feat: whitelisted WordPress settings tools
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,227 @@
|
||||
<?php
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace LIT\MCP\Integrations\WordPress\Settings;
|
||||
|
||||
use WP_Post;
|
||||
|
||||
/**
|
||||
* The WordPress options LIT MCP may read and write (spec §6.5), with validation.
|
||||
*
|
||||
* validate() arms are delegated to one-purpose helper methods rather than inline
|
||||
* ternaries: PHPCompatibility's RemovedTernaryAssociativity sniff misreads a `match`
|
||||
* whose arms are themselves ternaries as chained ternaries and rejects them, even
|
||||
* though PHP itself parses them fine (controller ruling P3).
|
||||
*/
|
||||
final class SettingsWhitelist
|
||||
{
|
||||
/** key => [group, type, description] */
|
||||
public const SETTINGS = [
|
||||
'blogname' => ['general', 'string', 'Titel der Website'],
|
||||
'blogdescription' => ['general', 'string', 'Untertitel der Website'],
|
||||
'WPLANG' => ['general', 'string', 'Sprache (Locale, z. B. de_DE; en_US = Englisch); nur installierte Sprachen'],
|
||||
'timezone_string' => ['general', 'string', 'Zeitzone, z. B. Europe/Berlin'],
|
||||
'date_format' => ['general', 'string', 'Datumsformat (PHP), z. B. j. F Y'],
|
||||
'time_format' => ['general', 'string', 'Zeitformat (PHP), z. B. H:i'],
|
||||
'show_on_front' => ['reading', 'string', 'Startseite: posts (neueste Beiträge) oder page (statische Seite)'],
|
||||
'page_on_front' => ['reading', 'integer', 'ID der statischen Startseite (0 = keine)'],
|
||||
'page_for_posts' => ['reading', 'integer', 'ID der Beitragsseite (0 = keine)'],
|
||||
'posts_per_page' => ['reading', 'integer', 'Beiträge pro Seite (1–100)'],
|
||||
'default_comment_status' => ['discussion', 'string', 'Kommentare für neue Beiträge: open oder closed'],
|
||||
'default_ping_status' => ['discussion', 'string', 'Pingbacks für neue Beiträge: open oder closed'],
|
||||
'permalink_structure' => ['permalinks', 'string', 'Permalink-Struktur, z. B. /%postname%/ (leer = einfach)'],
|
||||
'site_icon' => ['site_icon', 'integer', 'Anhang-ID des Website-Icons (Bild, empfohlen 512×512; 0 = keins)'],
|
||||
];
|
||||
|
||||
public const BLOCKED = ['admin_email', 'users_can_register', 'default_role', 'siteurl', 'home'];
|
||||
public const GROUPS = ['general', 'reading', 'discussion', 'permalinks', 'site_icon'];
|
||||
|
||||
private const INTEGER_KEYS = ['page_on_front', 'page_for_posts', 'posts_per_page', 'site_icon'];
|
||||
|
||||
public function current(string $key): mixed
|
||||
{
|
||||
$value = get_option($key);
|
||||
if ($key === 'WPLANG') {
|
||||
return $value === '' || $value === false ? 'en_US' : (string) $value;
|
||||
}
|
||||
|
||||
if (in_array($key, self::INTEGER_KEYS, true)) {
|
||||
return (int) $value;
|
||||
}
|
||||
|
||||
return (string) $value;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param array<string, mixed> $pending All values of the current call.
|
||||
* @return string|null Error message, null when valid.
|
||||
*/
|
||||
public function validate(string $key, mixed $value, array $pending): ?string
|
||||
{
|
||||
if (in_array($key, self::BLOCKED, true)) {
|
||||
return 'Gesperrt: aus Sicherheitsgründen nicht über LIT MCP änderbar.';
|
||||
}
|
||||
|
||||
if (! isset(self::SETTINGS[$key])) {
|
||||
return 'Nicht freigegeben; erlaubt: ' . implode(', ', array_keys(self::SETTINGS)) . '.';
|
||||
}
|
||||
|
||||
return match ($key) {
|
||||
'blogname', 'blogdescription' => $this->checkText($value),
|
||||
'WPLANG' => $this->checkLanguage($value),
|
||||
'timezone_string' => $this->checkTimezone($value),
|
||||
'date_format', 'time_format' => $this->checkFormat($value),
|
||||
'show_on_front' => $this->checkShowOnFront($value, $pending),
|
||||
'page_on_front', 'page_for_posts' => $this->checkPage($key, $value, $pending),
|
||||
'posts_per_page' => $this->checkPostsPerPage($value),
|
||||
'default_comment_status', 'default_ping_status' => $this->checkOpenClosed($value),
|
||||
'permalink_structure' => $this->checkPermalink($value),
|
||||
'site_icon' => $this->checkSiteIcon($value),
|
||||
};
|
||||
}
|
||||
|
||||
public function normalize(string $key, mixed $value): mixed
|
||||
{
|
||||
if ($key === 'WPLANG' && $value === 'en_US') {
|
||||
return '';
|
||||
}
|
||||
|
||||
return $value;
|
||||
}
|
||||
|
||||
private function checkText(mixed $value): ?string
|
||||
{
|
||||
if (is_string($value) && mb_strlen($value) <= 200) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return 'Text bis 200 Zeichen erwartet.';
|
||||
}
|
||||
|
||||
private function checkLanguage(mixed $value): ?string
|
||||
{
|
||||
if ($value === 'en_US' || $value === '') {
|
||||
return null;
|
||||
}
|
||||
|
||||
$installed = get_available_languages();
|
||||
if (is_string($value) && in_array($value, $installed, true)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return sprintf('Sprache nicht installiert; verfügbar: en_US, %s.', implode(', ', $installed));
|
||||
}
|
||||
|
||||
private function checkTimezone(mixed $value): ?string
|
||||
{
|
||||
if (is_string($value) && in_array($value, timezone_identifiers_list(), true)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return 'Zeitzonen-Kennung wie Europe/Berlin erwartet.';
|
||||
}
|
||||
|
||||
private function checkFormat(mixed $value): ?string
|
||||
{
|
||||
if (is_string($value) && trim($value) !== '' && mb_strlen($value) <= 50) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return 'Nicht leeres Format bis 50 Zeichen erwartet.';
|
||||
}
|
||||
|
||||
/** @param array<string, mixed> $pending */
|
||||
private function checkShowOnFront(mixed $value, array $pending): ?string
|
||||
{
|
||||
if ($value === 'posts') {
|
||||
return null;
|
||||
}
|
||||
|
||||
if ($value !== 'page') {
|
||||
return 'posts oder page erwartet.';
|
||||
}
|
||||
|
||||
$front = (int) ($pending['page_on_front'] ?? get_option('page_on_front'));
|
||||
if ($front > 0) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return 'Für page zuerst page_on_front setzen (im selben Aufruf möglich).';
|
||||
}
|
||||
|
||||
/** @param array<string, mixed> $pending */
|
||||
private function checkPage(string $key, mixed $value, array $pending): ?string
|
||||
{
|
||||
if (! is_int($value) || $value < 0) {
|
||||
return 'Seiten-ID (0 = keine) erwartet.';
|
||||
}
|
||||
|
||||
if ($value === 0) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$page = get_post($value);
|
||||
if (! $page instanceof WP_Post || $page->post_type !== 'page' || $page->post_status !== 'publish') {
|
||||
return sprintf('%d ist keine veröffentlichte Seite.', $value);
|
||||
}
|
||||
|
||||
$other = $key === 'page_on_front' ? 'page_for_posts' : 'page_on_front';
|
||||
$otherValue = (int) ($pending[$other] ?? get_option($other));
|
||||
if ($otherValue === $value) {
|
||||
return 'Startseite und Beitragsseite müssen verschiedene Seiten sein.';
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private function checkPostsPerPage(mixed $value): ?string
|
||||
{
|
||||
if (is_int($value) && $value >= 1 && $value <= 100) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return 'Ganzzahl von 1 bis 100 erwartet.';
|
||||
}
|
||||
|
||||
private function checkOpenClosed(mixed $value): ?string
|
||||
{
|
||||
if (in_array($value, ['open', 'closed'], true)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return 'open oder closed erwartet.';
|
||||
}
|
||||
|
||||
private function checkPermalink(mixed $value): ?string
|
||||
{
|
||||
if ($value === '') {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (
|
||||
is_string($value)
|
||||
&& str_starts_with($value, '/')
|
||||
&& str_contains($value, '%')
|
||||
&& mb_strlen($value) <= 200
|
||||
&& preg_match('/\s/', $value) !== 1
|
||||
) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return 'Leer oder eine Struktur wie /%postname%/ erwartet.';
|
||||
}
|
||||
|
||||
private function checkSiteIcon(mixed $value): ?string
|
||||
{
|
||||
if (! is_int($value) || $value < 0) {
|
||||
return 'Anhang-ID (0 = keins) erwartet.';
|
||||
}
|
||||
|
||||
if ($value === 0 || wp_attachment_is_image($value)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return sprintf('%d ist kein Bild der Mediathek.', $value);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user