| @@ -21,8 +21,13 @@ | ||
| 21 | 21 | use WP_REST_Request; |
| 22 | 22 | use WP_REST_Response; |
| 23 | 23 | use WP_Error; |
| 24 | 24 | |
| 25 | +// Prevent direct access | |
| 26 | +if (!defined('ABSPATH')) { | |
| 27 | + exit; | |
| 28 | +} | |
| 29 | + | |
| 25 | 30 | /** |
| 26 | 31 | * Instant Indexing API Endpoints Class |
| 27 | 32 | * |
| 28 | 33 | * Provides REST API endpoints for Instant Indexing operations. |
| @@ -159,9 +164,25 @@ | ||
| 159 | 164 | 'limit' => [ |
| 160 | 165 | 'required' => false, |
| 161 | 166 | 'type' => 'integer', |
| 162 | 167 | 'default' => -1 |
| 163 | - ] | |
| 168 | + ], | |
| 169 | + // Both are read by get_submission_history() and neither | |
| 170 | + // was registered, so they arrived uncoerced and | |
| 171 | + // unbounded (#394). | |
| 172 | + 'page' => [ | |
| 173 | + 'required' => false, | |
| 174 | + 'type' => 'integer', | |
| 175 | + 'default' => 1, | |
| 176 | + 'minimum' => 1, | |
| 177 | + ], | |
| 178 | + 'per_page' => [ | |
| 179 | + 'required' => false, | |
| 180 | + 'type' => 'integer', | |
| 181 | + 'default' => 20, | |
| 182 | + 'minimum' => 1, | |
| 183 | + 'maximum' => 100, | |
| 184 | + ], | |
| 164 | 185 | ] |
| 165 | 186 | ], |
| 166 | 187 | [ |
| 167 | 188 | 'methods' => 'DELETE', |
| @@ -328,18 +349,26 @@ | ||
| 328 | 349 | if (empty($params)) { |
| 329 | 350 | $params = $request->get_params(); // Fallback if content-type is not JSON |
| 330 | 351 | } |
| 331 | 352 | |
| 332 | - // Sanitize Post Types | |
| 333 | - $post_types = isset($params['auto_submit_post_types']) ? (array) $params['auto_submit_post_types'] : []; | |
| 334 | - $sanitized_post_types = array_map('sanitize_text_field', $post_types); | |
| 353 | + $current_settings = get_option($this->option_name, []); | |
| 354 | + if (!is_array($current_settings)) { | |
| 355 | + $current_settings = []; | |
| 356 | + } | |
| 357 | + $new_settings = $current_settings; | |
| 335 | 358 | |
| 336 | - // We generally don't let user update API Key directly via update_settings, | |
| 337 | - // they should use regenerate, but if we need to support manual entry: | |
| 338 | - $current_settings = get_option($this->option_name, []); | |
| 339 | - $new_settings = array_merge($current_settings, [ | |
| 340 | - 'auto_submit_post_types' => $sanitized_post_types | |
| 341 | - ]); | |
| 359 | + // Only write the post types when the caller actually sent them. Writing | |
| 360 | + // unconditionally meant a payload of {"enabled": true} cleared the list, | |
| 361 | + // so the feature came on with nothing to submit — and diverged from the | |
| 362 | + // MCP ability, which writes this same option with an array_key_exists() | |
| 363 | + // merge. An explicit empty array still clears, since isset() is true | |
| 364 | + // for one (#562). | |
| 365 | + if (isset($params['auto_submit_post_types'])) { | |
| 366 | + $new_settings['auto_submit_post_types'] = array_values(array_map( | |
| 367 | + 'sanitize_key', | |
| 368 | + (array) $params['auto_submit_post_types'] | |
| 369 | + )); | |
| 370 | + } | |
| 342 | 371 | |
| 343 | 372 | // Save enabled state |
| 344 | 373 | if (isset($params['enabled'])) { |
| 345 | 374 | $new_settings['enabled'] = rest_sanitize_boolean($params['enabled']); |
