Files
WP-LIT-MCP/src/Lifecycle.php
T
janniclas.loosenandClaude Opus 5.5 b24eb6c3e9 fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)
Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:32:12 +02:00

43 lines
1.3 KiB
PHP
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<?php
declare(strict_types=1);
namespace LIT\MCP;
use LIT\MCP\Admin\ConnectionStatus;
use LIT\MCP\ChangeLog\ChangeLog;
use LIT\MCP\ChangeLog\ChangeLogCleanup;
use LIT\MCP\ChangeLog\ChangeLogInstaller;
use WPMedia\MCP\OAuth\Bootstrap as OAuthBootstrap;
defined('ABSPATH') || exit;
/**
* Activation and deactivation hooks (registered in wp-lit-mcp.php). Uninstall
* lives in uninstall.php.
*/
final class Lifecycle
{
public static function activate(): void
{
$log = new ChangeLog();
(new ChangeLogInstaller($log))->install();
(new ChangeLogCleanup($log, new Limits()))->ensureScheduled();
if (class_exists(OAuthBootstrap::class)) {
// mcp-oauth's public API: rewrite its /oauth and /.well-known rules on the next init.
OAuthBootstrap::schedule_rewrite_flush();
}
}
public static function deactivate(): void
{
wp_clear_scheduled_hook(ChangeLogCleanup::HOOK);
delete_transient(ConnectionStatus::ENDPOINT_TRANSIENT);
// WordPress regenerates the rules on the next request – without those of this now
// inactive plugin. Calling flush_rewrite_rules() here instead would rewrite them
// including our rules, because the plugin is still loaded during this request.
delete_option('rewrite_rules');
}
}