| @@ -232,8 +232,29 @@ | ||
| 232 | 232 | $name_field_placeholder = isset($current_options['name_field_placeholder']) ? |
| 233 | 233 | esc_attr($current_options['name_field_placeholder']) : |
| 234 | 234 | esc_attr__('Enter your name', 'mxchat'); |
| 235 | 235 | |
| 236 | + // Require Email Address (c0cfaf). Default ON — absent key means required, | |
| 237 | + // so existing installs render the same markup they always have. | |
| 238 | + $require_email_field = ($current_options['lead_capture_require_email_toggle'] ?? 'on') === 'on'; | |
| 239 | + | |
| 240 | + // Pre-fill the form from the profile when a signed-in visitor is being | |
| 241 | + // shown it (c0cfaf). Emitted ONLY for a logged-in request, so the markup a | |
| 242 | + // guest gets — the copy a page cache actually stores and re-serves — never | |
| 243 | + // carries anyone's address. WordPress already marks logged-in responses | |
| 244 | + // uncacheable, and such a page carries per-user data from other plugins | |
| 245 | + // regardless. | |
| 246 | + $prefill_email_attr = ''; | |
| 247 | + $prefill_name_attr = ''; | |
| 248 | + if (is_user_logged_in()) { | |
| 249 | + if ($user_email !== '') { | |
| 250 | + $prefill_email_attr = ' value="' . esc_attr($user_email) . '"'; | |
| 251 | + } | |
| 252 | + if ($user_name !== '') { | |
| 253 | + $prefill_name_attr = ' value="' . esc_attr($user_name) . '"'; | |
| 254 | + } | |
| 255 | + } | |
| 256 | + | |
| 236 | 257 | // Consent checkbox (b062c4). Default OFF — with the toggle off this block |
| 237 | 258 | // renders nothing and the form markup is byte-identical to before. |
| 238 | 259 | $enable_consent_checkbox = isset($current_options['enable_consent_checkbox']) && |
| 239 | 260 | ($current_options['enable_consent_checkbox'] === '1' || $current_options['enable_consent_checkbox'] === 'on'); |
| @@ -310,13 +331,17 @@ | ||
| 310 | 331 | |
| 311 | 332 | // Add name field if enabled |
| 312 | 333 | if ($enable_name_field) { |
| 313 | 334 | echo ' <label for="user-name-' . esc_attr($bot_id) . '" class="sr-only mxchat-name-label">' . esc_html__('Name', 'mxchat') . '</label>'; |
| 314 | - echo ' <input type="text" id="user-name-' . esc_attr($bot_id) . '" name="user_name" class="mxchat-name-input" required placeholder="' . $name_field_placeholder . '" />'; | |
| 335 | + echo ' <input type="text" id="user-name-' . esc_attr($bot_id) . '" name="user_name" class="mxchat-name-input" required' . $prefill_name_attr . ' placeholder="' . $name_field_placeholder . '" />'; | |
| 315 | 336 | } |
| 316 | 337 | |
| 338 | + // The email field drops its required attribute when the owner | |
| 339 | + // has made it optional (c0cfaf). Like the consent checkbox, | |
| 340 | + // the attribute is UX only — the save endpoint re-enforces the | |
| 341 | + // rule server-side, so a direct POST cannot bypass it. | |
| 317 | 342 | echo ' <label for="user-email-' . esc_attr($bot_id) . '" class="sr-only">' . esc_html__('Email Address', 'mxchat') . '</label>'; |
| 318 | - echo ' <input type="email" id="user-email-' . esc_attr($bot_id) . '" name="user_email" class="mxchat-email-input" required placeholder="' . esc_attr__('Enter your email address', 'mxchat') . '" />'; | |
| 343 | + echo ' <input type="email" id="user-email-' . esc_attr($bot_id) . '" name="user_email" class="mxchat-email-input"' . ($require_email_field ? ' required' : '') . $prefill_email_attr . ' placeholder="' . ($require_email_field ? esc_attr__('Enter your email address', 'mxchat') : esc_attr__('Enter your email address (optional)', 'mxchat')) . '" />'; | |
| 319 | 344 | |
| 320 | 345 | // Consent checkbox row (b062c4). The native required attribute |
| 321 | 346 | // is UX only — the save endpoint re-enforces it server-side. |
| 322 | 347 | // Clicking an anchor inside the label activates the link, not |
| @@ -351,9 +376,15 @@ | ||
| 351 | 376 | // additions-only + non-atomic, with aria-busy held on the streaming |
| 352 | 377 | // bubble until [DONE] (chat-script.js) so a streamed reply is |
| 353 | 378 | // announced once, complete — not per token (WCAG 4.1.3, plan 67f126). |
| 354 | 379 | echo ' <div id="chat-box-' . esc_attr($bot_id) . '" class="chat-box" role="log" aria-live="polite" aria-atomic="false" aria-relevant="additions text" aria-label="' . esc_attr__('Chat messages', 'mxchat') . '">'; |
| 355 | - echo ' <div class="bot-message"' . ($skip_inline_colors ? '' : ' style="background: ' . esc_attr($bot_message_bg_color) . ';"') . '>'; | |
| 380 | + // mxchat-intro-message marks the greeting bubble so nothing has to | |
| 381 | + // infer it from position (plan a1a79b). Only this element ever | |
| 382 | + // carries the class — reset and the {visitor_name} substitution | |
| 383 | + // both key off it, and both used to assume the greeting was still | |
| 384 | + // the first .bot-message in the box, which stops being true the | |
| 385 | + // moment chat persistence rehydrates the transcript. | |
| 386 | + echo ' <div class="bot-message mxchat-intro-message"' . ($skip_inline_colors ? '' : ' style="background: ' . esc_attr($bot_message_bg_color) . ';"') . '>'; | |
| 356 | 387 | echo ' <div dir="auto"' . ($skip_inline_colors ? '' : ' style="color: ' . esc_attr($bot_message_font_color) . ';"') . '>'; |
| 357 | 388 | echo wp_kses_post($intro_message); |
| 358 | 389 | echo ' </div>'; |
| 359 | 390 | echo ' </div>'; |
| @@ -494,14 +525,22 @@ | ||
| 494 | 525 | echo ' <path d="M14.5 4h-5L7 7H4a2 2 0 0 0-2 2v9a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-3l-2.5-3z" style="fill: none !important;"/>'; |
| 495 | 526 | echo ' <circle cx="12" cy="13" r="3" style="fill: none !important;"/>'; |
| 496 | 527 | echo ' </svg>'; |
| 497 | 528 | echo ' </button>'; |
| 498 | - | |
| 499 | - | |
| 529 | + | |
| 530 | + // Toolbar items API (plan 65c9b6). Add-ons put their buttons here | |
| 531 | + // through the mxchat_chat_toolbar_items filter instead of polling | |
| 532 | + // the DOM after load. Only asked for when the toolbar is on: an item | |
| 533 | + // nobody can see is work nobody should do (the Woo cart badge used | |
| 534 | + // to fetch a count for a hidden toolbar on every page view). | |
| 535 | + if (isset($this->options['chat_toolbar_toggle']) && $this->options['chat_toolbar_toggle'] === 'on') { | |
| 536 | + echo self::render_toolbar_items($bot_id); | |
| 537 | + } | |
| 538 | + | |
| 500 | 539 | echo ' </div>'; |
| 501 | - | |
| 540 | + | |
| 502 | 541 | echo ' <div class="chatbot-footer">'; |
| 503 | - | |
| 542 | + | |
| 504 | 543 | // Output the privacy notice if enabled |
| 505 | 544 | if ($privacy_toggle && !empty($privacy_text)) { |
| 506 | 545 | echo '<p class="privacy-notice">' . $privacy_text . '</p>'; |
| 507 | 546 | } |
| @@ -547,10 +586,116 @@ | ||
| 547 | 586 | return ob_get_clean(); |
| 548 | 587 | } |
| 549 | 588 | |
| 550 | 589 | /** |
| 590 | + * Render the add-on items of the chat toolbar (plan-mxchat-20260916-65c9b6). | |
| 591 | + * | |
| 592 | + * `mxchat_chat_toolbar_items` receives an empty array and the bot id and | |
| 593 | + * returns items shaped ['id' => 'woo-cart', 'html' => '<button …>…</button>', | |
| 594 | + * 'order' => 10]. Items are sorted by order (ties keep filter order), keyed | |
| 595 | + * by id so a later callback can replace an earlier one, and the html is run | |
| 596 | + * through wp_kses with the post allow-list plus the SVG shapes a toolbar | |
| 597 | + * icon needs (filterable via mxchat_chat_toolbar_items_allowed_html). | |
| 598 | + * Add-ons must not add the dropdowns / panels their button opens here — | |
| 599 | + * the toolbar sits inside an overflow-hidden widget; append those to body | |
| 600 | + * from JS on first use, the way the Woo cart does. | |
| 601 | + * | |
| 602 | + * @param string $bot_id | |
| 603 | + * @return string HTML, empty when no add-on contributed anything | |
| 604 | + */ | |
| 605 | + public static function render_toolbar_items($bot_id) { | |
| 606 | + $items = apply_filters('mxchat_chat_toolbar_items', array(), $bot_id); | |
| 607 | + if (!is_array($items) || empty($items)) { | |
| 608 | + return ''; | |
| 609 | + } | |
| 610 | + | |
| 611 | + $clean = array(); | |
| 612 | + $seq = 0; | |
| 613 | + foreach ($items as $key => $item) { | |
| 614 | + if (!is_array($item) || empty($item['html']) || !is_string($item['html'])) { | |
| 615 | + continue; | |
| 616 | + } | |
| 617 | + $id = isset($item['id']) ? sanitize_key($item['id']) : (is_string($key) ? sanitize_key($key) : ''); | |
| 618 | + if ($id === '') { | |
| 619 | + continue; | |
| 620 | + } | |
| 621 | + $clean[$id] = array( | |
| 622 | + 'html' => $item['html'], | |
| 623 | + 'order' => isset($item['order']) ? (int) $item['order'] : 10, | |
| 624 | + 'seq' => $seq++, | |
| 625 | + ); | |
| 626 | + } | |
| 627 | + if (empty($clean)) { | |
| 628 | + return ''; | |
| 629 | + } | |
| 630 | + | |
| 631 | + uasort($clean, function ($a, $b) { | |
| 632 | + if ($a['order'] === $b['order']) { | |
| 633 | + return $a['seq'] <=> $b['seq']; | |
| 634 | + } | |
| 635 | + return $a['order'] <=> $b['order']; | |
| 636 | + }); | |
| 637 | + | |
| 638 | + $allowed = self::toolbar_items_allowed_html(); | |
| 639 | + $out = ''; | |
| 640 | + foreach ($clean as $id => $item) { | |
| 641 | + $html = trim(wp_kses($item['html'], $allowed)); | |
| 642 | + if ($html === '') { | |
| 643 | + continue; | |
| 644 | + } | |
| 645 | + $out .= ' <!-- toolbar item: ' . esc_html($id) . ' -->' . "\n"; | |
| 646 | + $out .= ' ' . $html . "\n"; | |
| 647 | + } | |
| 648 | + return $out; | |
| 649 | + } | |
| 650 | + | |
| 651 | + /** | |
| 652 | + * Allow-list for toolbar item markup: everything wp_kses_post allows (button, | |
| 653 | + * span, div, aria-* and data-* are in there) plus inline SVG icon shapes. | |
| 654 | + */ | |
| 655 | + private static function toolbar_items_allowed_html() { | |
| 656 | + $allowed = wp_kses_allowed_html('post'); | |
| 657 | + $shape = array( | |
| 658 | + 'fill' => true, | |
| 659 | + 'stroke' => true, | |
| 660 | + 'stroke-width' => true, | |
| 661 | + 'stroke-linecap' => true, | |
| 662 | + 'stroke-linejoin' => true, | |
| 663 | + 'transform' => true, | |
| 664 | + 'style' => true, | |
| 665 | + 'class' => true, | |
| 666 | + ); | |
| 667 | + $allowed['svg'] = array_merge($shape, array( | |
| 668 | + 'xmlns' => true, | |
| 669 | + 'viewbox' => true, | |
| 670 | + 'width' => true, | |
| 671 | + 'height' => true, | |
| 672 | + 'aria-hidden' => true, | |
| 673 | + 'focusable' => true, | |
| 674 | + 'role' => true, | |
| 675 | + )); | |
| 676 | + $allowed['path'] = array_merge($shape, array('d' => true)); | |
| 677 | + $allowed['circle'] = array_merge($shape, array('cx' => true, 'cy' => true, 'r' => true)); | |
| 678 | + $allowed['line'] = array_merge($shape, array('x1' => true, 'y1' => true, 'x2' => true, 'y2' => true)); | |
| 679 | + $allowed['polyline'] = array_merge($shape, array('points' => true)); | |
| 680 | + $allowed['polygon'] = array_merge($shape, array('points' => true)); | |
| 681 | + $allowed['rect'] = array_merge($shape, array('x' => true, 'y' => true, 'width' => true, 'height' => true, 'rx' => true, 'ry' => true)); | |
| 682 | + $allowed['g'] = $shape; | |
| 683 | + if (!isset($allowed['button'])) { | |
| 684 | + $allowed['button'] = array(); | |
| 685 | + } | |
| 686 | + $allowed['button'] = array_merge($allowed['button'], array( | |
| 687 | + 'type' => true, | |
| 688 | + 'disabled' => true, | |
| 689 | + 'aria-haspopup' => true, | |
| 690 | + 'aria-pressed' => true, | |
| 691 | + )); | |
| 692 | + return apply_filters('mxchat_chat_toolbar_items_allowed_html', $allowed); | |
| 693 | + } | |
| 694 | + | |
| 695 | + /** | |
| 551 | 696 | * Get bot-specific options for multi-bot functionality |
| 552 | - * Falls back to default options if bot_id is 'default' or multi-bot add-on is not active | |
| 697 | +* Falls back to default options if bot_id is 'default' or multi-bot add-on is not active | |
| 553 | 698 | */ |
| 554 | 699 | private function get_bot_options($bot_id = 'default') { |
| 555 | 700 | // If default bot or multi-bot add-on not active, return empty (use default options) |
| 556 | 701 | if ($bot_id === 'default' || !class_exists('MxChat_Multi_Bot_Manager')) { |
| @@ -586,13 +731,27 @@ | ||
| 586 | 731 | } |
| 587 | 732 | |
| 588 | 733 | |
| 589 | 734 | private function determine_email_collection_state() { |
| 590 | - // Logged-in users skip the email form | |
| 735 | + // Logged-in users skip the email form, UNLESS the owner has turned on | |
| 736 | + // "Also Show for Logged-In Users" (c0cfaf). On a membership or LMS site | |
| 737 | + // every visitor is signed in, so the short-circuit meant lead capture — | |
| 738 | + // and the consent checkbox — never appeared at all. | |
| 739 | + // | |
| 740 | + // Deliberately no PII in this decision: the returned profile values are | |
| 741 | + // NOT rendered into the markup, because this page HTML is cacheable and | |
| 742 | + // a cached form carrying one user's address would serve it to the next | |
| 743 | + // visitor. Pre-fill travels on the nocache'd AJAX check instead | |
| 744 | + // (mxchat_check_email_provided). Both logged-in and guest requests render | |
| 745 | + // the same empty form, so the cached copy is correct for either. | |
| 591 | 746 | if (is_user_logged_in()) { |
| 747 | + $options = get_option('mxchat_options', array()); | |
| 748 | + $show_for_logged_in = isset($options['lead_capture_logged_in_toggle']) | |
| 749 | + && $options['lead_capture_logged_in_toggle'] === 'on'; | |
| 750 | + | |
| 592 | 751 | $current_user = wp_get_current_user(); |
| 593 | 752 | return [ |
| 594 | - 'show_email_form' => false, | |
| 753 | + 'show_email_form' => $show_for_logged_in, | |
| 595 | 754 | 'user_email' => $current_user->user_email, |
| 596 | 755 | 'user_name' => $current_user->display_name ?: $current_user->first_name ?: '' |
| 597 | 756 | ]; |
| 598 | 757 | } |
