Files
WP-LIT-MCP/src/Admin/LimitsTab.php
T
janniclas.loosenandClaude Opus 5.5 b24eb6c3e9 fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)
Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:32:12 +02:00

122 lines
4.3 KiB
PHP
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<?php
declare(strict_types=1);
namespace LIT\MCP\Admin;
use LIT\MCP\Limits;
defined('ABSPATH') || exit;
/**
* Tab "Limits": upload/download size and log retention (spec §8.4). The snapshot count is
* kept as a hidden field until the design system feature that uses it exists.
* Changes apply immediately – Limits::all() always reads the current option.
*/
final class LimitsTab implements AdminTab
{
public const GROUP = 'lit_mcp_limits';
public function slug(): string
{
return 'limits';
}
public function label(): string
{
return __('Limits', 'wp-lit-mcp');
}
public function registerSettings(): void
{
register_setting(self::GROUP, Limits::OPTION, [
'type' => 'array',
'sanitize_callback' => [Limits::class, 'sanitize'],
'default' => Limits::DEFAULTS,
]);
}
public function registerActions(): void
{
}
public function render(): void
{
$values = (new Limits())->all();
$bounds = Limits::bounds();
$fields = [
'upload_mb' => [
__('Maximale Dateigröße', 'wp-lit-mcp'),
__('MB', 'wp-lit-mcp'),
sprintf(
/* translators: 1: maximum value in MB, 2: cap for Base64 transfers in MB */
__('Höchstens %1$d MB; für Base64-Übertragungen höchstens %2$d MB.', 'wp-lit-mcp'),
$bounds['upload_mb'][1],
Limits::INLINE_MAX_MB
),
],
'log_retention_days' => [
__('Protokoll aufbewahren', 'wp-lit-mcp'),
__('Tage', 'wp-lit-mcp'),
__('Ältere Einträge im Protokoll werden automatisch gelöscht.', 'wp-lit-mcp'),
],
];
echo '<form method="post" action="options.php">';
settings_fields(self::GROUP);
echo '<table class="form-table" role="presentation"><tbody>';
foreach ($fields as $key => [$label, $unit, $description]) {
[$min, $max] = $bounds[$key];
printf(
'<tr><th scope="row"><label for="lit-mcp-%1$s">%2$s</label></th><td>'
. '<input id="lit-mcp-%1$s" class="small-text" type="number" min="%3$d" max="%4$d"'
. ' name="%5$s[%1$s]" value="%6$d" aria-describedby="lit-mcp-%1$s-description">'
. ' <span class="lit-mcp-unit">%7$s</span>'
. '<p class="description" id="lit-mcp-%1$s-description">%8$s</p>',
esc_attr($key),
esc_html($label),
esc_attr((string) $min),
esc_attr((string) $max),
esc_attr(Limits::OPTION),
esc_attr((string) $values[$key]),
esc_html($unit),
esc_html($description)
);
if ($key === 'upload_mb') {
$this->maybeRenderUploadSizeNotice($values['upload_mb']);
}
echo '</td></tr>';
}
echo '</tbody></table>';
// Design system snapshots are not available yet: no visible setting, but keep the saved value.
printf(
'<input type="hidden" name="%s[snapshot_count]" value="%d">',
esc_attr(Limits::OPTION),
(int) $values['snapshot_count']
);
submit_button();
echo '</form>';
}
/**
* PHP's own upload_max_filesize/post_max_size (via wp_max_upload_size()) can be lower than
* what is configured here – WordPress itself would then refuse a large upload/download before
* this limit ever applies. A warning only, since the two are independent knobs.
*/
private function maybeRenderUploadSizeNotice(int $uploadMb): void
{
$serverMaxMb = (int) floor(wp_max_upload_size() / (1024 * 1024));
if ($serverMaxMb <= 0 || $uploadMb <= $serverMaxMb) {
return;
}
$message = sprintf(
/* translators: 1: configured limit in MB, 2: server limit in MB */
__('%1$d MB übersteigt das Server-Limit von %2$d MB (upload_max_filesize/post_max_size).', 'wp-lit-mcp'),
$uploadMb,
$serverMaxMb
);
printf('<div class="notice notice-warning inline"><p>%s</p></div>', esc_html($message));
}
}