PluginProbe
MxChat – AI Chatbot & Content Generation for WordPress / trunk
MxChat – AI Chatbot & Content Generation for WordPress vtrunk
3.2.21 3.2.20 3.2.19 3.2.18 3.2.17 3.2.16 3.2.15 3.2.14 3.2.12 3.2.13 3.2.11 3.2.10 3.2.9 3.2.8 3.2.7 3.2.6 3.2.5 3.2.4 3.2.3 3.2.2 3.2.1 2.0.3 2.0.4 2.0.5 2.0.6 All 152 releases
← All changes | includes/class-mxchat-public.php +223 -31 3.2.7trunk View file →
@@ -5,8 +5,14 @@
5 5
6 6 class MxChat_Public {
7 7 private $options;
8 8
9 + // True once any FLOATING instance has rendered on this request via the
10 + // shortcode (or the block wrapping it) — append_chatbot_to_body() then
11 + // yields, so an explicit floating placement never doubles up with the
12 + // Auto-Display instance (plan 95dd1e).
13 + private static $floating_instance_rendered = false;
14 +
9 15 public function __construct() {
10 16 // Simply get the options without defining duplicated defaults
11 17 $this->options = get_option('mxchat_options', array());
12 18 add_shortcode('mxchat_chatbot', array($this, 'render_chatbot_shortcode'));
@@ -56,9 +62,18 @@
56 62 // Check if auto-append chatbot should be hidden on this page
57 63 if ($this->should_hide_chatbot('auto')) {
58 64 return; // Don't show auto-appended chatbot
59 65 }
60 -
66 +
67 + // An explicit floating placement (shortcode or the 95dd1e block) already
68 + // rendered during content — appending the auto instance would put two
69 + // floating widgets on the page with colliding element ids. The explicit
70 + // placement wins; content renders before wp_footer, so the flag is set
71 + // by the time this runs.
72 + if (self::$floating_instance_rendered) {
73 + return;
74 + }
75 +
61 76 // Get the bot that should be displayed using new logic
62 77 $bot_to_show = $this->get_display_bot();
63 78
64 79 // Don't show chatbot if determination is false
@@ -95,8 +110,22 @@
95 110 /**
96 111 * UPDATED: Enhanced shortcode with context-aware hiding
97 112 */
98 113 public function render_chatbot_shortcode($atts) {
114 + // Smart asset loading safety net (plan-915355): if the opt-in enqueue gate
115 + // skipped assets on this request (shortcode invisible to has_shortcode —
116 + // builder-stored content, template files, widget areas), force the FULL
117 + // enqueue now, including the mxchatChat settings payload and the delayed
118 + // loader wiring. The integrator method is idempotent, so this is a no-op
119 + // when assets already went out at wp_enqueue_scripts time.
120 + if (self::is_smart_asset_loading_enabled() && !wp_style_is('mxchat-chat-css', 'enqueued')) {
121 + global $mxchat_integrator;
122 + if (isset($mxchat_integrator) && is_object($mxchat_integrator)
123 + && method_exists($mxchat_integrator, 'mxchat_enqueue_scripts_styles')) {
124 + $mxchat_integrator->mxchat_enqueue_scripts_styles(true);
125 + }
126 + }
127 +
99 128 // UPDATED: Add bot_id parameter support and improve logic
100 129 $attributes = shortcode_atts(array(
101 130 'floating' => 'yes',
102 131 'has_consent' => 'yes',
@@ -105,20 +134,16 @@
105 134
106 135 // Determine which bot to use
107 136 $bot_id = $this->determine_bot_for_shortcode($attributes['bot_id']);
108 137
109 - // UPDATED: Only check hiding for floating shortcodes that could conflict with auto-append
110 - // Non-floating shortcodes should always work
138 + // A floating shortcode always renders; what it does is suppress the LATER
139 + // auto-append instance (see append_chatbot_to_body), so a page never gets
140 + // two floating widgets. This replaced a dead empty branch here that
141 + // documented the intent but never suppressed anything (plan 95dd1e).
111 142 if ($attributes['floating'] === 'yes') {
112 - // For floating shortcodes, check if auto-append is hidden
113 - // This prevents duplicate floating chatbots
114 - if ($this->should_hide_chatbot('auto') && $this->is_auto_append_enabled()) {
115 - // If auto-append is enabled but hidden on this page,
116 - // allow the floating shortcode to work (user is overriding)
117 - // But if auto-append is disabled globally, also allow shortcode
118 - }
143 + self::$floating_instance_rendered = true;
119 144 }
120 -
145 +
121 146 // Non-floating shortcodes (floating="no") should NEVER be blocked by the hide setting
122 147 // This allows embedded chatbots even when floating is hidden
123 148
124 149 $is_floating = $attributes['floating'] === 'yes';
@@ -201,14 +226,28 @@
201 226 $enable_email_block = isset($current_options['enable_email_block']) &&
202 227 ($current_options['enable_email_block'] === '1' || $current_options['enable_email_block'] === 'on');
203 228
204 229 // Add name field variables
205 - $enable_name_field = isset($current_options['enable_name_field']) &&
230 + $enable_name_field = isset($current_options['enable_name_field']) &&
206 231 ($current_options['enable_name_field'] === '1' || $current_options['enable_name_field'] === 'on');
207 - $name_field_placeholder = isset($current_options['name_field_placeholder']) ?
208 - esc_attr($current_options['name_field_placeholder']) :
232 + $name_field_placeholder = isset($current_options['name_field_placeholder']) ?
233 + esc_attr($current_options['name_field_placeholder']) :
209 234 esc_attr__('Enter your name', 'mxchat');
210 235
236 + // Consent checkbox (b062c4). Default OFF — with the toggle off this block
237 + // renders nothing and the form markup is byte-identical to before.
238 + $enable_consent_checkbox = isset($current_options['enable_consent_checkbox']) &&
239 + ($current_options['enable_consent_checkbox'] === '1' || $current_options['enable_consent_checkbox'] === 'on');
240 + $consent_checkbox_required = isset($current_options['consent_checkbox_required']) &&
241 + ($current_options['consent_checkbox_required'] === '1' || $current_options['consent_checkbox_required'] === 'on');
242 + // Owner content, kses'd through the shared allowlist at render time as well
243 + // as save time — the render is the security boundary the spec names.
244 + $consent_checkbox_label = MxChat_Utils::sanitize_consent_label(
245 + isset($current_options['consent_checkbox_label']) && $current_options['consent_checkbox_label'] !== ''
246 + ? $current_options['consent_checkbox_label']
247 + : __('I agree to the Privacy Policy.', 'mxchat')
248 + );
249 +
211 250 ob_start();
212 251
213 252 // Check if floating attribute is set to 'yes' and wrap accordingly
214 253 if ($is_floating) {
@@ -215,9 +254,12 @@
215 254 echo '<div id="floating-chatbot-' . esc_attr($bot_id) . '" class="floating-chatbot ' . $initial_visibility . $additional_class . '">';
216 255 }
217 256
218 257 // Add bot_id to the chatbot wrapper as a data attribute
219 - echo '<div id="mxchat-chatbot-wrapper-' . esc_attr($bot_id) . '" class="mxchat-chatbot-wrapper" data-bot-id="' . esc_attr($bot_id) . '">';
258 + // data-nosnippet: keep the chat widget's UI copy (greeting, title, quick-question
259 + // prompts, privacy notice) out of Google search snippets. This wrapper renders in both
260 + // floating and inline/shortcode modes, so it covers all in-panel copy in one place.
261 + echo '<div id="mxchat-chatbot-wrapper-' . esc_attr($bot_id) . '" class="mxchat-chatbot-wrapper" data-nosnippet data-bot-id="' . esc_attr($bot_id) . '">';
220 262
221 263 echo ' <div class="chatbot-top-bar" id="exit-chat-button-' . esc_attr($bot_id) . '"' . ($skip_inline_colors ? '' : ' style="background: ' . esc_attr($top_bar_bg_color) . ';"') . '>';
222 264 echo ' <div class="chatbot-title-container">';
223 265 echo ' <div class="chatbot-title-group">';
@@ -273,8 +315,20 @@
273 315 }
274 316
275 317 echo ' <label for="user-email-' . esc_attr($bot_id) . '" class="sr-only">' . esc_html__('Email Address', 'mxchat') . '</label>';
276 318 echo ' <input type="email" id="user-email-' . esc_attr($bot_id) . '" name="user_email" class="mxchat-email-input" required placeholder="' . esc_attr__('Enter your email address', 'mxchat') . '" />';
319 +
320 + // Consent checkbox row (b062c4). The native required attribute
321 + // is UX only — the save endpoint re-enforces it server-side.
322 + // Clicking an anchor inside the label activates the link, not
323 + // the checkbox (interactive descendants skip label activation).
324 + if ($enable_consent_checkbox) {
325 + echo ' <div class="mxchat-consent-row">';
326 + echo ' <input type="checkbox" id="user-consent-' . esc_attr($bot_id) . '" name="user_consent" value="1" class="mxchat-consent-checkbox"' . ($consent_checkbox_required ? ' required' : '') . ' />';
327 + echo ' <label for="user-consent-' . esc_attr($bot_id) . '" class="mxchat-consent-label">' . $consent_checkbox_label . '</label>';
328 + echo ' </div>';
329 + }
330 +
277 331 echo '<button type="submit" id="email-submit-button-' . esc_attr($bot_id) . '" class="email-submit-button">';
278 332 $button_text = isset($current_options['email_blocker_button_text'])
279 333 ? $current_options['email_blocker_button_text']
280 334 : esc_html__('Start Chat', 'mxchat');
@@ -290,10 +344,22 @@
290 344 echo ' </div>';
291 345 echo ' </div>';
292 346
293 347 echo ' <div id="chat-container-' . esc_attr($bot_id) . '" class="chat-container" style="' . ($enable_email_block && $show_email_form ? 'display: none;' : '') . '">';
294 - echo ' <div id="chat-box-' . esc_attr($bot_id) . '" class="chat-box">';
295 - echo ' <div class="bot-message"' . ($skip_inline_colors ? '' : ' style="background: ' . esc_attr($bot_message_bg_color) . ';"') . '>';
348 + // role="log" + polite live region: new messages are announced to
349 + // screen readers explicitly, so the arrival signal no longer rides
350 + // the post-reply input autofocus (suppressed on touch — plan 03799f).
351 + // additions-only + non-atomic, with aria-busy held on the streaming
352 + // bubble until [DONE] (chat-script.js) so a streamed reply is
353 + // announced once, complete — not per token (WCAG 4.1.3, plan 67f126).
354 + echo ' <div id="chat-box-' . esc_attr($bot_id) . '" class="chat-box" role="log" aria-live="polite" aria-atomic="false" aria-relevant="additions text" aria-label="' . esc_attr__('Chat messages', 'mxchat') . '">';
355 + // mxchat-intro-message marks the greeting bubble so nothing has to
356 + // infer it from position (plan a1a79b). Only this element ever
357 + // carries the class — reset and the {visitor_name} substitution
358 + // both key off it, and both used to assume the greeting was still
359 + // the first .bot-message in the box, which stops being true the
360 + // moment chat persistence rehydrates the transcript.
361 + echo ' <div class="bot-message mxchat-intro-message"' . ($skip_inline_colors ? '' : ' style="background: ' . esc_attr($bot_message_bg_color) . ';"') . '>';
296 362 echo ' <div dir="auto"' . ($skip_inline_colors ? '' : ' style="color: ' . esc_attr($bot_message_font_color) . ';"') . '>';
297 363 echo wp_kses_post($intro_message);
298 364 echo ' </div>';
299 365 echo ' </div>';
@@ -339,9 +405,25 @@
339 405 echo ' </div>';
340 406 echo ' </div>';
341 407
342 408 echo ' <div id="input-container-' . esc_attr($bot_id) . '" class="input-container">';
343 - echo ' <textarea id="chat-input-' . esc_attr($bot_id) . '" class="chat-input" dir="auto" placeholder="' . esc_attr($input_copy) . '"' . ($skip_inline_colors ? '' : ' style="color: ' . esc_attr($chat_input_font_color) . ';"') . '></textarea>';
409 + // Max input length (plan a3fae2 part C) — global core setting, 0 = unlimited.
410 + // Hard-caps typing/paste client-side; the chat handler enforces it server-side too.
411 + $mxchat_max_input_length = isset($this->options['max_input_length']) ? intval($this->options['max_input_length']) : 0;
412 + $mxchat_maxlength_attr = $mxchat_max_input_length > 0 ? ' maxlength="' . esc_attr($mxchat_max_input_length) . '"' : '';
413 + // Visually-hidden label = the input's accessible name (WCAG 3.3.2,
414 + // plan 67f126). The placeholder stays as visible prompt copy but
415 + // cannot be the name — it vanishes on the first keystroke.
416 + echo ' <label for="chat-input-' . esc_attr($bot_id) . '" class="sr-only">' . esc_html__('Type your message', 'mxchat') . '</label>';
417 + echo ' <textarea id="chat-input-' . esc_attr($bot_id) . '" class="chat-input" dir="auto"' . $mxchat_maxlength_attr . ' placeholder="' . esc_attr($input_copy) . '"' . ($skip_inline_colors ? '' : ' style="color: ' . esc_attr($chat_input_font_color) . ';"') . '></textarea>';
418 + // Language-neutral character counter (plan 7091a2). Numbers only — no
419 + // translatable strings — so it reads correctly on every-language install.
420 + // Only rendered when a cap is set; hidden until ~80% of the cap, then
421 + // ramps neutral -> amber -> red. Decorative (aria-hidden); the textarea's
422 + // maxlength carries the real semantics for assistive tech.
423 + if ($mxchat_max_input_length > 0) {
424 + echo ' <div id="mxchat-char-counter-' . esc_attr($bot_id) . '" class="mxchat-char-counter" aria-hidden="true"><span class="mxchat-char-counter-current">0</span><span class="mxchat-char-counter-sep">/</span><span class="mxchat-char-counter-max">' . esc_html($mxchat_max_input_length) . '</span></div>';
425 + }
344 426 echo ' <button id="send-button-' . esc_attr($bot_id) . '" class="send-button" aria-label="' . esc_attr__('Send message', 'mxchat') . '">';
345 427 if (!empty($custom_send_image)) {
346 428 echo ' <img src="' . esc_url($custom_send_image) . '" alt="' . esc_attr__('Send', 'mxchat') . '" style="width: ' . intval($send_width) . 'px; height: ' . intval($send_height) . 'px; transform: rotate(' . intval($send_rotation) . 'deg);" />';
347 429 } else {
@@ -439,9 +521,11 @@
439 521 echo '</div>';
440 522
441 523 if (!empty($pre_chat_message)) {
442 524 // Rendered hidden by default — JS checkPreChatDismissal() handles show/hide via localStorage
443 - echo '<div id="pre-chat-message-' . esc_attr($bot_id) . '" class="pre-chat-message" style="display:none;">';
525 + // data-nosnippet: the pre-chat teaser bubble is a sibling outside
526 + // .mxchat-chatbot-wrapper, so it needs its own marker to stay out of snippets.
527 + echo '<div id="pre-chat-message-' . esc_attr($bot_id) . '" class="pre-chat-message" data-nosnippet style="display:none;">';
444 528 echo nl2br(esc_html($pre_chat_message));
445 529 echo '<button class="close-pre-chat-message" aria-label="' . esc_attr__('Close', 'mxchat') . '">&times;</button>';
446 530 echo '</div>';
447 531 }
@@ -533,14 +617,50 @@
533 617 /**
534 618 * NEW: Determine if and which chatbot should be displayed
535 619 */
536 620 private function get_display_bot() {
621 + // Delegates to the static so the enqueue-time gate (smart asset loading,
622 + // plan-915355) and this render-time decision share ONE code path and can
623 + // never disagree. The static reads mxchat_options fresh — same row this
624 + // instance loaded at construct.
625 + return self::compute_display_bot();
626 +}
627 +
628 +/**
629 + * Static single source of truth for the display decision (plan-915355).
630 + * Combines the per-page meta box, the append_to_body global toggle, and the
631 + * post-type include/exclude mode. Returns a bot id ('default' or specific)
632 + * when the auto-append widget will render on the current request, false when
633 + * it won't. Static (not a second instance) deliberately: MxChat_Public's
634 + * constructor registers a wp_footer action, so constructing a throwaway
635 + * instance would double-append the widget.
636 + */
637 +public static function compute_display_bot() {
638 + // The Elementor builder canvas is not a chat surface (plan 95dd1e part 2):
639 + // its preview iframe is a real front-end page load, so without this guard
640 + // the Auto-Display instance renders LIVE inside the canvas — front-end
641 + // chat scripts firing in the editor, able to start a session for the
642 + // person editing. Returning false here suppresses both the wp_footer
643 + // auto-append and the asset enqueue gate for preview requests only; the
644 + // placement widget's own canvas rendering is a static placeholder anyway.
645 + if (did_action('elementor/loaded')
646 + && class_exists('\Elementor\Plugin')
647 + && isset(\Elementor\Plugin::$instance->preview)
648 + && \Elementor\Plugin::$instance->preview
649 + && \Elementor\Plugin::$instance->preview->is_preview_mode()) {
650 + return false;
651 + }
652 +
653 + $options = get_option('mxchat_options', array());
654 + if (!is_array($options)) {
655 + $options = array();
656 + }
657 +
537 658 // Get page-specific settings from meta box
538 - $page_setting = $this->get_page_bot_setting();
659 + $page_setting = self::get_page_bot_setting();
539 660
540 - // Get global settings - FIXED: Check for 'on' instead of 'on'
541 - $global_autoshow = isset($this->options['append_to_body']) && $this->options['append_to_body'] === 'on';
542 - $global_default_bot = isset($this->options['default_bot']) ? $this->options['default_bot'] : 'default';
661 + $global_autoshow = isset($options['append_to_body']) && $options['append_to_body'] === 'on';
662 + $global_default_bot = isset($options['default_bot']) ? $options['default_bot'] : 'default';
543 663
544 664 // If page specifically hides chatbot, don't show anything
545 665 if ($page_setting && $page_setting['action'] === 'hide') {
546 666 return false;
@@ -554,9 +674,9 @@
554 674 // Page setting is 'global' or no page setting exists
555 675 // Check global auto-show setting
556 676 if ($global_autoshow) {
557 677 // Check post type visibility settings
558 - if (!$this->should_show_on_current_post_type()) {
678 + if (!self::should_show_on_current_post_type()) {
559 679 return false;
560 680 }
561 681
562 682 // Global auto-show is enabled, return the default bot
@@ -568,14 +688,86 @@
568 688 return false;
569 689 }
570 690
571 691 /**
692 + * Smart asset loading opt-in (plan-915355). Standalone option — deliberately
693 + * NOT a mxchat_options key, so it can never be stripped by mxchat_sanitize().
694 + * Default off: enqueue behavior is byte-identical to before until an owner
695 + * turns the toggle on.
696 + */
697 +public static function is_smart_asset_loading_enabled() {
698 + return get_option('mxchat_smart_asset_loading', 'off') === 'on';
699 +}
700 +
701 +/**
702 + * Will the chat widget render on the current request? (plan-915355)
703 + *
704 + * True when the auto-append decision resolves to a bot, OR the singular
705 + * post's content contains the [mxchat_chatbot] shortcode (first-chance
706 + * detection so shortcode pages keep head-loaded CSS — no FOUC). Computed
707 + * once per request and cached, so the wp_enqueue_scripts gate and any
708 + * add-on consulting this later in the same request always get one answer.
709 + *
710 + * Filter `mxchat_should_load_assets` is the force-load escape hatch for
711 + * headless/builder/custom-JS setups whose shortcode placement is invisible
712 + * to has_shortcode (builder-stored content, template files, widget areas).
713 + * Note the render-time safety net in render_chatbot_shortcode() still
714 + * force-loads assets whenever the shortcode actually renders — the filter
715 + * is only needed where even that net can't fire (e.g. markup assembled
716 + * outside WP rendering).
717 + */
718 +public static function should_load_assets() {
719 + static $cached = null;
720 + if ($cached !== null) {
721 + return $cached;
722 + }
723 +
724 + // Never gate admin/ajax requests — this decision is for front-end enqueues only.
725 + if (is_admin()) {
726 + $cached = true;
727 + return $cached;
728 + }
729 +
730 + $display_bot = self::compute_display_bot();
731 + $has_shortcode = false;
732 +
733 + if ($display_bot === false && is_singular()) {
734 + $post = get_post();
735 + if ($post && has_shortcode((string) $post->post_content, 'mxchat_chatbot')) {
736 + $has_shortcode = true;
737 + }
738 + // The mxchat/chatbot block (plan-95dd1e) stores a block comment, not
739 + // shortcode text, so has_shortcode can't see it — first-chance detect
740 + // it here for the same no-FOUC reason. The render-time safety net in
741 + // render_chatbot_shortcode() still covers template/widget placements.
742 + if ($post && !$has_shortcode && function_exists('has_block')
743 + && has_block('mxchat/chatbot', $post)) {
744 + $has_shortcode = true;
745 + }
746 + }
747 +
748 + $should = ($display_bot !== false) || $has_shortcode;
749 +
750 + $cached = (bool) apply_filters('mxchat_should_load_assets', $should, array(
751 + 'display_bot' => $display_bot,
752 + 'has_shortcode' => $has_shortcode,
753 + 'post_id' => get_the_ID(),
754 + ));
755 +
756 + return $cached;
757 +}
758 +
759 +/**
572 760 * Check if chatbot should be shown on the current post type
573 761 */
574 -private function should_show_on_current_post_type() {
762 +private static function should_show_on_current_post_type() {
763 + $options = get_option('mxchat_options', array());
764 + if (!is_array($options)) {
765 + $options = array();
766 + }
575 767 // Get visibility settings
576 - $mode = isset($this->options['post_type_visibility_mode']) ? $this->options['post_type_visibility_mode'] : 'all';
577 - $list = isset($this->options['post_type_visibility_list']) ? $this->options['post_type_visibility_list'] : array();
768 + $mode = isset($options['post_type_visibility_mode']) ? $options['post_type_visibility_mode'] : 'all';
769 + $list = isset($options['post_type_visibility_list']) ? $options['post_type_visibility_list'] : array();
578 770
579 771 // Ensure list is an array
580 772 if (!is_array($list)) {
581 773 $list = array();
@@ -586,9 +778,9 @@
586 778 return true;
587 779 }
588 780
589 781 // Get current post type
590 - $current_post_type = $this->get_current_post_type();
782 + $current_post_type = self::get_current_post_type();
591 783
592 784 // If we can't determine post type, default to showing
593 785 if (empty($current_post_type)) {
594 786 return true;
@@ -609,9 +801,9 @@
609 801
610 802 /**
611 803 * Get the current post type
612 804 */
613 -private function get_current_post_type() {
805 +private static function get_current_post_type() {
614 806 // Try to get from queried object first
615 807 $queried_object = get_queried_object();
616 808
617 809 if ($queried_object instanceof WP_Post) {
@@ -643,9 +835,9 @@
643 835
644 836 /**
645 837 * Get page-specific bot setting using new visibility field with backward compat
646 838 */
647 -private function get_page_bot_setting($post_id = null) {
839 +private static function get_page_bot_setting($post_id = null) {
648 840 if (!$post_id) {
649 841 $post_id = get_the_ID();
650 842 }
651 843
@@ -693,9 +885,9 @@
693 885 return $shortcode_bot_id;
694 886 }
695 887
696 888 // No bot_id in shortcode, check page setting
697 - $page_setting = $this->get_page_bot_setting();
889 + $page_setting = self::get_page_bot_setting();
698 890 if ($page_setting && $page_setting['action'] === 'show') {
699 891 return $page_setting['bot_id'];
700 892 }
701 893