← All changes | includes/class-mxchat-public.php +162 -9 3.2.21 → 3.2.24 View file →

		@@ -232,8 +232,29 @@
232	232	$name_field_placeholder = isset($current_options['name_field_placeholder']) ?
233	233	esc_attr($current_options['name_field_placeholder']) :
234	234	esc_attr__('Enter your name', 'mxchat');
235	235
	236	+ // Require Email Address (c0cfaf). Default ON — absent key means required,
	237	+ // so existing installs render the same markup they always have.
	238	+ $require_email_field = ($current_options['lead_capture_require_email_toggle'] ?? 'on') === 'on';
	239	+
	240	+ // Pre-fill the form from the profile when a signed-in visitor is being
	241	+ // shown it (c0cfaf). Emitted ONLY for a logged-in request, so the markup a
	242	+ // guest gets — the copy a page cache actually stores and re-serves — never
	243	+ // carries anyone's address. WordPress already marks logged-in responses
	244	+ // uncacheable, and such a page carries per-user data from other plugins
	245	+ // regardless.
	246	+ $prefill_email_attr = '';
	247	+ $prefill_name_attr = '';
	248	+ if (is_user_logged_in()) {
	249	+ if ($user_email !== '') {
	250	+ $prefill_email_attr = ' value="' . esc_attr($user_email) . '"';
	251	+ }
	252	+ if ($user_name !== '') {
	253	+ $prefill_name_attr = ' value="' . esc_attr($user_name) . '"';
	254	+ }
	255	+ }
	256	+
236	257	// Consent checkbox (b062c4). Default OFF — with the toggle off this block
237	258	// renders nothing and the form markup is byte-identical to before.
238	259	$enable_consent_checkbox = isset($current_options['enable_consent_checkbox']) &&
239	260	($current_options['enable_consent_checkbox'] === '1' || $current_options['enable_consent_checkbox'] === 'on');
		@@ -310,13 +331,17 @@
310	331
311	332	// Add name field if enabled
312	333	if ($enable_name_field) {
313	334	echo ' <label for="user-name-' . esc_attr($bot_id) . '" class="sr-only mxchat-name-label">' . esc_html__('Name', 'mxchat') . '</label>';
314		- echo ' <input type="text" id="user-name-' . esc_attr($bot_id) . '" name="user_name" class="mxchat-name-input" required placeholder="' . $name_field_placeholder . '" />';
	335	+ echo ' <input type="text" id="user-name-' . esc_attr($bot_id) . '" name="user_name" class="mxchat-name-input" required' . $prefill_name_attr . ' placeholder="' . $name_field_placeholder . '" />';
315	336	}
316	337
	338	+ // The email field drops its required attribute when the owner
	339	+ // has made it optional (c0cfaf). Like the consent checkbox,
	340	+ // the attribute is UX only — the save endpoint re-enforces the
	341	+ // rule server-side, so a direct POST cannot bypass it.
317	342	echo ' <label for="user-email-' . esc_attr($bot_id) . '" class="sr-only">' . esc_html__('Email Address', 'mxchat') . '</label>';
318		- echo ' <input type="email" id="user-email-' . esc_attr($bot_id) . '" name="user_email" class="mxchat-email-input" required placeholder="' . esc_attr__('Enter your email address', 'mxchat') . '" />';
	343	+ echo ' <input type="email" id="user-email-' . esc_attr($bot_id) . '" name="user_email" class="mxchat-email-input"' . ($require_email_field ? ' required' : '') . $prefill_email_attr . ' placeholder="' . ($require_email_field ? esc_attr__('Enter your email address', 'mxchat') : esc_attr__('Enter your email address (optional)', 'mxchat')) . '" />';
319	344
320	345	// Consent checkbox row (b062c4). The native required attribute
321	346	// is UX only — the save endpoint re-enforces it server-side.
322	347	// Clicking an anchor inside the label activates the link, not
		@@ -500,14 +525,22 @@
500	525	echo ' <path d="M14.5 4h-5L7 7H4a2 2 0 0 0-2 2v9a2 2 0 0 0 2 2h16a2 2 0 0 0 2-2V9a2 2 0 0 0-2-2h-3l-2.5-3z" style="fill: none !important;"/>';
501	526	echo ' <circle cx="12" cy="13" r="3" style="fill: none !important;"/>';
502	527	echo ' </svg>';
503	528	echo ' </button>';
504		-
505		-
	529	+
	530	+ // Toolbar items API (plan 65c9b6). Add-ons put their buttons here
	531	+ // through the mxchat_chat_toolbar_items filter instead of polling
	532	+ // the DOM after load. Only asked for when the toolbar is on: an item
	533	+ // nobody can see is work nobody should do (the Woo cart badge used
	534	+ // to fetch a count for a hidden toolbar on every page view).
	535	+ if (isset($this->options['chat_toolbar_toggle']) && $this->options['chat_toolbar_toggle'] === 'on') {
	536	+ echo self::render_toolbar_items($bot_id);
	537	+ }
	538	+
506	539	echo ' </div>';
507		-
	540	+
508	541	echo ' <div class="chatbot-footer">';
509		-
	542	+
510	543	// Output the privacy notice if enabled
511	544	if ($privacy_toggle && !empty($privacy_text)) {
512	545	echo '<p class="privacy-notice">' . $privacy_text . '</p>';
513	546	}
		@@ -553,10 +586,116 @@
553	586	return ob_get_clean();
554	587	}
555	588
556	589	/**
	590	+ * Render the add-on items of the chat toolbar (plan-mxchat-20260916-65c9b6).
	591	+ *
	592	+ * `mxchat_chat_toolbar_items` receives an empty array and the bot id and
	593	+ * returns items shaped ['id' => 'woo-cart', 'html' => '<button …>…</button>',
	594	+ * 'order' => 10]. Items are sorted by order (ties keep filter order), keyed
	595	+ * by id so a later callback can replace an earlier one, and the html is run
	596	+ * through wp_kses with the post allow-list plus the SVG shapes a toolbar
	597	+ * icon needs (filterable via mxchat_chat_toolbar_items_allowed_html).
	598	+ * Add-ons must not add the dropdowns / panels their button opens here —
	599	+ * the toolbar sits inside an overflow-hidden widget; append those to body
	600	+ * from JS on first use, the way the Woo cart does.
	601	+ *
	602	+ * @param string $bot_id
	603	+ * @return string HTML, empty when no add-on contributed anything
	604	+ */
	605	+ public static function render_toolbar_items($bot_id) {
	606	+ $items = apply_filters('mxchat_chat_toolbar_items', array(), $bot_id);
	607	+ if (!is_array($items) || empty($items)) {
	608	+ return '';
	609	+ }
	610	+
	611	+ $clean = array();
	612	+ $seq = 0;
	613	+ foreach ($items as $key => $item) {
	614	+ if (!is_array($item) || empty($item['html']) || !is_string($item['html'])) {
	615	+ continue;
	616	+ }
	617	+ $id = isset($item['id']) ? sanitize_key($item['id']) : (is_string($key) ? sanitize_key($key) : '');
	618	+ if ($id === '') {
	619	+ continue;
	620	+ }
	621	+ $clean[$id] = array(
	622	+ 'html' => $item['html'],
	623	+ 'order' => isset($item['order']) ? (int) $item['order'] : 10,
	624	+ 'seq' => $seq++,
	625	+ );
	626	+ }
	627	+ if (empty($clean)) {
	628	+ return '';
	629	+ }
	630	+
	631	+ uasort($clean, function ($a, $b) {
	632	+ if ($a['order'] === $b['order']) {
	633	+ return $a['seq'] <=> $b['seq'];
	634	+ }
	635	+ return $a['order'] <=> $b['order'];
	636	+ });
	637	+
	638	+ $allowed = self::toolbar_items_allowed_html();
	639	+ $out = '';
	640	+ foreach ($clean as $id => $item) {
	641	+ $html = trim(wp_kses($item['html'], $allowed));
	642	+ if ($html === '') {
	643	+ continue;
	644	+ }
	645	+ $out .= ' <!-- toolbar item: ' . esc_html($id) . ' -->' . "\n";
	646	+ $out .= ' ' . $html . "\n";
	647	+ }
	648	+ return $out;
	649	+ }
	650	+
	651	+ /**
	652	+ * Allow-list for toolbar item markup: everything wp_kses_post allows (button,
	653	+ * span, div, aria-* and data-* are in there) plus inline SVG icon shapes.
	654	+ */
	655	+ private static function toolbar_items_allowed_html() {
	656	+ $allowed = wp_kses_allowed_html('post');
	657	+ $shape = array(
	658	+ 'fill' => true,
	659	+ 'stroke' => true,
	660	+ 'stroke-width' => true,
	661	+ 'stroke-linecap' => true,
	662	+ 'stroke-linejoin' => true,
	663	+ 'transform' => true,
	664	+ 'style' => true,
	665	+ 'class' => true,
	666	+ );
	667	+ $allowed['svg'] = array_merge($shape, array(
	668	+ 'xmlns' => true,
	669	+ 'viewbox' => true,
	670	+ 'width' => true,
	671	+ 'height' => true,
	672	+ 'aria-hidden' => true,
	673	+ 'focusable' => true,
	674	+ 'role' => true,
	675	+ ));
	676	+ $allowed['path'] = array_merge($shape, array('d' => true));
	677	+ $allowed['circle'] = array_merge($shape, array('cx' => true, 'cy' => true, 'r' => true));
	678	+ $allowed['line'] = array_merge($shape, array('x1' => true, 'y1' => true, 'x2' => true, 'y2' => true));
	679	+ $allowed['polyline'] = array_merge($shape, array('points' => true));
	680	+ $allowed['polygon'] = array_merge($shape, array('points' => true));
	681	+ $allowed['rect'] = array_merge($shape, array('x' => true, 'y' => true, 'width' => true, 'height' => true, 'rx' => true, 'ry' => true));
	682	+ $allowed['g'] = $shape;
	683	+ if (!isset($allowed['button'])) {
	684	+ $allowed['button'] = array();
	685	+ }
	686	+ $allowed['button'] = array_merge($allowed['button'], array(
	687	+ 'type' => true,
	688	+ 'disabled' => true,
	689	+ 'aria-haspopup' => true,
	690	+ 'aria-pressed' => true,
	691	+ ));
	692	+ return apply_filters('mxchat_chat_toolbar_items_allowed_html', $allowed);
	693	+ }
	694	+
	695	+ /**
557	696	* Get bot-specific options for multi-bot functionality
558		- * Falls back to default options if bot_id is 'default' or multi-bot add-on is not active
	697	+* Falls back to default options if bot_id is 'default' or multi-bot add-on is not active
559	698	*/
560	699	private function get_bot_options($bot_id = 'default') {
561	700	// If default bot or multi-bot add-on not active, return empty (use default options)
562	701	if ($bot_id === 'default' || !class_exists('MxChat_Multi_Bot_Manager')) {
		@@ -592,13 +731,27 @@
592	731	}
593	732
594	733
595	734	private function determine_email_collection_state() {
596		- // Logged-in users skip the email form
	735	+ // Logged-in users skip the email form, UNLESS the owner has turned on
	736	+ // "Also Show for Logged-In Users" (c0cfaf). On a membership or LMS site
	737	+ // every visitor is signed in, so the short-circuit meant lead capture —
	738	+ // and the consent checkbox — never appeared at all.
	739	+ //
	740	+ // Deliberately no PII in this decision: the returned profile values are
	741	+ // NOT rendered into the markup, because this page HTML is cacheable and
	742	+ // a cached form carrying one user's address would serve it to the next
	743	+ // visitor. Pre-fill travels on the nocache'd AJAX check instead
	744	+ // (mxchat_check_email_provided). Both logged-in and guest requests render
	745	+ // the same empty form, so the cached copy is correct for either.
597	746	if (is_user_logged_in()) {
	747	+ $options = get_option('mxchat_options', array());
	748	+ $show_for_logged_in = isset($options['lead_capture_logged_in_toggle'])
	749	+ && $options['lead_capture_logged_in_toggle'] === 'on';
	750	+
598	751	$current_user = wp_get_current_user();
599	752	return [
600		- 'show_email_form' => false,
	753	+ 'show_email_form' => $show_for_logged_in,
601	754	'user_email' => $current_user->user_email,
602	755	'user_name' => $current_user->display_name ?: $current_user->first_name ?: ''
603	756	];
604	757	}