Files
WP-LIT-MCP/src/Integrations/Divi/Pages/DiviFlags.php
T
janniclas.loosenandClaude Opus 5.5 b24eb6c3e9 fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)
Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:32:12 +02:00

41 lines
1.3 KiB
PHP

<?php
declare(strict_types=1);
namespace LIT\MCP\Integrations\Divi\Pages;
use RuntimeException;
defined('ABSPATH') || exit;
/**
* Marks an entry as a Divi 5 builder layout, like the Visual Builder's own save does
* (Divi 5.2.1 SyncToServerController.php:382-387: _et_pb_use_divi_5 = "on", legacy
* _et_pb_use_builder = "on", and _et_pb_show_page_creation = "off" so the builder does not show
* its page creation flow on the first open). Ruling S11: update_post_meta() returns false for
* an unchanged value too, so success is checked by reading the flags back. Used by DiviSaver
* (inside FollowUp) and the Divi content creation.
*/
final class DiviFlags
{
public const FLAGS = [
'_et_pb_use_divi_5' => 'on',
'_et_pb_use_builder' => 'on',
'_et_pb_show_page_creation' => 'off',
];
/** @throws RuntimeException When a flag does not read back as set. */
public static function set(int $postId): void
{
foreach (self::FLAGS as $key => $value) {
update_post_meta($postId, $key, $value);
}
foreach (self::FLAGS as $key => $value) {
if (get_post_meta($postId, $key, true) !== $value) {
throw new RuntimeException(sprintf('Divi flag %s of post %d is not "%s".', $key, $postId, $value));
}
}
}
}