Files
WP-LIT-MCP/src/Log.php
T
janniclas.loosenandClaude Opus 5.5 b24eb6c3e9 fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)
Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:32:12 +02:00

32 lines
891 B
PHP

<?php
declare(strict_types=1);
namespace LIT\MCP;
use Throwable;
defined('ABSPATH') || exit;
/**
* The plugin's one way into the PHP error log. Messages carry the "[wp-lit-mcp]" prefix; the
* log is for the site operator only and may contain details (paths, traces) that must never
* reach an MCP client.
*/
final class Log
{
private const PREFIX = '[wp-lit-mcp] ';
/** Logs "[wp-lit-mcp] <context> failed: <detail>"; a Throwable is logged with its trace. */
public static function failure(string $context, Throwable|string $detail): void
{
self::line(sprintf('%s failed: %s', $context, (string) $detail));
}
/** Logs one free-form line with the plugin prefix. */
public static function line(string $message): void
{
error_log(self::PREFIX . $message); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
}
}