PluginProbe
ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO / 2.7.0
ThinkRank AI SEO – AI SEO Plugin for WordPress: Schema, XML Sitemaps, Meta Tags, Search Console & Local SEO v2.7.0
2.8.0 2.7.0 2.6.0 2.5.0 2.4.0 2.3.0 2.2.0 2.1.1 2.1.0 2.0.2 2.0.1 2.0.0 1.32.0 1.31.0 1.30.0 1.29.0 1.28.0 1.27.0 1.26.0 1.25.0 trunk 1.0.0 1.0.1 1.0.2 1.1.0 All 49 releases
← All changes | includes/admin/class-metabox-manager.php +277 -23 2.1.02.7.0 View file →
@@ -18,8 +18,9 @@
18 18 use ThinkRank\Core\Settings;
19 19 use ThinkRank\Core\Database;
20 20 use ThinkRank\Core\Plan_Config;
21 21 use ThinkRank\SEO\Focus_Keywords;
22 +use ThinkRank\SEO\Object_Redirect;
22 23 use ThinkRank\SEO\Pattern_Resolver;
23 24
24 25 // Prevent direct access
25 26 if (!defined('ABSPATH')) {
@@ -77,8 +78,9 @@
77 78 public function init(): void {
78 79 add_action('add_meta_boxes', [$this, 'add_meta_boxes']);
79 80 add_action('save_post', [$this, 'save_meta_boxes'], 10, 2);
80 81 add_action('admin_enqueue_scripts', [$this, 'enqueue_metabox_scripts']);
82 + add_action('admin_notices', [$this, 'render_redirect_notice']);
81 83 add_action('init', [$this, 'register_meta_fields']);
82 84
83 85 // AJAX handlers for meta box functionality
84 86 add_action('wp_ajax_thinkrank_generate_post_metadata', [$this, 'ajax_generate_post_metadata']);
@@ -206,8 +208,26 @@
206 208 return current_user_can('edit_posts') || current_user_can('edit_pages');
207 209 }
208 210 ]);
209 211
212 + register_post_meta('', \ThinkRank\SEO\Content_Visibility::SEARCH_META, [
213 + 'show_in_rest' => true,
214 + 'single' => true,
215 + 'type' => 'integer',
216 + 'auth_callback' => function () {
217 + return current_user_can('edit_posts') || current_user_can('edit_pages');
218 + }
219 + ]);
220 +
221 + register_post_meta('', \ThinkRank\SEO\Content_Visibility::ARCHIVE_META, [
222 + 'show_in_rest' => true,
223 + 'single' => true,
224 + 'type' => 'integer',
225 + 'auth_callback' => function () {
226 + return current_user_can('edit_posts') || current_user_can('edit_pages');
227 + }
228 + ]);
229 +
210 230 register_post_meta('', '_thinkrank_primary_category', [
211 231 'show_in_rest' => true,
212 232 'single' => true,
213 233 'type' => 'integer',
@@ -483,9 +503,22 @@
483 503 <input type="hidden" id="thinkrank_focus_keywords" name="thinkrank_focus_keywords" value="<?php echo esc_attr(wp_json_encode($existing_metadata['focus_keywords'] ?? [])); ?>" />
484 504 <input type="hidden" id="thinkrank_seo_score" name="thinkrank_seo_score" value="<?php echo esc_attr($existing_metadata['seo_score'] ?? '0'); ?>" />
485 505 <input type="hidden" id="thinkrank_generated_at" name="thinkrank_generated_at" value="<?php echo esc_attr($existing_metadata['generated_at'] ?? ''); ?>" />
486 506 <input type="hidden" id="thinkrank_pillar_content" name="thinkrank_pillar_content" value="<?php echo esc_attr($existing_metadata['pillar_content'] ?? ''); ?>" />
507 + <input type="hidden" id="thinkrank_exclude_from_search" name="thinkrank_exclude_from_search" value="<?php echo esc_attr((string) ($existing_metadata['exclude_from_search'] ?? '')); ?>" />
508 + <input type="hidden" id="thinkrank_exclude_from_archives" name="thinkrank_exclude_from_archives" value="<?php echo esc_attr((string) ($existing_metadata['exclude_from_archives'] ?? '')); ?>" />
487 509 <input type="hidden" id="thinkrank_canonical_url" name="thinkrank_canonical_url" value="<?php echo esc_url($existing_metadata['canonical_url'] ?? ''); ?>" />
510 + <?php
511 + // The redirect lives in Pro's rules table, not post meta, so nothing
512 + // else hands it to the React app. Without these the field loads
513 + // empty, and its own hidden input then posts that empty value on the
514 + // next save, which Object_Redirect reads as "remove the redirect".
515 + // Rendered only when a provider can store it, matching MetaboxApp.
516 + if (Object_Redirect::is_supported()) :
517 + ?>
518 + <input type="hidden" id="thinkrank_redirect_url" name="thinkrank_redirect_url" value="<?php echo esc_attr((string) ($existing_metadata['redirect_url'] ?? '')); ?>" />
519 + <input type="hidden" id="thinkrank_redirect_type" name="thinkrank_redirect_type" value="<?php echo esc_attr((string) ($existing_metadata['redirect_type'] ?? Object_Redirect::DEFAULT_TYPE)); ?>" />
520 + <?php endif; ?>
488 521 <input type="hidden" id="thinkrank_robots_meta_enabled" name="thinkrank_robots_meta_enabled" value="<?php echo esc_attr((string) ($existing_metadata['robots_meta_enabled'] ?? '0')); ?>" />
489 522 <input type="hidden" id="thinkrank_robots_meta" name="thinkrank_robots_meta" value="<?php echo esc_attr((string) ($existing_metadata['robots_meta'] ?? '')); ?>" />
490 523 <input type="hidden" id="thinkrank_advanced_robots_meta" name="thinkrank_advanced_robots_meta" value="<?php echo esc_attr((string) ($existing_metadata['advanced_robots_meta'] ?? '')); ?>" />
491 524 <input type="hidden" id="thinkrank_og_title" name="thinkrank_og_title" value="<?php echo esc_attr((string) ($existing_metadata['og_title'] ?? '')); ?>" />
@@ -532,8 +565,16 @@
532 565 // #post form, so they arrive (slashed) in $_POST. Hand them straight to
533 566 // the shared persistence routine.
534 567 // phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce verified above
535 568 $this->persist_metadata($post_id, wp_unslash($_POST));
569 +
570 + // The redirect is the one field here that can be refused outright. The
571 + // response to this request is a redirect back to the editor, so the
572 + // reason has to survive one page load to be seen at all.
573 + $redirect_error = $this->get_last_redirect_error();
574 + if (null !== $redirect_error) {
575 + $this->store_redirect_error($redirect_error);
576 + }
536 577 }
537 578
538 579 /**
539 580 * Persist metabox fields for a post from a form-field-name => value map,
@@ -571,15 +612,21 @@
571 612 // written out-of-band (Auto AI on publish, imports)
572 613 // after an editor was opened, so a plain save from that now-stale editor
573 614 // would clobber the generated value with a blank. Focus keywords are
574 615 // likewise handled separately (array meta) via Focus_Keywords below.
575 - $this->persist_seo_text_field($post_id, $src, 'thinkrank_seo_title', '_thinkrank_seo_title', 'sanitize_text_field');
576 - $this->persist_seo_text_field($post_id, $src, 'thinkrank_meta_description', '_thinkrank_meta_description', 'sanitize_textarea_field');
616 + //
617 + // Both fields may hold variable tags, so they are sanitized as templates:
618 + // sanitize_text_field()/sanitize_textarea_field() strip %date% and
619 + // %category% as percent-encoding and store "te%" / "tegory%" (#521).
620 + $this->persist_seo_text_field($post_id, $src, 'thinkrank_seo_title', '_thinkrank_seo_title', [Pattern_Resolver::class, 'sanitize_template']);
621 + $this->persist_seo_text_field($post_id, $src, 'thinkrank_meta_description', '_thinkrank_meta_description', [Pattern_Resolver::class, 'sanitize_template_textarea']);
577 622
578 623 $fields = [
579 624 'thinkrank_seo_score' => 'absint',
580 625 'thinkrank_generated_at' => 'sanitize_text_field',
581 626 'thinkrank_pillar_content' => 'sanitize_text_field',
627 + 'thinkrank_exclude_from_search' => 'sanitize_text_field',
628 + 'thinkrank_exclude_from_archives' => 'sanitize_text_field',
582 629 ];
583 630
584 631 // Focus keywords: prefer the JSON array field; fall back to the legacy
585 632 // single string. Focus_Keywords::save() normalizes (dedupe, drop empty,
@@ -619,8 +666,10 @@
619 666 update_post_meta($post_id, '_thinkrank_canonical_url', $canonical_url);
620 667 }
621 668 }
622 669
670 + $this->last_redirect_error = $this->save_object_redirect('post', $post_id, $src);
671 +
623 672 foreach ($fields as $field => $sanitize_callback) {
624 673 if (isset($src[$field])) {
625 674 $value = call_user_func($sanitize_callback, $src[$field]);
626 675 update_post_meta($post_id, "_{$field}", $value);
@@ -627,8 +676,9 @@
627 676 }
628 677 }
629 678
630 679 $this->save_robots_meta($post_id, $src);
680 + $this->save_visibility_meta($post_id, $src);
631 681 $this->save_social_meta($post_id, $src);
632 682
633 683 // Update last modified timestamp
634 684 update_post_meta($post_id, '_thinkrank_last_updated', current_time('mysql'));
@@ -750,9 +800,11 @@
750 800 foreach ($text_fields as $field => $meta_key) {
751 801 if (!isset($src[$field])) {
752 802 continue;
753 803 }
754 - $value = sanitize_textarea_field((string) $src[$field]);
804 + // Template fields: the frontend resolves their variable tags, so the
805 + // %tokens% have to survive the save (#521).
806 + $value = Pattern_Resolver::sanitize_template_textarea((string) $src[$field]);
755 807 if ($value === '') {
756 808 delete_post_meta($post_id, $meta_key);
757 809 } else {
758 810 update_post_meta($post_id, $meta_key, $value);
@@ -801,8 +853,43 @@
801 853 }
802 854
803 855
804 856 /**
857 + * Save the per-post listing-visibility switches.
858 + *
859 + * Stored as 1 or deleted rather than 1/0: the excluded set is read with a
860 + * `meta_value = '1'` query, so a row holding 0 would be dead weight on every
861 + * post anyone ever unticked. Deleting keeps the postmeta table proportional
862 + * to the number of posts actually hidden.
863 + *
864 + * @since 2.7.0
865 + *
866 + * @param int $post_id Post being saved.
867 + * @param array $src Submitted fields.
868 + * @return void
869 + */
870 + private function save_visibility_meta(int $post_id, array $src): void {
871 + $fields = [
872 + 'thinkrank_exclude_from_search' => \ThinkRank\SEO\Content_Visibility::SEARCH_META,
873 + 'thinkrank_exclude_from_archives' => \ThinkRank\SEO\Content_Visibility::ARCHIVE_META,
874 + ];
875 +
876 + foreach ($fields as $field => $meta_key) {
877 + if (!isset($src[$field])) {
878 + continue;
879 + }
880 +
881 + if ((bool) $src[$field]) {
882 + update_post_meta($post_id, $meta_key, 1);
883 + } else {
884 + delete_post_meta($post_id, $meta_key);
885 + }
886 + }
887 +
888 + \ThinkRank\SEO\Content_Visibility::flush();
889 + }
890 +
891 + /**
805 892 * Enqueue meta box scripts
806 893 *
807 894 * @param string $hook Current admin page hook
808 895 * @return void
@@ -934,8 +1021,13 @@
934 1021 'postModified' => $post ? get_the_modified_date('c', $post) : '',
935 1022 'linkSuggestionsEnabled' => $this->is_link_suggestions_enabled($post_type),
936 1023 'postStatus' => get_post_status($post_id),
937 1024 'isPro' => Plan_Config::is_pro(),
1025 + // Whether a provider (Pro's Redirections feature) can actually store
1026 + // a redirect. False renders the field as an upsell rather than an
1027 + // input that accepts text nothing will ever act on.
1028 + 'redirectSupported' => Object_Redirect::is_supported(),
1029 + 'redirectTypes' => Object_Redirect::TYPES,
938 1030 /**
939 1031 * Filter the editor SEO panel's post-load refresh behaviour.
940 1032 *
941 1033 * The panel re-checks `/metadata/{id}` after load so values written
@@ -966,10 +1058,8 @@
966 1058 'aiConfigured' => !empty($this->settings->get('openai_api_key', ''))
967 1059 || !empty($this->settings->get('claude_api_key', ''))
968 1060 || !empty($this->settings->get('gemini_api_key', ''))
969 1061 || !empty($this->settings->get('openrouter_api_key', '')),
970 - // Focus keywords plan limits (max_keywords; 0 = unlimited).
971 - 'focusKeywords' => Plan_Config::focus_keywords(),
972 1062 // Resolved Global/Bulk SEO variable-tag patterns for this post, shown
973 1063 // as placeholder previews when a field is empty (the frontend applies
974 1064 // these same patterns on output). Typing a value overrides them.
975 1065 'patternPreviews' => Pattern_Resolver::previews($post_id),
@@ -1085,26 +1175,43 @@
1085 1175 'show_ui' => true,
1086 1176 '_builtin' => false,
1087 1177 ]);
1088 1178
1179 + // WordPress internals that should never carry an SEO metabox. Fixed,
1180 + // so it is built once rather than per post type.
1181 + $wp_internal_types = [
1182 + 'attachment',
1183 + 'revision',
1184 + 'nav_menu_item',
1185 + 'custom_css',
1186 + 'customize_changeset',
1187 + 'oembed_cache',
1188 + 'user_request',
1189 + 'wp_block',
1190 + 'wp_template',
1191 + 'wp_template_part',
1192 + 'wp_global_styles',
1193 + 'wp_navigation',
1194 + 'acf-field',
1195 + 'acf-field-group',
1196 + ];
1197 +
1198 + // Builder template CPTs (Bricks, Elementor, Divi, Beaver Builder) are
1199 + // layout fragments, not pages with their own SEO. Global SEO already
1200 + // refuses them; this list is shared with that policy so the two cannot
1201 + // drift apart again (#621).
1202 + if (!class_exists('\ThinkRank\SEO\Global_SEO_Post_Types')) {
1203 + require_once THINKRANK_PLUGIN_DIR . 'includes/seo/class-global-seo-post-types.php';
1204 + }
1205 +
1089 1206 foreach ($custom_post_types as $post_type) {
1090 - // Skip certain post types that shouldn't have SEO metabox
1091 - $excluded_types = [
1092 - 'attachment',
1093 - 'revision',
1094 - 'nav_menu_item',
1095 - 'custom_css',
1096 - 'customize_changeset',
1097 - 'oembed_cache',
1098 - 'user_request',
1099 - 'wp_block',
1100 - 'wp_template',
1101 - 'wp_template_part',
1102 - 'wp_global_styles',
1103 - 'wp_navigation',
1104 - 'acf-field',
1105 - 'acf-field-group',
1106 - ];
1207 + // Resolved per post type, not hoisted: the shared list runs through
1208 + // a public filter that receives the post-type object, so an
1209 + // integrator can answer differently for different post types.
1210 + $excluded_types = array_merge(
1211 + $wp_internal_types,
1212 + \ThinkRank\SEO\Global_SEO_Post_Types::excluded_post_types(get_post_type_object($post_type))
1213 + );
1107 1214
1108 1215 if (!in_array($post_type, $excluded_types, true) && !in_array($post_type, $default_types, true)) {
1109 1216 $default_types[] = $post_type;
1110 1217 }
@@ -1113,8 +1220,130 @@
1113 1220 return apply_filters('thinkrank_supported_post_types', $default_types);
1114 1221 }
1115 1222
1116 1223 /**
1224 + * Transient holding the last redirect error for the current user.
1225 + */
1226 + private const REDIRECT_ERROR_TRANSIENT = 'thinkrank_redirect_error_';
1227 +
1228 + /**
1229 + * Why the redirect field was refused on the most recent persist, if it was.
1230 + *
1231 + * @var \WP_Error|null
1232 + */
1233 + private ?\WP_Error $last_redirect_error = null;
1234 +
1235 + /**
1236 + * Persist the edit-screen redirect field.
1237 + *
1238 + * Absent keys are left alone, so a caller that never rendered the field
1239 + * (the AJAX save from an editor that submits a subset, an import) cannot
1240 + * clear a redirect by omission.
1241 + *
1242 + * The destination is not post meta — Pro's rules table holds it — so unlike
1243 + * every other field here this save can fail for reasons the editor needs to
1244 + * hear about: no Pro, plain permalinks, a destination that is the page's own
1245 + * URL. Failing silently would be the worst of both, since the field would
1246 + * redisplay empty on the next load with no explanation, so the reason is
1247 + * stashed for the notice rendered on the next screen.
1248 + *
1249 + * @param string $object_type 'post' or 'term'.
1250 + * @param int $object_id Object ID.
1251 + * @param array $src Field name => raw value map.
1252 + * @return void
1253 + */
1254 + private function save_object_redirect(string $object_type, int $object_id, array $src): ?\WP_Error {
1255 + if (!array_key_exists('thinkrank_redirect_url', $src)) {
1256 + return null;
1257 + }
1258 +
1259 + $url = (string) $src['thinkrank_redirect_url'];
1260 +
1261 + // With no provider there is nothing to store and nothing to clear.
1262 + // Staying quiet when the field was submitted empty keeps every ordinary
1263 + // save on a free site from raising an error about a field the editor
1264 + // never touched.
1265 + if (!Object_Redirect::is_supported()) {
1266 + if ('' !== trim($url)) {
1267 + return new \WP_Error(
1268 + 'thinkrank_redirect_unsupported',
1269 + __('Redirects require ThinkRank Pro with the Redirections feature active.', 'thinkrank')
1270 + );
1271 + }
1272 + return null;
1273 + }
1274 +
1275 + $type = array_key_exists('thinkrank_redirect_type', $src)
1276 + ? $src['thinkrank_redirect_type']
1277 + : Object_Redirect::DEFAULT_TYPE;
1278 +
1279 + $result = Object_Redirect::save($object_type, $object_id, $url, $type);
1280 +
1281 + return is_wp_error($result) ? $result : null;
1282 + }
1283 +
1284 + /**
1285 + * Why the last persist_metadata() call could not store the redirect.
1286 + *
1287 + * Every other metabox field either saves or is sanitized into something
1288 + * that does; this one can be refused, and each caller reports that
1289 + * differently — a notice for the form post, a JSON field for the AJAX save,
1290 + * an error message for the MCP ability.
1291 + *
1292 + * @return \WP_Error|null
1293 + */
1294 + public function get_last_redirect_error(): ?\WP_Error {
1295 + return $this->last_redirect_error;
1296 + }
1297 +
1298 + /**
1299 + * Remember why a redirect could not be saved, for the next admin screen.
1300 + *
1301 + * @param \WP_Error $error Failure.
1302 + * @return void
1303 + */
1304 + private function store_redirect_error(\WP_Error $error): void {
1305 + $user_id = get_current_user_id();
1306 + if ($user_id <= 0) {
1307 + return;
1308 + }
1309 +
1310 + set_transient(self::REDIRECT_ERROR_TRANSIENT . $user_id, $error->get_error_message(), MINUTE_IN_SECONDS);
1311 + }
1312 +
1313 + /**
1314 + * Show, once, why the last redirect save failed.
1315 + *
1316 + * @return void
1317 + */
1318 + public function render_redirect_notice(): void {
1319 + $user_id = get_current_user_id();
1320 + if ($user_id <= 0) {
1321 + return;
1322 + }
1323 +
1324 + $key = self::REDIRECT_ERROR_TRANSIENT . $user_id;
1325 + $message = get_transient($key);
1326 +
1327 + if (!is_string($message) || '' === $message) {
1328 + return;
1329 + }
1330 +
1331 + delete_transient($key);
1332 +
1333 + printf(
1334 + '<div class="notice notice-error is-dismissible"><p>%s</p></div>',
1335 + esc_html(
1336 + sprintf(
1337 + /* translators: %s: reason the redirect was not saved. */
1338 + __('ThinkRank could not save the redirect: %s', 'thinkrank'),
1339 + $message
1340 + )
1341 + )
1342 + );
1343 + }
1344 +
1345 + /**
1117 1346 * Get existing post metadata
1118 1347 *
1119 1348 * @param int $post_id Post ID
1120 1349 * @return array Existing metadata
@@ -1119,8 +1348,11 @@
1119 1348 * @param int $post_id Post ID
1120 1349 * @return array Existing metadata
1121 1350 */
1122 1351 public function get_post_metadata(int $post_id): array {
1352 + // One lookup: get() goes through a filter Pro answers from the database.
1353 + $redirect = Object_Redirect::get('post', $post_id);
1354 +
1123 1355 return [
1124 1356 'title' => get_post_meta($post_id, '_thinkrank_seo_title', true),
1125 1357 'description' => get_post_meta($post_id, '_thinkrank_meta_description', true),
1126 1358 'focus_keyword' => Focus_Keywords::get_primary($post_id),
@@ -1127,9 +1359,15 @@
1127 1359 'focus_keywords' => Focus_Keywords::get($post_id),
1128 1360 'seo_score' => get_post_meta($post_id, '_thinkrank_seo_score', true),
1129 1361 'generated_at' => get_post_meta($post_id, '_thinkrank_generated_at', true),
1130 1362 'pillar_content' => get_post_meta($post_id, '_thinkrank_pillar_content', true),
1363 + 'exclude_from_search' => get_post_meta($post_id, \ThinkRank\SEO\Content_Visibility::SEARCH_META, true),
1364 + 'exclude_from_archives' => get_post_meta($post_id, \ThinkRank\SEO\Content_Visibility::ARCHIVE_META, true),
1131 1365 'canonical_url' => get_post_meta($post_id, '_thinkrank_canonical_url', true),
1366 + // Not post meta: the rule in Pro's redirections table is the value.
1367 + // See ThinkRank\SEO\Object_Redirect.
1368 + 'redirect_url' => $redirect['url'],
1369 + 'redirect_type' => $redirect['type'],
1132 1370 'robots_meta_enabled' => get_post_meta($post_id, '_thinkrank_robots_meta_enabled', true),
1133 1371 'robots_meta' => get_post_meta($post_id, '_thinkrank_robots_meta', true),
1134 1372 'advanced_robots_meta' => get_post_meta($post_id, '_thinkrank_advanced_robots_meta', true),
1135 1373 'og_title' => get_post_meta($post_id, '_thinkrank_og_title', true),
@@ -1233,9 +1471,11 @@
1233 1471 // Clean and limit content
1234 1472 $content = wp_strip_all_tags($content);
1235 1473 $content = preg_replace('/\s+/', ' ', $content);
1236 1474
1237 - return trim(substr($content, 0, 4000));
1475 + // substr() counts BYTES: on Thai or CJK this handed the model a third
1476 + // of the intended content and cut the last character in half (#687).
1477 + return trim(\ThinkRank\Core\Seo_Text::trim_to_length($content, 4000));
1238 1478 }
1239 1479
1240 1480 /**
1241 1481 * AJAX handler for generating post metadata
@@ -1296,8 +1536,22 @@
1296 1536 }
1297 1537
1298 1538 // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- nonce verified above; each field sanitized inside persist_metadata()
1299 1539 $this->persist_metadata($post_id, wp_unslash($_POST));
1540 +
1541 + // Everything else saved; only the redirect can have been refused. Report
1542 + // it in this response rather than as a notice on some later screen —
1543 + // this caller never reloads the page.
1544 + $redirect_error = $this->get_last_redirect_error();
1545 + if (null !== $redirect_error) {
1546 + wp_send_json_error([
1547 + 'message' => sprintf(
1548 + /* translators: %s: reason the redirect was not saved. */
1549 + __('Saved, except the redirect: %s', 'thinkrank'),
1550 + $redirect_error->get_error_message()
1551 + ),
1552 + ], 400);
1553 + }
1300 1554
1301 1555 wp_send_json_success([
1302 1556 'message' => __('SEO settings saved successfully!', 'thinkrank'),
1303 1557 ]);