← All changes | includes/admin/class-metabox-manager.php +268 -20 2.2.0 → 2.7.0 View file →

		@@ -18,8 +18,9 @@
18	18	use ThinkRank\Core\Settings;
19	19	use ThinkRank\Core\Database;
20	20	use ThinkRank\Core\Plan_Config;
21	21	use ThinkRank\SEO\Focus_Keywords;
	22	+use ThinkRank\SEO\Object_Redirect;
22	23	use ThinkRank\SEO\Pattern_Resolver;
23	24
24	25	// Prevent direct access
25	26	if (!defined('ABSPATH')) {
		@@ -77,8 +78,9 @@
77	78	public function init(): void {
78	79	add_action('add_meta_boxes', [$this, 'add_meta_boxes']);
79	80	add_action('save_post', [$this, 'save_meta_boxes'], 10, 2);
80	81	add_action('admin_enqueue_scripts', [$this, 'enqueue_metabox_scripts']);
	82	+ add_action('admin_notices', [$this, 'render_redirect_notice']);
81	83	add_action('init', [$this, 'register_meta_fields']);
82	84
83	85	// AJAX handlers for meta box functionality
84	86	add_action('wp_ajax_thinkrank_generate_post_metadata', [$this, 'ajax_generate_post_metadata']);
		@@ -206,8 +208,26 @@
206	208	return current_user_can('edit_posts') || current_user_can('edit_pages');
207	209	}
208	210	]);
209	211
	212	+ register_post_meta('', \ThinkRank\SEO\Content_Visibility::SEARCH_META, [
	213	+ 'show_in_rest' => true,
	214	+ 'single' => true,
	215	+ 'type' => 'integer',
	216	+ 'auth_callback' => function () {
	217	+ return current_user_can('edit_posts') || current_user_can('edit_pages');
	218	+ }
	219	+ ]);
	220	+
	221	+ register_post_meta('', \ThinkRank\SEO\Content_Visibility::ARCHIVE_META, [
	222	+ 'show_in_rest' => true,
	223	+ 'single' => true,
	224	+ 'type' => 'integer',
	225	+ 'auth_callback' => function () {
	226	+ return current_user_can('edit_posts') || current_user_can('edit_pages');
	227	+ }
	228	+ ]);
	229	+
210	230	register_post_meta('', '_thinkrank_primary_category', [
211	231	'show_in_rest' => true,
212	232	'single' => true,
213	233	'type' => 'integer',
		@@ -483,9 +503,22 @@
483	503	<input type="hidden" id="thinkrank_focus_keywords" name="thinkrank_focus_keywords" value="<?php echo esc_attr(wp_json_encode($existing_metadata['focus_keywords'] ?? [])); ?>" />
484	504	<input type="hidden" id="thinkrank_seo_score" name="thinkrank_seo_score" value="<?php echo esc_attr($existing_metadata['seo_score'] ?? '0'); ?>" />
485	505	<input type="hidden" id="thinkrank_generated_at" name="thinkrank_generated_at" value="<?php echo esc_attr($existing_metadata['generated_at'] ?? ''); ?>" />
486	506	<input type="hidden" id="thinkrank_pillar_content" name="thinkrank_pillar_content" value="<?php echo esc_attr($existing_metadata['pillar_content'] ?? ''); ?>" />
	507	+ <input type="hidden" id="thinkrank_exclude_from_search" name="thinkrank_exclude_from_search" value="<?php echo esc_attr((string) ($existing_metadata['exclude_from_search'] ?? '')); ?>" />
	508	+ <input type="hidden" id="thinkrank_exclude_from_archives" name="thinkrank_exclude_from_archives" value="<?php echo esc_attr((string) ($existing_metadata['exclude_from_archives'] ?? '')); ?>" />
487	509	<input type="hidden" id="thinkrank_canonical_url" name="thinkrank_canonical_url" value="<?php echo esc_url($existing_metadata['canonical_url'] ?? ''); ?>" />
	510	+ <?php
	511	+ // The redirect lives in Pro's rules table, not post meta, so nothing
	512	+ // else hands it to the React app. Without these the field loads
	513	+ // empty, and its own hidden input then posts that empty value on the
	514	+ // next save, which Object_Redirect reads as "remove the redirect".
	515	+ // Rendered only when a provider can store it, matching MetaboxApp.
	516	+ if (Object_Redirect::is_supported()) :
	517	+ ?>
	518	+ <input type="hidden" id="thinkrank_redirect_url" name="thinkrank_redirect_url" value="<?php echo esc_attr((string) ($existing_metadata['redirect_url'] ?? '')); ?>" />
	519	+ <input type="hidden" id="thinkrank_redirect_type" name="thinkrank_redirect_type" value="<?php echo esc_attr((string) ($existing_metadata['redirect_type'] ?? Object_Redirect::DEFAULT_TYPE)); ?>" />
	520	+ <?php endif; ?>
488	521	<input type="hidden" id="thinkrank_robots_meta_enabled" name="thinkrank_robots_meta_enabled" value="<?php echo esc_attr((string) ($existing_metadata['robots_meta_enabled'] ?? '0')); ?>" />
489	522	<input type="hidden" id="thinkrank_robots_meta" name="thinkrank_robots_meta" value="<?php echo esc_attr((string) ($existing_metadata['robots_meta'] ?? '')); ?>" />
490	523	<input type="hidden" id="thinkrank_advanced_robots_meta" name="thinkrank_advanced_robots_meta" value="<?php echo esc_attr((string) ($existing_metadata['advanced_robots_meta'] ?? '')); ?>" />
491	524	<input type="hidden" id="thinkrank_og_title" name="thinkrank_og_title" value="<?php echo esc_attr((string) ($existing_metadata['og_title'] ?? '')); ?>" />
		@@ -532,8 +565,16 @@
532	565	// #post form, so they arrive (slashed) in $_POST. Hand them straight to
533	566	// the shared persistence routine.
534	567	// phpcs:ignore WordPress.Security.NonceVerification.Missing -- nonce verified above
535	568	$this->persist_metadata($post_id, wp_unslash($_POST));
	569	+
	570	+ // The redirect is the one field here that can be refused outright. The
	571	+ // response to this request is a redirect back to the editor, so the
	572	+ // reason has to survive one page load to be seen at all.
	573	+ $redirect_error = $this->get_last_redirect_error();
	574	+ if (null !== $redirect_error) {
	575	+ $this->store_redirect_error($redirect_error);
	576	+ }
536	577	}
537	578
538	579	/**
539	580	* Persist metabox fields for a post from a form-field-name => value map,
		@@ -582,8 +623,10 @@
582	623	$fields = [
583	624	'thinkrank_seo_score' => 'absint',
584	625	'thinkrank_generated_at' => 'sanitize_text_field',
585	626	'thinkrank_pillar_content' => 'sanitize_text_field',
	627	+ 'thinkrank_exclude_from_search' => 'sanitize_text_field',
	628	+ 'thinkrank_exclude_from_archives' => 'sanitize_text_field',
586	629	];
587	630
588	631	// Focus keywords: prefer the JSON array field; fall back to the legacy
589	632	// single string. Focus_Keywords::save() normalizes (dedupe, drop empty,
		@@ -623,8 +666,10 @@
623	666	update_post_meta($post_id, '_thinkrank_canonical_url', $canonical_url);
624	667	}
625	668	}
626	669
	670	+ $this->last_redirect_error = $this->save_object_redirect('post', $post_id, $src);
	671	+
627	672	foreach ($fields as $field => $sanitize_callback) {
628	673	if (isset($src[$field])) {
629	674	$value = call_user_func($sanitize_callback, $src[$field]);
630	675	update_post_meta($post_id, "_{$field}", $value);
		@@ -631,8 +676,9 @@
631	676	}
632	677	}
633	678
634	679	$this->save_robots_meta($post_id, $src);
	680	+ $this->save_visibility_meta($post_id, $src);
635	681	$this->save_social_meta($post_id, $src);
636	682
637	683	// Update last modified timestamp
638	684	update_post_meta($post_id, '_thinkrank_last_updated', current_time('mysql'));
		@@ -807,8 +853,43 @@
807	853	}
808	854
809	855
810	856	/**
	857	+ * Save the per-post listing-visibility switches.
	858	+ *
	859	+ * Stored as 1 or deleted rather than 1/0: the excluded set is read with a
	860	+ * `meta_value = '1'` query, so a row holding 0 would be dead weight on every
	861	+ * post anyone ever unticked. Deleting keeps the postmeta table proportional
	862	+ * to the number of posts actually hidden.
	863	+ *
	864	+ * @since 2.7.0
	865	+ *
	866	+ * @param int $post_id Post being saved.
	867	+ * @param array $src Submitted fields.
	868	+ * @return void
	869	+ */
	870	+ private function save_visibility_meta(int $post_id, array $src): void {
	871	+ $fields = [
	872	+ 'thinkrank_exclude_from_search' => \ThinkRank\SEO\Content_Visibility::SEARCH_META,
	873	+ 'thinkrank_exclude_from_archives' => \ThinkRank\SEO\Content_Visibility::ARCHIVE_META,
	874	+ ];
	875	+
	876	+ foreach ($fields as $field => $meta_key) {
	877	+ if (!isset($src[$field])) {
	878	+ continue;
	879	+ }
	880	+
	881	+ if ((bool) $src[$field]) {
	882	+ update_post_meta($post_id, $meta_key, 1);
	883	+ } else {
	884	+ delete_post_meta($post_id, $meta_key);
	885	+ }
	886	+ }
	887	+
	888	+ \ThinkRank\SEO\Content_Visibility::flush();
	889	+ }
	890	+
	891	+ /**
811	892	* Enqueue meta box scripts
812	893	*
813	894	* @param string $hook Current admin page hook
814	895	* @return void
		@@ -940,8 +1021,13 @@
940	1021	'postModified' => $post ? get_the_modified_date('c', $post) : '',
941	1022	'linkSuggestionsEnabled' => $this->is_link_suggestions_enabled($post_type),
942	1023	'postStatus' => get_post_status($post_id),
943	1024	'isPro' => Plan_Config::is_pro(),
	1025	+ // Whether a provider (Pro's Redirections feature) can actually store
	1026	+ // a redirect. False renders the field as an upsell rather than an
	1027	+ // input that accepts text nothing will ever act on.
	1028	+ 'redirectSupported' => Object_Redirect::is_supported(),
	1029	+ 'redirectTypes' => Object_Redirect::TYPES,
944	1030	/**
945	1031	* Filter the editor SEO panel's post-load refresh behaviour.
946	1032	*
947	1033	* The panel re-checks `/metadata/{id}` after load so values written
		@@ -972,10 +1058,8 @@
972	1058	'aiConfigured' => !empty($this->settings->get('openai_api_key', ''))
973	1059	|| !empty($this->settings->get('claude_api_key', ''))
974	1060	|| !empty($this->settings->get('gemini_api_key', ''))
975	1061	|| !empty($this->settings->get('openrouter_api_key', '')),
976		- // Focus keywords plan limits (max_keywords; 0 = unlimited).
977		- 'focusKeywords' => Plan_Config::focus_keywords(),
978	1062	// Resolved Global/Bulk SEO variable-tag patterns for this post, shown
979	1063	// as placeholder previews when a field is empty (the frontend applies
980	1064	// these same patterns on output). Typing a value overrides them.
981	1065	'patternPreviews' => Pattern_Resolver::previews($post_id),
		@@ -1091,26 +1175,43 @@
1091	1175	'show_ui' => true,
1092	1176	'_builtin' => false,
1093	1177	]);
1094	1178
	1179	+ // WordPress internals that should never carry an SEO metabox. Fixed,
	1180	+ // so it is built once rather than per post type.
	1181	+ $wp_internal_types = [
	1182	+ 'attachment',
	1183	+ 'revision',
	1184	+ 'nav_menu_item',
	1185	+ 'custom_css',
	1186	+ 'customize_changeset',
	1187	+ 'oembed_cache',
	1188	+ 'user_request',
	1189	+ 'wp_block',
	1190	+ 'wp_template',
	1191	+ 'wp_template_part',
	1192	+ 'wp_global_styles',
	1193	+ 'wp_navigation',
	1194	+ 'acf-field',
	1195	+ 'acf-field-group',
	1196	+ ];
	1197	+
	1198	+ // Builder template CPTs (Bricks, Elementor, Divi, Beaver Builder) are
	1199	+ // layout fragments, not pages with their own SEO. Global SEO already
	1200	+ // refuses them; this list is shared with that policy so the two cannot
	1201	+ // drift apart again (#621).
	1202	+ if (!class_exists('\ThinkRank\SEO\Global_SEO_Post_Types')) {
	1203	+ require_once THINKRANK_PLUGIN_DIR . 'includes/seo/class-global-seo-post-types.php';
	1204	+ }
	1205	+
1095	1206	foreach ($custom_post_types as $post_type) {
1096		- // Skip certain post types that shouldn't have SEO metabox
1097		- $excluded_types = [
1098		- 'attachment',
1099		- 'revision',
1100		- 'nav_menu_item',
1101		- 'custom_css',
1102		- 'customize_changeset',
1103		- 'oembed_cache',
1104		- 'user_request',
1105		- 'wp_block',
1106		- 'wp_template',
1107		- 'wp_template_part',
1108		- 'wp_global_styles',
1109		- 'wp_navigation',
1110		- 'acf-field',
1111		- 'acf-field-group',
1112		- ];
	1207	+ // Resolved per post type, not hoisted: the shared list runs through
	1208	+ // a public filter that receives the post-type object, so an
	1209	+ // integrator can answer differently for different post types.
	1210	+ $excluded_types = array_merge(
	1211	+ $wp_internal_types,
	1212	+ \ThinkRank\SEO\Global_SEO_Post_Types::excluded_post_types(get_post_type_object($post_type))
	1213	+ );
1113	1214
1114	1215	if (!in_array($post_type, $excluded_types, true) && !in_array($post_type, $default_types, true)) {
1115	1216	$default_types[] = $post_type;
1116	1217	}
		@@ -1119,8 +1220,130 @@
1119	1220	return apply_filters('thinkrank_supported_post_types', $default_types);
1120	1221	}
1121	1222
1122	1223	/**
	1224	+ * Transient holding the last redirect error for the current user.
	1225	+ */
	1226	+ private const REDIRECT_ERROR_TRANSIENT = 'thinkrank_redirect_error_';
	1227	+
	1228	+ /**
	1229	+ * Why the redirect field was refused on the most recent persist, if it was.
	1230	+ *
	1231	+ * @var \WP_Error|null
	1232	+ */
	1233	+ private ?\WP_Error $last_redirect_error = null;
	1234	+
	1235	+ /**
	1236	+ * Persist the edit-screen redirect field.
	1237	+ *
	1238	+ * Absent keys are left alone, so a caller that never rendered the field
	1239	+ * (the AJAX save from an editor that submits a subset, an import) cannot
	1240	+ * clear a redirect by omission.
	1241	+ *
	1242	+ * The destination is not post meta — Pro's rules table holds it — so unlike
	1243	+ * every other field here this save can fail for reasons the editor needs to
	1244	+ * hear about: no Pro, plain permalinks, a destination that is the page's own
	1245	+ * URL. Failing silently would be the worst of both, since the field would
	1246	+ * redisplay empty on the next load with no explanation, so the reason is
	1247	+ * stashed for the notice rendered on the next screen.
	1248	+ *
	1249	+ * @param string $object_type 'post' or 'term'.
	1250	+ * @param int $object_id Object ID.
	1251	+ * @param array $src Field name => raw value map.
	1252	+ * @return void
	1253	+ */
	1254	+ private function save_object_redirect(string $object_type, int $object_id, array $src): ?\WP_Error {
	1255	+ if (!array_key_exists('thinkrank_redirect_url', $src)) {
	1256	+ return null;
	1257	+ }
	1258	+
	1259	+ $url = (string) $src['thinkrank_redirect_url'];
	1260	+
	1261	+ // With no provider there is nothing to store and nothing to clear.
	1262	+ // Staying quiet when the field was submitted empty keeps every ordinary
	1263	+ // save on a free site from raising an error about a field the editor
	1264	+ // never touched.
	1265	+ if (!Object_Redirect::is_supported()) {
	1266	+ if ('' !== trim($url)) {
	1267	+ return new \WP_Error(
	1268	+ 'thinkrank_redirect_unsupported',
	1269	+ __('Redirects require ThinkRank Pro with the Redirections feature active.', 'thinkrank')
	1270	+ );
	1271	+ }
	1272	+ return null;
	1273	+ }
	1274	+
	1275	+ $type = array_key_exists('thinkrank_redirect_type', $src)
	1276	+ ? $src['thinkrank_redirect_type']
	1277	+ : Object_Redirect::DEFAULT_TYPE;
	1278	+
	1279	+ $result = Object_Redirect::save($object_type, $object_id, $url, $type);
	1280	+
	1281	+ return is_wp_error($result) ? $result : null;
	1282	+ }
	1283	+
	1284	+ /**
	1285	+ * Why the last persist_metadata() call could not store the redirect.
	1286	+ *
	1287	+ * Every other metabox field either saves or is sanitized into something
	1288	+ * that does; this one can be refused, and each caller reports that
	1289	+ * differently — a notice for the form post, a JSON field for the AJAX save,
	1290	+ * an error message for the MCP ability.
	1291	+ *
	1292	+ * @return \WP_Error|null
	1293	+ */
	1294	+ public function get_last_redirect_error(): ?\WP_Error {
	1295	+ return $this->last_redirect_error;
	1296	+ }
	1297	+
	1298	+ /**
	1299	+ * Remember why a redirect could not be saved, for the next admin screen.
	1300	+ *
	1301	+ * @param \WP_Error $error Failure.
	1302	+ * @return void
	1303	+ */
	1304	+ private function store_redirect_error(\WP_Error $error): void {
	1305	+ $user_id = get_current_user_id();
	1306	+ if ($user_id <= 0) {
	1307	+ return;
	1308	+ }
	1309	+
	1310	+ set_transient(self::REDIRECT_ERROR_TRANSIENT . $user_id, $error->get_error_message(), MINUTE_IN_SECONDS);
	1311	+ }
	1312	+
	1313	+ /**
	1314	+ * Show, once, why the last redirect save failed.
	1315	+ *
	1316	+ * @return void
	1317	+ */
	1318	+ public function render_redirect_notice(): void {
	1319	+ $user_id = get_current_user_id();
	1320	+ if ($user_id <= 0) {
	1321	+ return;
	1322	+ }
	1323	+
	1324	+ $key = self::REDIRECT_ERROR_TRANSIENT . $user_id;
	1325	+ $message = get_transient($key);
	1326	+
	1327	+ if (!is_string($message) || '' === $message) {
	1328	+ return;
	1329	+ }
	1330	+
	1331	+ delete_transient($key);
	1332	+
	1333	+ printf(
	1334	+ '<div class="notice notice-error is-dismissible"><p>%s</p></div>',
	1335	+ esc_html(
	1336	+ sprintf(
	1337	+ /* translators: %s: reason the redirect was not saved. */
	1338	+ __('ThinkRank could not save the redirect: %s', 'thinkrank'),
	1339	+ $message
	1340	+ )
	1341	+ )
	1342	+ );
	1343	+ }
	1344	+
	1345	+ /**
1123	1346	* Get existing post metadata
1124	1347	*
1125	1348	* @param int $post_id Post ID
1126	1349	* @return array Existing metadata
		@@ -1125,8 +1348,11 @@
1125	1348	* @param int $post_id Post ID
1126	1349	* @return array Existing metadata
1127	1350	*/
1128	1351	public function get_post_metadata(int $post_id): array {
	1352	+ // One lookup: get() goes through a filter Pro answers from the database.
	1353	+ $redirect = Object_Redirect::get('post', $post_id);
	1354	+
1129	1355	return [
1130	1356	'title' => get_post_meta($post_id, '_thinkrank_seo_title', true),
1131	1357	'description' => get_post_meta($post_id, '_thinkrank_meta_description', true),
1132	1358	'focus_keyword' => Focus_Keywords::get_primary($post_id),
		@@ -1133,9 +1359,15 @@
1133	1359	'focus_keywords' => Focus_Keywords::get($post_id),
1134	1360	'seo_score' => get_post_meta($post_id, '_thinkrank_seo_score', true),
1135	1361	'generated_at' => get_post_meta($post_id, '_thinkrank_generated_at', true),
1136	1362	'pillar_content' => get_post_meta($post_id, '_thinkrank_pillar_content', true),
	1363	+ 'exclude_from_search' => get_post_meta($post_id, \ThinkRank\SEO\Content_Visibility::SEARCH_META, true),
	1364	+ 'exclude_from_archives' => get_post_meta($post_id, \ThinkRank\SEO\Content_Visibility::ARCHIVE_META, true),
1137	1365	'canonical_url' => get_post_meta($post_id, '_thinkrank_canonical_url', true),
	1366	+ // Not post meta: the rule in Pro's redirections table is the value.
	1367	+ // See ThinkRank\SEO\Object_Redirect.
	1368	+ 'redirect_url' => $redirect['url'],
	1369	+ 'redirect_type' => $redirect['type'],
1138	1370	'robots_meta_enabled' => get_post_meta($post_id, '_thinkrank_robots_meta_enabled', true),
1139	1371	'robots_meta' => get_post_meta($post_id, '_thinkrank_robots_meta', true),
1140	1372	'advanced_robots_meta' => get_post_meta($post_id, '_thinkrank_advanced_robots_meta', true),
1141	1373	'og_title' => get_post_meta($post_id, '_thinkrank_og_title', true),
		@@ -1239,9 +1471,11 @@
1239	1471	// Clean and limit content
1240	1472	$content = wp_strip_all_tags($content);
1241	1473	$content = preg_replace('/\s+/', ' ', $content);
1242	1474
1243		- return trim(substr($content, 0, 4000));
	1475	+ // substr() counts BYTES: on Thai or CJK this handed the model a third
	1476	+ // of the intended content and cut the last character in half (#687).
	1477	+ return trim(\ThinkRank\Core\Seo_Text::trim_to_length($content, 4000));
1244	1478	}
1245	1479
1246	1480	/**
1247	1481	* AJAX handler for generating post metadata
		@@ -1302,8 +1536,22 @@
1302	1536	}
1303	1537
1304	1538	// phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- nonce verified above; each field sanitized inside persist_metadata()
1305	1539	$this->persist_metadata($post_id, wp_unslash($_POST));
	1540	+
	1541	+ // Everything else saved; only the redirect can have been refused. Report
	1542	+ // it in this response rather than as a notice on some later screen —
	1543	+ // this caller never reloads the page.
	1544	+ $redirect_error = $this->get_last_redirect_error();
	1545	+ if (null !== $redirect_error) {
	1546	+ wp_send_json_error([
	1547	+ 'message' => sprintf(
	1548	+ /* translators: %s: reason the redirect was not saved. */
	1549	+ __('Saved, except the redirect: %s', 'thinkrank'),
	1550	+ $redirect_error->get_error_message()
	1551	+ ),
	1552	+ ], 400);
	1553	+ }
1306	1554
1307	1555	wp_send_json_success([
1308	1556	'message' => __('SEO settings saved successfully!', 'thinkrank'),
1309	1557	]);