Files
WP-LIT-MCP/src/Integrations/Divi/Pages/WpMediaResolver.php
T
janniclas.loosenandClaude Opus 5.5 b24eb6c3e9 fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)
Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:32:12 +02:00

31 lines
835 B
PHP

<?php
declare(strict_types=1);
namespace LIT\MCP\Integrations\Divi\Pages;
use LIT\MCP\Integrations\Divi\Compose\MediaResolver;
defined('ABSPATH') || exit;
/**
* Media library images for short-form fields (image_id, portrait_id, image_ids): only images
* the current user may read. URL and alt text are cleaned by ShortformWriter like client input.
*/
final class WpMediaResolver implements MediaResolver
{
public function image(int $id): ?array
{
if ($id <= 0 || ! wp_attachment_is_image($id) || ! current_user_can('read_post', $id)) {
return null;
}
$url = wp_get_attachment_url($id);
if (! is_string($url) || $url === '') {
return null;
}
return ['url' => $url, 'alt' => (string) get_post_meta($id, '_wp_attachment_image_alt', true)];
}
}