← All changes
|
includes/abilities/widgets/wdesignkit-update-widget.php
+13
-0
2.6.3
→
2.7.1
View file →
| @@ -82,8 +82,9 @@ | ||
| 82 | 82 | ], |
| 83 | 83 | 'execute_callback' => 'wdesignkit_mcp_update_widget', |
| 84 | 84 | 'permission_callback' => 'wdesignkit_mcp_permission_callback', |
| 85 | 85 | 'meta' => [ |
| 86 | + 'public' => true, | |
| 86 | 87 | 'show_in_rest' => true, |
| 87 | 88 | 'mcp' => ['public' => true], |
| 88 | 89 | 'annotations' => [ |
| 89 | 90 | 'instructions' => implode("\n", [ |
| @@ -248,8 +249,20 @@ | ||
| 248 | 249 | } |
| 249 | 250 | }; |
| 250 | 251 | |
| 251 | 252 | // --- Update code files (only fields explicitly provided) --- |
| 253 | + // Site-level opt-out for generated widget PHP (ClickUp 86d41zavc). Gating create-widget alone | |
| 254 | + // would be theatre: an operator blocked from creating a widget could simply overwrite an | |
| 255 | + // existing widget's PHP here instead — same capability, same sink, same result. Scoped to the | |
| 256 | + // php_code branch on purpose, so a locked-down site can still update css/js/json. | |
| 257 | + if (isset($input['php_code']) && $input['php_code'] !== '' | |
| 258 | + && function_exists('wdesignkit_widget_php_write_allowed') && !wdesignkit_widget_php_write_allowed()) { | |
| 259 | + return [ | |
| 260 | + 'success' => false, | |
| 261 | + 'message' => 'php_code was not written: generated widget PHP writes are disabled on this site via the wdesignkit_allow_widget_php_write filter. Re-send without php_code to update css_code / js_code / metadata only.', | |
| 262 | + ]; | |
| 263 | + } | |
| 264 | + | |
| 252 | 265 | if (isset($input['php_code']) && $input['php_code'] !== '') { |
| 253 | 266 | // Strip any namespace declaration — the widget loader instantiates the bare |
| 254 | 267 | // global class name, so namespaced PHP would fatal with "Class not found". |
| 255 | 268 | // (create-widget applies the same guard; see wdesignkit_mcp_strip_php_namespace.) |