| @@ -21,8 +21,13 @@ | ||
| 21 | 21 | use WP_REST_Request; |
| 22 | 22 | use WP_REST_Response; |
| 23 | 23 | use WP_Error; |
| 24 | 24 | |
| 25 | +// Prevent direct access | |
| 26 | +if (!defined('ABSPATH')) { | |
| 27 | + exit; | |
| 28 | +} | |
| 29 | + | |
| 25 | 30 | /** |
| 26 | 31 | * Instant Indexing API Endpoints Class |
| 27 | 32 | * |
| 28 | 33 | * Provides REST API endpoints for Instant Indexing operations. |
| @@ -344,18 +349,26 @@ | ||
| 344 | 349 | if (empty($params)) { |
| 345 | 350 | $params = $request->get_params(); // Fallback if content-type is not JSON |
| 346 | 351 | } |
| 347 | 352 | |
| 348 | - // Sanitize Post Types | |
| 349 | - $post_types = isset($params['auto_submit_post_types']) ? (array) $params['auto_submit_post_types'] : []; | |
| 350 | - $sanitized_post_types = array_map('sanitize_text_field', $post_types); | |
| 353 | + $current_settings = get_option($this->option_name, []); | |
| 354 | + if (!is_array($current_settings)) { | |
| 355 | + $current_settings = []; | |
| 356 | + } | |
| 357 | + $new_settings = $current_settings; | |
| 351 | 358 | |
| 352 | - // We generally don't let user update API Key directly via update_settings, | |
| 353 | - // they should use regenerate, but if we need to support manual entry: | |
| 354 | - $current_settings = get_option($this->option_name, []); | |
| 355 | - $new_settings = array_merge($current_settings, [ | |
| 356 | - 'auto_submit_post_types' => $sanitized_post_types | |
| 357 | - ]); | |
| 359 | + // Only write the post types when the caller actually sent them. Writing | |
| 360 | + // unconditionally meant a payload of {"enabled": true} cleared the list, | |
| 361 | + // so the feature came on with nothing to submit — and diverged from the | |
| 362 | + // MCP ability, which writes this same option with an array_key_exists() | |
| 363 | + // merge. An explicit empty array still clears, since isset() is true | |
| 364 | + // for one (#562). | |
| 365 | + if (isset($params['auto_submit_post_types'])) { | |
| 366 | + $new_settings['auto_submit_post_types'] = array_values(array_map( | |
| 367 | + 'sanitize_key', | |
| 368 | + (array) $params['auto_submit_post_types'] | |
| 369 | + )); | |
| 370 | + } | |
| 358 | 371 | |
| 359 | 372 | // Save enabled state |
| 360 | 373 | if (isset($params['enabled'])) { |
| 361 | 374 | $new_settings['enabled'] = rest_sanitize_boolean($params['enabled']); |
