Files
WP-LIT-MCP/src/Integrations/WordPress/Schema/SampledMetaSource.php
T
Jan-Niclas LoosenandClaude Opus 5.5 234fd1edac fix(security): Pods-Meta nur lesbar, wenn Pods aktiv, aber nicht nutzbar
Ist Pods aktiv, seine API aber nicht nutzbar, melden gesampelte und registrierte Meta-Schlüssel READONLY statt schreibbar. Sonst würden Pods-Felder (auch über Pods' register_meta-Integration) an Pods vorbei geschrieben.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 11:30:05 +01:00

64 lines
1.8 KiB
PHP

<?php
declare(strict_types=1);
namespace LIT\MCP\Integrations\WordPress\Schema;
defined('ABSPATH') || exit;
/**
* Meta keys actually used by the most recent posts of a type. Keys starting with
* "_" are internal and only shown when another source knows them.
*/
final class SampledMetaSource extends MetaFieldSource
{
private const SAMPLE_POSTS = 50;
private const MAX_KEYS = 200;
/** @param bool $readOnly Report the keys as READONLY (Pods is active but cannot be used to write them). */
public function __construct(private ?\wpdb $db = null, private bool $readOnly = false)
{
}
public function id(): string
{
return 'sample';
}
public function fieldsFor(string $postType): array
{
$wpdb = $this->db ?? $GLOBALS['wpdb'];
// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- only core table names interpolated.
$keys = $wpdb->get_col($wpdb->prepare(
"SELECT DISTINCT pm.meta_key FROM {$wpdb->postmeta} pm
INNER JOIN (
SELECT ID FROM {$wpdb->posts}
WHERE post_type = %s AND post_status NOT IN ('auto-draft', 'trash')
ORDER BY ID DESC LIMIT %d
) recent ON recent.ID = pm.post_id
ORDER BY pm.meta_key LIMIT %d",
$postType,
self::SAMPLE_POSTS,
self::MAX_KEYS
));
$fields = [];
foreach ((array) $keys as $key) {
$key = (string) $key;
if ($key === '' || str_starts_with($key, '_')) {
continue;
}
$fields[] = new FieldDefinition(
$key,
$key,
'unknown',
'sample',
$this->readOnly ? FieldDefinition::READONLY : FieldDefinition::UNKNOWN
);
}
return $fields;
}
}