← All changes | includes/abilities/widgets/wdesignkit-widget-preview.php +8 -0 2.6.2 → 2.7.1 View file →

		@@ -47,8 +47,9 @@
47	47	],
48	48	'execute_callback' => 'wdesignkit_mcp_widget_preview',
49	49	'permission_callback' => 'wdesignkit_mcp_permission_callback',
50	50	'meta' => [
	51	+ 'public' => true,
51	52	'show_in_rest' => true,
52	53	'mcp' => ['public' => true],
53	54	'annotations' => [
54	55	'instructions' => implode("\n", [
		@@ -91,8 +92,15 @@
91	92	$widget_dir = WDKIT_BUILDER_PATH . '/' . $fs_builder . '/' . $folder;
92	93
93	94	if (!is_dir($widget_dir)) {
94	95	return ['success' => false, 'message' => "Widget folder not found: {$fs_builder}/{$folder}"];
	96	+ }
	97	+
	98	+ // Realpath validation — ensure we're still inside WDKIT_BUILDER_PATH.
	99	+ $real_widget = realpath($widget_dir);
	100	+ $real_base = realpath(WDKIT_BUILDER_PATH);
	101	+ if (!$real_widget || !$real_base || strpos($real_widget, $real_base . DIRECTORY_SEPARATOR) !== 0) {
	102	+ return ['success' => false, 'message' => 'Invalid widget path.'];
95	103	}
96	104
97	105	// Read widget metadata from JSON
98	106	$widget_name = $folder;