (is_wp_error($response)) {
208 - wp_send_json_error(array('message' => sprintf(esc_html__('Network error: %s', 'mxchat'), esc_html($response->get_error_message()))));
209 - }
210 -
211 - $code = (int) wp_remote_retrieve_response_code($response);
212 - if ($code >= 200 && $code < 300) {
213 - wp_send_json_success(array('message' => esc_html__('Key is valid.', 'mxchat')));
214 - }
215 -
216 - // Surface the provider's own error text when present (trimmed; key never echoed).
217 - $detail = '';
218 - $body = json_decode(wp_remote_retrieve_body($response), true);
219 - if (is_array($body)) {
220 - if (isset($body['error']['message'])) {
221 - $detail = $body['error']['message'];
222 - } elseif (isset($body['error']) && is_string($body['error'])) {
223 - $detail = $body['error'];
224 - } elseif (isset($body['message'])) {
225 - $detail = $body['message'];
226 - }
227 - }
228 - $detail = trim((string) $detail);
229 - if (strlen($detail) > 200) {
230 - $detail = substr($detail, 0, 200) . '…';
231 - }
232 -
233 - if ($code === 401 || $code === 403) {
234 - $msg = ($detail !== '')
235 - ? sprintf(esc_html__('Key rejected (HTTP %1$d): %2$s', 'mxchat'), $code, esc_html($detail))
236 - : sprintf(esc_html__('Key rejected (HTTP %d). Check the API key.', 'mxchat'), $code);
237 - wp_send_json_error(array('message' => $msg));
238 - }
239 -
240 - $msg = ($detail !== '')
241 - ? sprintf(esc_html__('Provider returned HTTP %1$d: %2$s', 'mxchat'), $code, esc_html($detail))
242 - : sprintf(esc_html__('Provider returned HTTP %d.', 'mxchat'), $code);
243 - wp_send_json_error(array('message' => $msg));
244 -}
245 -
246 45 // ========================================
247 46 // SETTINGS AJAX HANDLERS
248 47 // ========================================
249 48
@@ -257,10 +56,10 @@
257 56 wp_send_json_error(['message' => esc_html__('Unauthorized', 'mxchat')]);
258 57 }
259 58
260 59 $name = isset($_POST['name']) ? $_POST['name'] : '';
261 - // Remove WP's added slashes before saving (wp_unslash is the canonical form; plan-3f8158).
262 - $value = isset($_POST['value']) ? wp_unslash($_POST['value']) : '';
60 + // Strip slashes from the value before saving
61 + $value = isset($_POST['value']) ? stripslashes($_POST['value']) : '';
263 62
264 63 //error_log('MXChat Save: Processing field name: ' . $name);
265 64 //error_log('MXChat Save: Field value: ' . $value);
266 65
@@ -272,78 +71,15 @@
272 71 // Load the full options array
273 72 $options = get_option('mxchat_options', []);
274 73 //error_log('MXChat Save: Current options array: ' . print_r($options, true));
275 74
276 - // Extract field name from mxchat_options[field_name] format if present
277 - // But preserve the full name for special cases like rate_limits that need the full path
278 - $field_name = $name;
279 - if (preg_match('/^mxchat_options\[([^\[\]]+)\]$/', $name, $matches)) {
280 - $field_name = $matches[1];
281 - }
282 -
283 75 // Handle special cases
284 - switch ($field_name) {
285 - case 'model':
286 - //error_log('MXChat Save: Processing model selection');
287 - //error_log('MXChat Save: Model value received: ' . $value);
288 - //error_log('MXChat Save: Value type: ' . gettype($value));
289 - //error_log('MXChat Save: Value length: ' . strlen($value));
290 - //error_log('MXChat Save: Value === "openrouter": ' . ($value === 'openrouter' ? 'YES' : 'NO'));
291 -
292 - // Allow 'openrouter' or validate against whitelist
293 - if ($value === 'openrouter') {
294 - //error_log('MXChat Save: Setting model to openrouter');
295 - $options['model'] = 'openrouter';
296 - } else {
297 - //error_log('MXChat Save: Checking against whitelist');
298 - // Catalog refactor (plan-d14e89): canonical allowlist lives in
299 - // includes/class-mxchat-model-catalog.php. A new chat model
300 - // added there is automatically accepted by autosave.
301 - if (!class_exists('MxChat_Model_Catalog')) {
302 - require_once plugin_dir_path(dirname(__FILE__)) . 'includes/class-mxchat-model-catalog.php';
303 - }
304 - $allowed_models = MxChat_Model_Catalog::chat_model_ids();
305 -
306 - //error_log('MXChat Save: in_array result: ' . (in_array($value, $allowed_models) ? 'YES' : 'NO'));
307 -
308 - if (in_array($value, $allowed_models)) {
309 - //error_log('MXChat Save: Model is in whitelist, saving');
310 - $options['model'] = sanitize_text_field($value);
311 - } else {
312 - //error_log('MXChat Save: Invalid model rejected: ' . $value);
313 - //error_log('MXChat Save: Allowed models: ' . print_r($allowed_models, true));
314 - wp_send_json_error(['message' => esc_html__('Invalid model selected', 'mxchat')]);
315 - return;
316 - }
317 - }
318 - break;
319 -
320 - case 'openrouter_selected_model':
321 - //error_log('MXChat Save: Processing OpenRouter model: ' . $value);
322 - $options['openrouter_selected_model'] = sanitize_text_field($value);
323 - // Force immediate save for new keys
324 - //error_log('MXChat Save: OpenRouter model saved immediately');
325 - break;
326 -
327 - case 'openrouter_selected_model_name':
328 - //error_log('MXChat Save: Processing OpenRouter model name: ' . $value);
329 - $options['openrouter_selected_model_name'] = sanitize_text_field($value);
330 - // Force immediate save for new keys
331 - //error_log('MXChat Save: OpenRouter model name saved immediately');
332 - break;
333 -
334 - case 'openrouter_api_key':
335 - //error_log('MXChat Save: Processing OpenRouter API key');
336 - $options['openrouter_api_key'] = sanitize_text_field($value);
337 - break;
338 -
339 - // REMOVED DUPLICATE case 'openrouter_selected_model_name' HERE!
340 -
76 + switch ($name) {
341 77 case 'additional_popular_questions':
342 78 //error_log('MXChat Save: Processing additional_popular_questions');
343 79 $questions = json_decode($value, true); // No need for stripslashes here
344 80 if (is_array($questions)) {
345 - $options[$field_name] = $questions;
81 + $options[$name] = $questions;
346 82 // Also update old option for backwards compatibility
347 83 update_option('additional_popular_questions', $questions);
348 84 //error_log('MXChat Save: Saved ' . count($questions) . ' additional questions');
349 85 } else {
@@ -352,197 +88,55 @@
352 88 break;
353 89 case 'email_blocker_header_content':
354 90 //error_log('MXChat Save: Processing email_blocker_header_content');
355 91 // Allow HTML content but sanitize it safely
356 - $options[$field_name] = wp_kses_post($value);
92 + $options[$name] = wp_kses_post($value);
357 93 break;
358 - case 'intro_message':
359 - // Stored-XSS hardening (Wordfence CWE-79, plan-3f8158): sanitize on save as
360 - // defense in depth. wp_kses_post mirrors mxchat_sanitize() (the options.php
361 - // save path) so both save routes treat intro_message identically and strip
362 - // <script>/</textarea> breakout while keeping basic formatting + {visitor_name}.
363 - $options[$field_name] = wp_kses_post($value);
364 - break;
365 94 case 'email_blocker_button_text':
366 95 //error_log('MXChat Save: Processing email_blocker_button_text');
367 - $options[$field_name] = sanitize_text_field($value);
96 + $options[$name] = sanitize_text_field($value);
368 97 break;
369 98 case 'name_field_placeholder':
370 99 //error_log('MXChat Save: Processing name_field_placeholder');
371 - $options[$field_name] = sanitize_text_field($value);
100 + $options[$name] = sanitize_text_field($value);
372 101 break;
373 102 case 'similarity_threshold':
374 103 //error_log('MXChat Save: Processing similarity_threshold');
375 - // Validate and save - enforce min 20, max 85
376 - $threshold = intval($value);
377 - if ($threshold < 20) $threshold = 20;
378 - if ($threshold > 85) $threshold = 85;
379 - $options[$field_name] = $threshold;
104 + // Save to the options array
105 + $options[$name] = $value;
380 106 break;
381 - case 'rag_sources_limit':
382 - //error_log('MXChat Save: Processing rag_sources_limit');
383 - // Validate and save - enforce min 3, max 10, default 6
384 - $rag_limit = intval($value);
385 - if ($rag_limit < 3) $rag_limit = 3;
386 - if ($rag_limit > 10) $rag_limit = 10;
387 - $options[$field_name] = $rag_limit;
107 + case 'user_message_bg_color':
108 + case 'user_message_font_color':
109 + case 'bot_message_bg_color':
110 + case 'bot_message_font_color':
111 + case 'top_bar_bg_color':
112 + case 'send_button_font_color':
113 + case 'chatbot_background_color':
114 + case 'icon_color':
115 + case 'chat_input_font_color':
116 + case 'live_agent_message_bg_color':
117 + case 'live_agent_message_font_color':
118 + case 'mode_indicator_bg_color':
119 + case 'mode_indicator_font_color':
120 + case 'toolbar_icon_color':
121 + case 'quick_questions_toggle_color':
122 + //error_log('MXChat Save: Processing color value: ' . $name);
123 + // Store color values directly
124 + $options[$name] = $value;
388 125 break;
389 - case 'rag_chunks_limit':
390 - // Validate and save - enforce min 8, max 20, default 15
391 - $chunks_limit = intval($value);
392 - if ($chunks_limit < 8) $chunks_limit = 8;
393 - if ($chunks_limit > 20) $chunks_limit = 20;
394 - $options[$field_name] = $chunks_limit;
395 - break;
396 126 case 'live_agent_status':
397 127 //error_log('MXChat Save: Processing live_agent_status');
398 128 // Set the new value
399 - $options[$field_name] = ($value === 'on') ? 'on' : 'off';
129 + $options[$name] = ($value === 'on') ? 'on' : 'off';
400 130 break;
401 - case 'enable_web_search':
402 - //error_log('MXChat Save: Processing enable_web_search');
403 - $options[$field_name] = ($value === 'on') ? 'on' : 'off';
404 - break;
405 131 case 'enable_woocommerce_integration':
406 132 //error_log('MXChat Save: Processing enable_woocommerce_integration');
407 133 // Handle values that used to be 1/0
408 - $options[$field_name] = ($value === 'on' || $value === '1') ? 'on' : 'off';
134 + $options[$name] = ($value === 'on' || $value === '1') ? 'on' : 'off';
409 135 break;
410 - case 'post_type_visibility_mode':
411 - // Validate mode value
412 - $allowed_modes = array('all', 'include', 'exclude');
413 - $options[$field_name] = in_array($value, $allowed_modes) ? $value : 'all';
414 - break;
415 - case 'post_type_visibility_list':
416 - // Handle JSON array of post types
417 - $post_types = json_decode($value, true);
418 - if (is_array($post_types)) {
419 - // Sanitize each post type slug
420 - $options[$field_name] = array_map('sanitize_key', $post_types);
421 - } else {
422 - $options[$field_name] = array();
423 - }
424 - break;
425 - case 'script_loading_strategy':
426 - // Validate script loading strategy value
427 - $allowed_strategies = array('default', 'defer', 'delay_1s', 'delay_3s', 'delay_5s', 'on_interaction');
428 - $options[$field_name] = in_array($value, $allowed_strategies) ? $value : 'default';
429 - break;
430 - case 'auto_retry_on_transient_error':
431 - // Boolean toggle — accept 1/0/on/off, default to '1' if any truthy value.
432 - $options[$field_name] = ($value === '1' || $value === 'on' || $value === 1 || $value === true) ? '1' : '0';
433 - break;
434 136 default:
435 - // Handle transcripts options
436 - if (strpos($name, 'mxchat_transcripts_options') !== false) {
437 - // Extract field name from mxchat_transcripts_options[field_name]
438 - if (preg_match('/mxchat_transcripts_options\[([^\]]+)\]/', $name, $matches)) {
439 - $field_name = $matches[1];
440 -
441 - // Get current transcripts options
442 - $transcripts_options = get_option('mxchat_transcripts_options', array());
443 -
444 - // Ensure it's an array
445 - if (!is_array($transcripts_options)) {
446 - $transcripts_options = array();
447 - }
448 -
449 - // Handle checkbox values (convert 'on'/'off' to 1/0)
450 - if ($value === 'on' || $value === '1') {
451 - $transcripts_options[$field_name] = 1;
452 - } else if ($value === 'off' || $value === '0' || $value === '') {
453 - $transcripts_options[$field_name] = 0;
454 - } else {
455 - // For text/select fields, sanitize appropriately
456 - if ($field_name === 'mxchat_notification_email') {
457 - $transcripts_options[$field_name] = sanitize_email($value);
458 - } else {
459 - $transcripts_options[$field_name] = sanitize_text_field($value);
460 - }
461 - }
462 -
463 - // Use direct database update to bypass any filters
464 - global $wpdb;
465 -
466 - // Serialize the options array
467 - $serialized = maybe_serialize($transcripts_options);
468 -
469 - // Check if the option already exists in the database
470 - $existing = $wpdb->get_var("SELECT option_id FROM {$wpdb->options} WHERE option_name = 'mxchat_transcripts_options'");
471 -
472 - if ($existing) {
473 - // Option exists, do an update
474 - $result = $wpdb->update(
475 - $wpdb->options,
476 - array('option_value' => $serialized),
477 - array('option_name' => 'mxchat_transcripts_options'),
478 - array('%s'),
479 - array('%s')
480 - );
481 - } else {
482 - // Option doesn't exist (new install), do an insert
483 - $result = $wpdb->insert(
484 - $wpdb->options,
485 - array(
486 - 'option_name' => 'mxchat_transcripts_options',
487 - 'option_value' => $serialized,
488 - 'autoload' => 'yes'
489 - ),
490 - array('%s', '%s', '%s')
491 - );
492 - }
493 -
494 - // Clear all caches after direct DB update
495 - wp_cache_delete('mxchat_transcripts_options', 'options');
496 - wp_cache_delete('alloptions', 'options');
497 - wp_cache_flush();
498 -
499 - wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
500 - return;
501 - }
502 - }
503 - // Whole-chatbot global cap (sits in mxchat_options['rate_limits_global']).
504 - // Field names: mxchat_options[rate_limits_global][limit|timeframe|limit_custom]
505 - else if (strpos($name, 'mxchat_options[rate_limits_global]') !== false) {
506 - preg_match('/\[rate_limits_global\]\[(.*?)\]/', $name, $matches);
507 - if (isset($matches[1])) {
508 - $setting_key = $matches[1];
509 - if (!isset($options['rate_limits_global']) || !is_array($options['rate_limits_global'])) {
510 - $options['rate_limits_global'] = array('limit' => 'unlimited', 'timeframe' => 'daily');
511 - }
512 - if ($setting_key === 'limit') {
513 - // Selection from the preset dropdown. If __custom__, resolve from limit_custom; otherwise store directly.
514 - if ($value === '__custom__') {
515 - $custom = isset($options['rate_limits_global']['limit_custom']) ? (string) $options['rate_limits_global']['limit_custom'] : '';
516 - if ($custom !== '' && ctype_digit($custom) && (int) $custom >= 1) {
517 - $options['rate_limits_global']['limit'] = $custom;
518 - }
519 - // else leave existing limit untouched until the custom value arrives
520 - } else {
521 - $options['rate_limits_global']['limit'] = $value;
522 - }
523 - } elseif ($setting_key === 'limit_custom') {
524 - $clean = preg_replace('/[^0-9]/', '', (string) $value);
525 - $options['rate_limits_global']['limit_custom'] = $clean;
526 - // Mirror a valid custom value into limit UNCONDITIONALLY (plan-74eb86).
527 - // The custom number input is only editable when the dropdown is on
528 - // "Custom…" (the toggle JS hides it for presets/unlimited) and autosave
529 - // sends one field per change event, so a limit_custom change only fires
530 - // in custom mode — there is no preset to clobber. The old guard required
531 - // limit to already be non-preset, which it isn't on a first-time custom
532 - // entry (the limit=__custom__ event arrives before limit_custom is set),
533 - // so the value never landed in limit on the first save and reverted on refresh.
534 - if ($clean !== '' && (int) $clean >= 1) {
535 - $options['rate_limits_global']['limit'] = $clean;
536 - }
537 - } elseif ($setting_key === 'timeframe') {
538 - $allowed_tf = array('hourly','daily','weekly','monthly');
539 - $options['rate_limits_global']['timeframe'] = in_array($value, $allowed_tf, true) ? $value : 'daily';
540 - }
541 - }
542 - }
543 137 // First check for rate limits settings
544 - else if (strpos($name, 'mxchat_options[rate_limits]') !== false) {
138 + if (strpos($name, 'mxchat_options[rate_limits]') !== false) {
545 139 //error_log('MXChat Save: Detected rate_limits field: ' . $name);
546 140
547 141 // Extract role ID and setting from the name
548 142 preg_match('/\[rate_limits\]\[(.*?)\]\[(.*?)\]/', $name, $matches);
@@ -549,9 +143,9 @@
549 143 //error_log('MXChat Save: Regex matches: ' . print_r($matches, true));
550 144
551 145 if (isset($matches[1]) && isset($matches[2])) {
552 146 $role_id = $matches[1];
553 - $setting_key = $matches[2]; // limit, timeframe, message, or limit_custom
147 + $setting_key = $matches[2]; // limit, timeframe, or message
554 148
555 149 //error_log('MXChat Save: Role ID = ' . $role_id . ', Setting Key = ' . $setting_key);
556 150
557 151 // Initialize rate_limits if it doesn't exist
@@ -569,32 +163,10 @@
569 163 'message' => 'Rate limit exceeded. Please try again later.'
570 164 ];
571 165 }
572 166
573 - if ($setting_key === 'limit') {
574 - if ($value === '__custom__') {
575 - // Pull the integer from limit_custom that may have arrived (or will arrive).
576 - $custom = isset($options['rate_limits'][$role_id]['limit_custom']) ? (string) $options['rate_limits'][$role_id]['limit_custom'] : '';
577 - if ($custom !== '' && ctype_digit($custom) && (int) $custom >= 1) {
578 - $options['rate_limits'][$role_id]['limit'] = $custom;
579 - }
580 - } else {
581 - $options['rate_limits'][$role_id]['limit'] = $value;
582 - }
583 - } elseif ($setting_key === 'limit_custom') {
584 - $clean = preg_replace('/[^0-9]/', '', (string) $value);
585 - $options['rate_limits'][$role_id]['limit_custom'] = $clean;
586 - // Mirror a valid custom value into limit UNCONDITIONALLY — same reasoning
587 - // as the global branch above (plan-74eb86). The per-role custom input is
588 - // only editable in custom mode and autosave is one-field-per-change, so
589 - // this never clobbers a preset; it fixes the first-time-save revert.
590 - if ($clean !== '' && (int) $clean >= 1) {
591 - $options['rate_limits'][$role_id]['limit'] = $clean;
592 - }
593 - } else {
594 - // Update the specific setting (timeframe, message)
595 - $options['rate_limits'][$role_id][$setting_key] = $value;
596 - }
167 + // Update the specific setting
168 + $options['rate_limits'][$role_id][$setting_key] = $value;
597 169 //error_log('MXChat Save: Updated rate_limits[' . $role_id . '][' . $setting_key . '] = ' . $value);
598 170 } else {
599 171 //error_log('MXChat Save: Failed to parse rate_limits pattern: ' . $name);
600 172 }
@@ -619,10 +191,10 @@
619 191 } else {
620 192 //error_log('MXChat Save: Failed to parse role_rate_limits pattern: ' . $name);
621 193 }
622 194 }
623 - // Handle toggles - check both extracted field_name and original name for toggle detection
624 - else if (strpos($field_name, 'toggle') !== false || in_array($field_name, [
195 + // Handle toggles
196 + else if (strpos($name, 'toggle') !== false || in_array($name, [
625 197 'chat_persistence_toggle',
626 198 'privacy_toggle',
627 199 'complianz_toggle',
628 200 'chat_toolbar_toggle',
@@ -629,22 +201,17 @@
629 201 'show_pdf_upload_button',
630 202 'show_word_upload_button',
631 203 'enable_streaming_toggle',
632 204 'contextual_awareness_toggle',
633 - 'citation_links_toggle',
634 205 'enable_email_block',
635 - 'enable_name_field',
636 - 'custom_provider_for_embeddings',
637 - 'custom_provider_for_images',
638 - 'print_button_enabled',
639 - 'reset_chat_enabled'
206 + 'enable_name_field'
640 207 ])) {
641 - //error_log('MXChat Save: Processing toggle: ' . $field_name);
642 - $options[$field_name] = ($value === 'on') ? 'on' : 'off';
208 + //error_log('MXChat Save: Processing toggle: ' . $name);
209 + $options[$name] = ($value === 'on') ? 'on' : 'off';
643 210 } else {
644 - //error_log('MXChat Save: Processing standard field: ' . $field_name);
645 - // Store all other values directly using the extracted field name
646 - $options[$field_name] = $value;
211 + //error_log('MXChat Save: Processing standard field: ' . $name);
212 + // Store all other values directly
213 + $options[$name] = $value;
647 214 }
648 215 break;
649 216 }
650 217
@@ -652,20 +219,8 @@
652 219 $updated = update_option('mxchat_options', $options);
653 220 //error_log('MXChat Save: Update result: ' . ($updated ? 'success' : 'unchanged') . ' for field: ' . $name);
654 221 //error_log('MXChat Save: Updated options array: ' . print_r($options, true));
655 222
656 - // Log the save action if debug mode is enabled
657 - if ( class_exists( 'MxChat_Admin' ) ) {
658 - MxChat_Admin::mxchat_log_debug(
659 - 'settings_save',
660 - sprintf( 'Field saved: %s', $field_name ),
661 - array(
662 - 'field' => $field_name,
663 - 'updated' => $updated,
664 - )
665 - );
666 - }
667 -
668 223 // Always return success even if WordPress says nothing changed
669 224 // (which happens when the value is the same as before)
670 225 wp_send_json_success(['message' => esc_html__('Setting saved', 'mxchat')]);
671 226 }
@@ -869,123 +424,8 @@
869 424 wp_send_json_error(['message' => esc_html__('No changes detected', 'mxchat')]);
870 425 }
871 426 }
872 427
873 - // Handle chunking settings - use direct DB access to bypass WordPress filters
874 - if (strpos($name, 'mxchat_chunk') === 0 || $name === 'mxchat_chunking_enabled') {
875 - global $wpdb;
876 -
877 - // Get current options directly from database
878 - $current_options_raw = $wpdb->get_var(
879 - $wpdb->prepare(
880 - "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s",
881 - 'mxchat_options'
882 - )
883 - );
884 -
885 - $options = $current_options_raw !== null ? maybe_unserialize($current_options_raw) : array();
886 - if (!is_array($options)) {
887 - $options = array();
888 - }
889 -
890 - // Update the specific chunking field
891 - if ($name === 'mxchat_chunking_enabled') {
892 - $options['chunking_enabled'] = in_array($value, array('on', '1', 'true', true), true);
893 - } elseif ($name === 'mxchat_chunk_size') {
894 - $options['chunk_size'] = max(1000, min(10000, intval($value)));
895 - }
896 -
897 - // Save directly to database
898 - $serialized_options = maybe_serialize($options);
899 -
900 - $option_exists = $wpdb->get_var(
901 - $wpdb->prepare(
902 - "SELECT COUNT(*) FROM {$wpdb->options} WHERE option_name = %s",
903 - 'mxchat_options'
904 - )
905 - );
906 -
907 - if ($option_exists > 0) {
908 - $save_result = $wpdb->update(
909 - $wpdb->options,
910 - array('option_value' => $serialized_options),
911 - array('option_name' => 'mxchat_options'),
912 - array('%s'),
913 - array('%s')
914 - );
915 - } else {
916 - $save_result = $wpdb->insert(
917 - $wpdb->options,
918 - array(
919 - 'option_name' => 'mxchat_options',
920 - 'option_value' => $serialized_options,
921 - 'autoload' => 'yes'
922 - ),
923 - array('%s', '%s', '%s')
924 - );
925 - }
926 -
927 - // Clear object cache for this option
928 - wp_cache_delete('mxchat_options', 'options');
929 -
930 - if ($save_result !== false) {
931 - wp_send_json_success(['message' => esc_html__('Chunking setting saved', 'mxchat')]);
932 - } else {
933 - wp_send_json_error(['message' => esc_html__('Failed to save chunking setting', 'mxchat')]);
934 - }
935 - return;
936 - }
937 -
938 - // Handle ACF field exclusion toggles
939 - if (strpos($name, 'mxchat_acf_field_') === 0) {
940 - // Extract field name from the input name (e.g., mxchat_acf_field_private_notes -> private_notes)
941 - $field_name = str_replace('mxchat_acf_field_', '', $name);
942 - $is_enabled = ($value === 'on' || $value === '1');
943 -
944 - // Get current excluded fields
945 - $excluded_fields = get_option('mxchat_acf_excluded_fields', array());
946 - if (!is_array($excluded_fields)) {
947 - $excluded_fields = array();
948 - }
949 -
950 - if ($is_enabled) {
951 - // Remove from exclusion list (field should be included)
952 - $excluded_fields = array_values(array_diff($excluded_fields, array($field_name)));
953 - } else {
954 - // Add to exclusion list (field should be excluded)
955 - if (!in_array($field_name, $excluded_fields)) {
956 - $excluded_fields[] = $field_name;
957 - }
958 - }
959 -
960 - $updated = update_option('mxchat_acf_excluded_fields', $excluded_fields);
961 -
962 - if ($updated || true) { // Always report success since the state may already be correct
963 - wp_send_json_success([
964 - 'message' => $is_enabled
965 - ? sprintf(esc_html__('Field "%s" will be included in imports', 'mxchat'), $field_name)
966 - : sprintf(esc_html__('Field "%s" will be excluded from imports', 'mxchat'), $field_name)
967 - ]);
968 - } else {
969 - wp_send_json_error(['message' => esc_html__('Failed to save ACF field setting', 'mxchat')]);
970 - }
971 - return;
972 - }
973 -
974 - // Handle custom post meta whitelist
975 - if ($name === 'mxchat_custom_meta_whitelist') {
976 - $updated = update_option('mxchat_custom_meta_whitelist', sanitize_textarea_field($value));
977 -
978 - if ($updated || true) { // Always report success since the state may already be correct
979 - wp_send_json_success([
980 - 'message' => esc_html__('Custom meta whitelist saved', 'mxchat')
981 - ]);
982 - } else {
983 - wp_send_json_error(['message' => esc_html__('Failed to save custom meta whitelist', 'mxchat')]);
984 - }
985 - return;
986 - }
987 -
988 428 // Handle other prompts options
989 429 $options = get_option('mxchat_prompts_options', []);
990 430 $options[$name] = $value;
991 431 $updated = update_option('mxchat_prompts_options', $options);
@@ -1369,240 +809,8 @@
1369 809 */
1370 810 private function mxchat_get_nonce_action() {
1371 811 return 'mxchat_license_nonce';
1372 812 }
1373 -
1374 - /**
1375 - * Check API key status for all providers
1376 - */
1377 - public function mxchat_check_api_keys() {
1378 - // Check nonce
1379 - if (!wp_verify_nonce($_POST['nonce'] ?? '', 'mxchat_save_setting_nonce')) {
1380 - wp_send_json_error('Invalid nonce');
1381 - }
1382 -
1383 - // Check permissions
1384 - if (!current_user_can('manage_options')) {
1385 - wp_send_json_error('Unauthorized');
1386 - }
1387 -
1388 - // Get current options
1389 - $options = get_option('mxchat_options', array());
1390 -
1391 - // Check which API keys are present
1392 - $api_key_status = array(
1393 - 'openai' => !empty($options['api_key']),
1394 - 'claude' => !empty($options['claude_api_key']),
1395 - 'xai' => !empty($options['xai_api_key']),
1396 - 'deepseek' => !empty($options['deepseek_api_key']),
1397 - 'gemini' => !empty($options['gemini_api_key']),
1398 - 'openrouter' => !empty($options['openrouter_api_key']),
1399 - 'voyage' => !empty($options['voyage_api_key'])
1400 - );
1401 -
1402 - wp_send_json_success($api_key_status);
1403 - }
1404 -
1405 - // ========================================
1406 - // DEBUG & OPTIMIZATION AJAX HANDLERS
1407 - // ========================================
1408 -
1409 - /**
1410 - * Toggle debug mode on/off
1411 - */
1412 - public function mxchat_toggle_debug_mode_callback() {
1413 - // Verify nonce
1414 - if ( ! check_ajax_referer( 'mxchat_save_setting_nonce', '_ajax_nonce', false ) ) {
1415 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1416 - }
1417 -
1418 - // Check permissions
1419 - if ( ! current_user_can( 'manage_options' ) ) {
1420 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1421 - }
1422 -
1423 - $enabled = isset( $_POST['enabled'] ) && $_POST['enabled'] === 'on';
1424 -
1425 - $options = get_option( 'mxchat_options', array() );
1426 -
1427 - if ( $enabled ) {
1428 - $options['debug_mode'] = 'on';
1429 - update_option( 'mxchat_options', $options );
1430 - MxChat_Admin::mxchat_log_debug( 'debug_mode', 'Debug mode enabled' );
1431 - } else {
1432 - // Log before disabling
1433 - MxChat_Admin::mxchat_log_debug( 'debug_mode', 'Debug mode disabled' );
1434 - $options['debug_mode'] = 'off';
1435 - update_option( 'mxchat_options', $options );
1436 - }
1437 -
1438 - wp_send_json_success( array(
1439 - 'message' => $enabled ? esc_html__( 'Debug mode enabled', 'mxchat' ) : esc_html__( 'Debug mode disabled', 'mxchat' ),
1440 - 'enabled' => $enabled,
1441 - ) );
1442 - }
1443 -
1444 - /**
1445 - * Get the debug log entries
1446 - */
1447 - public function mxchat_get_debug_log_callback() {
1448 - // Verify nonce
1449 - if ( ! check_ajax_referer( 'mxchat_save_setting_nonce', '_ajax_nonce', false ) ) {
1450 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1451 - }
1452 -
1453 - // Check permissions
1454 - if ( ! current_user_can( 'manage_options' ) ) {
1455 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1456 - }
1457 -
1458 - $log = MxChat_Admin::mxchat_get_debug_log();
1459 -
1460 - wp_send_json_success( array(
1461 - 'log' => $log,
1462 - 'count' => count( $log ),
1463 - ) );
1464 - }
1465 -
1466 - /**
1467 - * Clear the debug log
1468 - */
1469 - public function mxchat_clear_debug_log_callback() {
1470 - // Verify nonce
1471 - if ( ! check_ajax_referer( 'mxchat_save_setting_nonce', '_ajax_nonce', false ) ) {
1472 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1473 - }
1474 -
1475 - // Check permissions
1476 - if ( ! current_user_can( 'manage_options' ) ) {
1477 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1478 - }
1479 -
1480 - MxChat_Admin::mxchat_clear_debug_log();
1481 -
1482 - // Log that the log was cleared (this will be the first entry in the new log)
1483 - MxChat_Admin::mxchat_log_debug( 'debug_log', 'Debug log cleared by user' );
1484 -
1485 - wp_send_json_success( array( 'message' => esc_html__( 'Debug log cleared', 'mxchat' ) ) );
1486 - }
1487 -
1488 - /**
1489 - * Export settings as JSON
1490 - */
1491 - public function mxchat_export_settings_callback() {
1492 - // Verify nonce
1493 - if ( ! check_ajax_referer( 'mxchat_save_setting_nonce', '_ajax_nonce', false ) ) {
1494 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1495 - }
1496 -
1497 - // Check permissions
1498 - if ( ! current_user_can( 'manage_options' ) ) {
1499 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1500 - }
1501 -
1502 - $export = MxChat_Admin::mxchat_export_settings();
1503 -
1504 - // Log the export
1505 - MxChat_Admin::mxchat_log_debug( 'settings_export', 'Settings exported by user' );
1506 -
1507 - wp_send_json_success( array(
1508 - 'settings' => $export,
1509 - 'filename' => 'mxchat-settings-' . gmdate( 'Y-m-d-His' ) . '.json',
1510 - ) );
1511 - }
1512 -
1513 - /**
1514 - * Reset all settings to defaults
1515 - */
1516 - public function mxchat_reset_all_settings_callback() {
1517 - // Verify nonce
1518 - if ( ! check_ajax_referer( 'mxchat_save_setting_nonce', '_ajax_nonce', false ) ) {
1519 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1520 - }
1521 -
1522 - // Check permissions
1523 - if ( ! current_user_can( 'manage_options' ) ) {
1524 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1525 - }
1526 -
1527 - // Require confirmation code
1528 - $confirmation = isset( $_POST['confirmation'] ) ? sanitize_text_field( wp_unslash( $_POST['confirmation'] ) ) : '';
1529 -
1530 - if ( strtoupper( $confirmation ) !== 'RESET' ) {
1531 - wp_send_json_error( array( 'message' => esc_html__( 'Invalid confirmation code. Please type RESET to confirm.', 'mxchat' ) ) );
1532 - }
1533 -
1534 - // Perform the reset
1535 - MxChat_Admin::mxchat_reset_all_settings();
1536 -
1537 - wp_send_json_success( array( 'message' => esc_html__( 'All settings have been reset to defaults. The page will reload.', 'mxchat' ) ) );
1538 - }
1539 -
1540 - /**
1541 - * Reset the global rate-limit usage counter to zero on demand.
1542 - *
1543 - * Zeroes the WP option mxchat_chat_limit_<bot>_global that the integrator
1544 - * increments per message, then returns a freshly-formatted readout string
1545 - * so the settings page can update without a reload. Does NOT change any
1546 - * enforcement config — purely clears the running counter.
1547 - */
1548 - public function mxchat_reset_global_rate_limit_callback() {
1549 - // Verify nonce
1550 - if ( ! check_ajax_referer( 'mxchat_reset_global_usage', '_ajax_nonce', false ) ) {
1551 - wp_send_json_error( array( 'message' => esc_html__( 'Security check failed', 'mxchat' ) ) );
1552 - }
1553 -
1554 - // Check permissions
1555 - if ( ! current_user_can( 'manage_options' ) ) {
1556 - wp_send_json_error( array( 'message' => esc_html__( 'Unauthorized', 'mxchat' ) ) );
1557 - }
1558 -
1559 - // Resolve the per-bot counter key the same way the integrator does.
1560 - $bot_id = isset( $_POST['bot_id'] ) ? sanitize_key( wp_unslash( $_POST['bot_id'] ) ) : 'default';
1561 - $safe_bot = preg_replace( '/[^a-zA-Z0-9_]/', '_', $bot_id );
1562 - if ( $safe_bot === '' ) {
1563 - $safe_bot = 'default';
1564 - }
1565 - $option_key = 'mxchat_chat_limit_' . $safe_bot . '_global';
1566 -
1567 - $now = time();
1568 - update_option( $option_key, array( 'count' => 0, 'timestamp' => $now ) );
1569 -
1570 - // Recompute the display string so the front-end can update in place.
1571 - $all_options = get_option( 'mxchat_options', array() );
1572 - $global_cfg = isset( $all_options['rate_limits_global'] ) && is_array( $all_options['rate_limits_global'] )
1573 - ? $all_options['rate_limits_global']
1574 - : array();
1575 - $limit_raw = isset( $global_cfg['limit'] ) ? (string) $global_cfg['limit'] : 'unlimited';
1576 - // Defensive: if a raw __custom__ ever slips through, fall back to the custom value.
1577 - if ( ! ctype_digit( $limit_raw ) && isset( $global_cfg['limit_custom'] ) && ctype_digit( (string) $global_cfg['limit_custom'] ) ) {
1578 - $limit_raw = (string) $global_cfg['limit_custom'];
1579 - }
1580 - $timeframe = isset( $global_cfg['timeframe'] ) ? (string) $global_cfg['timeframe'] : 'daily';
1581 - $windows = array( 'hourly' => 3600, 'daily' => 86400, 'weekly' => 604800, 'monthly' => 2592000 );
1582 - $window = isset( $windows[ $timeframe ] ) ? $windows[ $timeframe ] : 86400;
1583 - $reset_at = $now + $window;
1584 - $limit_int = ctype_digit( $limit_raw ) ? (int) $limit_raw : 0;
1585 -
1586 - $text = sprintf(
1587 - /* translators: 1: used count, 2: limit, 3: remaining, 4: human-readable time until reset */
1588 - esc_html__( '%1$s of %2$s used · %3$s left · resets in %4$s', 'mxchat' ),
1589 - number_format_i18n( 0 ),
1590 - number_format_i18n( $limit_int ),
1591 - number_format_i18n( $limit_int ),
1592 - human_time_diff( $now, $reset_at )
1593 - );
1594 -
1595 - wp_send_json_success( array(
1596 - 'count' => 0,
1597 - 'limit' => $limit_int,
1598 - 'left' => $limit_int,
1599 - 'reset_at' => $reset_at,
1600 - 'pct' => 0,
1601 - 'text' => $text,
1602 - 'message' => esc_html__( 'Usage counter reset.', 'mxchat' ),
1603 - ) );
1604 - }
1605 813
1606 814 }
1607 815
1608 816 // Initialize the AJAX handler