fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)

Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

This commit is contained in:

janniclas.loosen

2026-09-26 19:32:12 +02:00

co-authored by

Claude Opus 5.5

parent 4d4bf57c9f

commit b24eb6c3e9

185 changed files with 418 additions and 1 deletions

									
										src/Abilities/Errors.php
									
		+2
		
												View File
												
				@@ -6,6 +6,8 @@ namespace LIT\MCP\Abilities;

				use WP_Error;

				defined('ABSPATH') || exit;

				/**

				 * Factory for the error objects abilities return.

				 *