← All changes | includes/abilities/widgets/wdesignkit-widget-preview.php +13 -2 2.6.1 → 2.7.1 View file →

		@@ -47,8 +47,9 @@
47	47	],
48	48	'execute_callback' => 'wdesignkit_mcp_widget_preview',
49	49	'permission_callback' => 'wdesignkit_mcp_permission_callback',
50	50	'meta' => [
	51	+ 'public' => true,
51	52	'show_in_rest' => true,
52	53	'mcp' => ['public' => true],
53	54	'annotations' => [
54	55	'instructions' => implode("\n", [
		@@ -81,15 +82,25 @@
81	82	if ($folder === '') {
82	83	return ['success' => false, 'message' => 'folder is required.'];
83	84	}
84	85
85		- // Normalise gutenberg_core → gutenberg for filesystem lookup
86		- $fs_builder = ($builder === 'gutenberg_core') ? 'gutenberg' : $builder;
	86	+ // gutenberg_core widgets live under their own gutenberg_core/ directory — create-widget,
	87	+ // list-widgets, and the gutenberg_core loader all use the raw builder name. Resolve the
	88	+ // folder under the actual builder dir; collapsing gutenberg_core → gutenberg made the
	89	+ // lookup fail with "Widget folder not found" for every Core Gutenberg widget. (bug: 86d3rc7nf)
	90	+ $fs_builder = $builder;
87	91
88	92	$widget_dir = WDKIT_BUILDER_PATH . '/' . $fs_builder . '/' . $folder;
89	93
90	94	if (!is_dir($widget_dir)) {
91	95	return ['success' => false, 'message' => "Widget folder not found: {$fs_builder}/{$folder}"];
	96	+ }
	97	+
	98	+ // Realpath validation — ensure we're still inside WDKIT_BUILDER_PATH.
	99	+ $real_widget = realpath($widget_dir);
	100	+ $real_base = realpath(WDKIT_BUILDER_PATH);
	101	+ if (!$real_widget || !$real_base || strpos($real_widget, $real_base . DIRECTORY_SEPARATOR) !== 0) {
	102	+ return ['success' => false, 'message' => 'Invalid widget path.'];
92	103	}
93	104
94	105	// Read widget metadata from JSON
95	106	$widget_name = $folder;