Changeset 3361722

integromat-connector/trunk/api/authentication.php

-                      r2784613
+                      r3361722
         if ( $skip ) {
             $log && \Integromat\Logger::write( implode( ', ', $codes ) );
+            $log && \Integromat\Logger::write( implode( ';', $codes ) );
             return $result;
+        }
 …
         if ( isset( $_SERVER['HTTP_IWC_API_KEY'] ) && ! empty( $_SERVER['HTTP_IWC_API_KEY'] ) ) {
             $token = sanitize_text_field( $_SERVER['HTTP_IWC_API_KEY'] );
+            $token = sanitize_text_field( wp_unslash( $_SERVER['HTTP_IWC_API_KEY'] ) );
             if ( strlen( $token ) !== \Integromat\Api_Token::API_TOKEN_LENGTH || ! \Integromat\Api_Token::is_valid( $token ) ) {
 …
                 \Integromat\Rest_Response::render_error( 401, 'Provided API key is invalid', 'invalid_token' );
             } else {
+                \Integromat\User::login( $user_id );
+                // Check rate limiting
+                $rate_limit_id = \Integromat\Rate_Limiter::get_identifier();
+                if ( \Integromat\Rate_Limiter::is_rate_limited( $rate_limit_id ) ) {
+                    $rate_status = \Integromat\Rate_Limiter::get_rate_limit_status( $rate_limit_id );
+                    $log && \Integromat\Logger::write( 9 );
+                    \Integromat\Rest_Response::render_error(
+,
+                        'Rate limit exceeded. Try again later.',
+                        'rate_limit_exceeded',
+                        array(
+                            'X-RateLimit-Limit' => $rate_status['limit'],
+                            'X-RateLimit-Remaining' => max( 0, $rate_status['limit'] - $rate_status['requests'] ),
+                            'X-RateLimit-Reset' => $rate_status['reset_time'],
+                        )
+                    );
+                }
+                // Check payload size
+                if ( \Integromat\Rate_Limiter::is_payload_too_large() ) {
+                    $log && \Integromat\Logger::write( 10 );
+                    \Integromat\Rest_Response::render_error( 413, 'Request payload too large', 'payload_too_large' );
+                }
+                // Extract endpoint and method for permission checking
+                $request_uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_url( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
+                $method = isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : 'GET';
+                $endpoint = '';
+                if ( preg_match( '#\/wp-json/(.*?)(\?.*)?$#i', $request_uri, $matches ) ) {
+                    $endpoint = '/' . $matches[1];
+                }
+                // Use safer user context setting with permission checking
+                if ( ! \Integromat\User::set_api_user_context( $user_id, $endpoint, $method ) ) {
+                    $log && \Integromat\Logger::write( 8 );
+                    \Integromat\Rest_Response::render_error( 403, 'Insufficient API permissions', 'insufficient_permissions' );
+                }
                 $log && \Integromat\Logger::write( 7 );
                 \Integromat\Rest_Request::dispatch();

integromat-connector/trunk/assets/iwc.css

-                      r2529734
+                      r3361722
     background-color: white;
     padding: 30px;
+    margin-right: 20px;
+}
 #imt-content-panel section {
 …
 .imapie_settings_container.wait {
     filter: opacity(20%)
+    filter: opacity(20%);
+}
 .imapie_settings_container.wait * {
     cursor: wait;
+}
+.nav-tab-wrapper {
+    border-bottom: 1px solid #ccd0d4;
+    padding-left: 10px;
+    position: relative;
+    z-index: 10;
+    background: #fff;
+    overflow: hidden;
+    /* Ensures tabs don't wrap unexpectedly */
+}
+.nav-tab {
+    background: #f1f1f1;
+    border: 1px solid #ccd0d4;
+    border-bottom: none;
+    color: #555;
+    display: inline-block;
+    font-size: 14px;
+    line-height: 1.71428571;
+    margin: 0 5px -1px 0;
+    padding: 8px 12px;
+    text-decoration: none;
+    white-space: nowrap;
+    cursor: pointer;
+    transition: all 0.2s ease;
+    position: relative;
+    vertical-align: top;
+}
+.nav-tab:hover {
+    background-color: #fff;
+    color: #444;
+    text-decoration: none;
+    border-color: #999;
+}
+.nav-tab-active,
+.nav-tab-active:hover {
+    background-color: #fff;
+    border-bottom: 1px solid #fff;
+    color: #000;
+    font-weight: 600;
+    position: relative;
+    z-index: 11;
+    border-color: #ccd0d4;
+}
+.iwc-tab-content {
+    display: none;
+    padding: 15px 0 0;
+    position: relative;
+    z-index: 1;
+}
+.iwc-tab-content.iwc-tab-active {
+    display: block;
+    animation: fadeIn 0.3s ease-in-out;
+}
+@keyframes fadeIn {
+    from { opacity: 0; }
+    to { opacity: 1; }
+}
+/* Ensure consistent styling between General Settings and Custom Fields */
+.imapie_settings_container {
+    max-width: none;
+}
+.imapie_settings_container .form-table {
+    margin-top: 20px;
+}
+.imapie_settings_container .form-table th {
+    width: 200px;
+    min-width: 200px;
+}
+.imapie_settings_container .form-table td {
+    padding: 20px 0;
+}
+.imapie_settings_container h3 {
+    color: #23282d;
+    font-size: 18px;
+    font-weight: 600;
+    margin: 30px 0 10px;
+    padding: 0;
+}
+.imapie_settings_container p.desc,
+.imapie_settings_container .description {
+    color: #666;
+    font-style: italic;
+    margin: 5px 0 0;
+}
+.imapie_settings_container p.submit {
+    margin: 20px 0 0;
+    padding: 0;
+}
+/* Consistent form element styling */
+.imapie_settings_container select,
+.imapie_settings_container input[type="text"],
+.imapie_settings_container input[type="number"],
+.imapie_settings_container input[type="email"],
+.imapie_settings_container textarea {
+    border: 1px solid #ddd;
+    border-radius: 3px;
+    padding: 6px 8px;
+    font-size: 14px;
+    line-height: 1.4;
+    background-color: #fff;
+    color: #32373c;
+    box-shadow: inset 0 1px 2px rgba(0,0,0,.07);
+    transition: border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+}
+.imapie_settings_container select:focus,
+.imapie_settings_container input[type="text"]:focus,
+.imapie_settings_container input[type="number"]:focus,
+.imapie_settings_container input[type="email"]:focus,
+.imapie_settings_container textarea:focus {
+    border-color: #0073aa;
+    box-shadow: 0 0 0 1px #0073aa;
+    outline: none;
+}
+.imapie_settings_container input[type="checkbox"] {
+    margin: 0 4px 0 0;
+    vertical-align: middle;
+}
+.imapie_settings_container label {
+    vertical-align: middle;
+    cursor: pointer;
+}
+/* API Permissions specific styling to match General Settings */
+.iwc-permissions-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+    gap: 15px;
+    border: 1px solid #ddd;
+    padding: 15px;
+    background: #f9f9f9;
+    border-radius: 3px;
+    margin-top: 10px;
+}
+.iwc-permission-group h4 {
+    margin: 0 0 8px 0;
+    font-size: 13px;
+    font-weight: 600;
+    color: #23282d;
+}
+.iwc-permission-group label {
+    display: block;
+    margin-bottom: 4px;
+    font-size: 12px;
+    color: #555;
+}
+.iwc-permission-group input[type="checkbox"] {
+    margin-right: 5px;
+}
+/* Buttons consistency */
+.imapie_settings_container .button {
+    border: 1px solid #0073aa;
+    border-radius: 3px;
+    text-decoration: none;
+    text-shadow: none;
+    font-size: 13px;
+    line-height: 2.15384615;
+    min-height: 30px;
+    margin: 0;
+    padding: 0 10px;
+    cursor: pointer;
+}
+/* Notices styling for consistency */
+.imapie_settings_container .notice {
+    margin: 15px 0;
+    padding: 10px;
+    border-radius: 3px;
+    border-left: 4px solid;
+}
+.imapie_settings_container .notice-info {
+    background: #e7f3ff;
+    border-left-color: #0073aa;
+    color: #0c4a6e;
+}
+.imapie_settings_container .notice-warning {
+    background: #fff3cd;
+    border-left-color: #ffb900;
+    color: #8b4513;
+}
+.imapie_settings_container .notice-error {
+    background: #f8d7da;
+    border-left-color: #d63638;
+    color: #721c24;
+}
+.imapie_settings_container .notice-success {
+    background: #d4edda;
+    border-left-color: #46b450;
+    color: #155724;
+}
+/* Accessibility and Form Validation Improvements */
+.error {
+    border-color: #d63638 !important;
+    box-shadow: 0 0 2px rgba(214, 54, 56, 0.5);
+}
+.error:focus {
+    border-color: #d63638 !important;
+    outline: 2px solid #d63638;
+    outline-offset: 1px;
+}
+/* Focus states for better accessibility */
+input[type="checkbox"]:focus,
+input[type="text"]:focus,
+select:focus,
+textarea:focus {
+    outline: 2px solid #0073aa;
+    outline-offset: 1px;
+}
+/* High contrast mode support */
+@media (prefers-contrast: high) {
+    .uncheck_all {
+        text-decoration: underline;
+        font-weight: bold;
+    }
+    .error {
+        border-width: 2px;
+    }
+}
+/* API Key Management Styles */
+.iwc-api-key-container {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    margin-bottom: 10px;
+}
+/* API Key revealed state styling */
+#iwc-api-key-value[data-state="revealed"] {
+    background-color: #fff3cd;
+    border-color: #ffeaa7;
+    box-shadow: 0 0 0 1px #ffeaa7;
+}
+/* Countdown indicator for auto-hide */
+.iwc-countdown {
+    font-size: 12px;
+    color: #666;
+    margin-left: 10px;
+    font-style: italic;
+}
+/* Log Actions Styles */
+.iwc-log-actions {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    margin-bottom: 10px;
+}
+/* Modal Styles for Regenerate Confirmation */
+.iwc-modal {
+    display: none;
+    position: fixed;
+    z-index: 100000;
+    left: 0;
+    top: 0;
+    width: 100%;
+    height: 100%;
+    background-color: rgba(0, 0, 0, 0.5);
+    backdrop-filter: blur(2px);
+}
+.iwc-modal-content {
+    background-color: #fff;
+    margin: 5% auto;
+    padding: 0;
+    border: 1px solid #ddd;
+    border-radius: 4px;
+    width: 90%;
+    max-width: 600px;
+    box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
+    animation: iwc-modal-appear 0.3s ease-out;
+}
+@keyframes iwc-modal-appear {
+    from {
+        opacity: 0;
+        transform: translateY(-50px);
+    }
+    to {
+        opacity: 1;
+        transform: translateY(0);
+    }
+}
+.iwc-modal-header {
+    background-color: #fcf2f2;
+    padding: 15px 20px;
+    border-bottom: 1px solid #ddd;
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    border-radius: 4px 4px 0 0;
+}
+.iwc-modal-header h3 {
+    margin: 0;
+    font-size: 18px;
+    color: #d63638;
+    display: flex;
+    align-items: center;
+    gap: 8px;
+}
+.iwc-modal-header h3:before {
+    content: "⚠️";
+    font-size: 20px;
+}
+.iwc-modal-close {
+    font-size: 24px;
+    font-weight: bold;
+    color: #999;
+    cursor: pointer;
+    line-height: 1;
+    transition: color 0.2s ease;
+}
+.iwc-modal-close:hover {
+    color: #333;
+}
+.iwc-modal-body {
+    padding: 20px;
+}
+.iwc-warning-box {
+    background-color: #fff3cd;
+    border: 1px solid #ffeaa7;
+    border-radius: 4px;
+    padding: 15px;
+    margin-bottom: 20px;
+}
+.iwc-warning-box strong {
+    color: #856404;
+}
+.iwc-form-group {
+    margin-bottom: 15px;
+}
+.iwc-form-group label {
+    display: block;
+    margin-bottom: 5px;
+    font-weight: bold;
+    color: #333;
+}
+.iwc-checkbox-group {
+    display: flex;
+    align-items: flex-start;
+    gap: 8px;
+    margin-bottom: 15px;
+}
+.iwc-checkbox-group input[type="checkbox"] {
+    margin-top: 3px;
+}
+.iwc-checkbox-group label {
+    margin-bottom: 0;
+    font-weight: normal;
+    cursor: pointer;
+}
+.iwc-form-group input[type="text"] {
+    width: 100%;
+    padding: 8px 12px;
+    border: 1px solid #ddd;
+    border-radius: 3px;
+    font-size: 14px;
+    transition: border-color 0.2s ease;
+}
+.iwc-form-group input[type="text"]:focus {
+    outline: none;
+    border-color: #0073aa;
+    box-shadow: 0 0 0 1px #0073aa;
+}
+.iwc-form-actions {
+    margin-top: 20px;
+    display: flex;
+    gap: 10px;
+    justify-content: flex-end;
+    padding-top: 15px;
+    border-top: 1px solid #ddd;
+}
+.iwc-form-actions .button {
+    min-width: 100px;
+}
+.iwc-confirm-btn {
+    border-color: #d63638 !important;
+    color: #d63638 !important;
+}
+.iwc-confirm-btn:hover:not(:disabled) {
+    background-color: #d63638;
+    color: white !important;
+}
+.iwc-confirm-btn:disabled {
+    opacity: 0.5;
+    cursor: not-allowed;
+}
+/* Responsive design */
+@media (max-width: 600px) {
+    .iwc-api-key-container {
+        flex-direction: column;
+        align-items: flex-start;
+        gap: 8px;
+    }
+    .iwc-api-key-container input {
+        width: 100%;
+        margin-bottom: 8px;
+    }
+    .iwc-modal-content {
+        margin: 2% auto;
+        width: 95%;
+    }
+    .iwc-form-actions {
+        flex-direction: column-reverse;
+    }
+    .iwc-form-actions .button {
+        width: 100%;
+        min-width: auto;
+    }
+    /* Tab responsive design */
+    .nav-tab-wrapper {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 2px;
+        margin-bottom: 15px;
+    }
+    .nav-tab {
+        flex: 1;
+        text-align: center;
+        min-width: 80px;
+        font-size: 12px;
+        padding: 6px 8px;
+    }
+    #imt-content-panel {
+        padding: 15px;
+        margin-right: 10px;
+    }
+    .imapie_settings_container .form-table th {
+        width: auto;
+        min-width: auto;
+        display: block;
+        padding-bottom: 5px;
+    }
+    .imapie_settings_container .form-table td {
+        display: block;
+        padding: 5px 0 15px;
+    }
+    .iwc-permissions-grid {
+        grid-template-columns: 1fr;
+        gap: 10px;
+        padding: 10px;
+    }
+}
+@media (max-width: 782px) {
+    .nav-tab {
+        font-size: 12px;
+        padding: 6px 10px;
+    }
+    .integromat_api_row th {
+        min-width: auto;
+        width: auto;
+    }
+}
+/* Success/Error Messages */
+.iwc-message {
+    padding: 10px 15px;
+    margin: 15px 0;
+    border-radius: 4px;
+    font-weight: bold;
+}
+.iwc-message.success {
+    background-color: #d4edda;
+    border: 1px solid #c3e6cb;
+    color: #155724;
+}
+.iwc-message.error {
+    background-color: #f8d7da;
+    border: 1px solid #f5c6cb;
+    color: #721c24;
+}
+/* Tab-specific messages that appear after Save Settings button */
+.iwc-tab-message {
+    margin: 15px 0 0;
+    padding: 10px 12px;
+    border-left: 4px solid;
+    background: #fff;
+    box-shadow: 0 1px 1px rgba(0, 0, 0, 0.04);
+}
+.iwc-tab-message.notice-success {
+    border-left-color: #46b450;
+    background: #d4edda;
+}
+/* Simple messages for non-tabbed forms like Custom Taxonomies */
+.iwc-simple-message {
+    margin: 15px 0 0;
+    padding: 10px 12px;
+    border-left: 4px solid;
+    background: #fff;
+    box-shadow: 0 1px 1px rgba(0, 0, 0, 0.04);
+    border-radius: 0 3px 3px 0;
+}
+.iwc-simple-message.notice-success {
+    border-left-color: #46b450;
+    background: #d4edda;
+    color: #155724;
+}
+.iwc-simple-message.notice-error {
+    border-left-color: #d63638;
+    background: #f8d7da;
+    color: #721c24;
+}
+.iwc-simple-message.notice-warning {
+    border-left-color: #ffb900;
+    background: #fff3cd;
+    color: #8b4513;
+}
+.iwc-simple-message.notice-info {
+    border-left-color: #0073aa;
+    background: #e7f3ff;
+    color: #0c4a6e;
+}
+.iwc-tab-message.notice-error {
+    border-left-color: #d63638;
+    background: #f8d7da;
+}
+.iwc-tab-message p {
+    margin: 0;
+    font-weight: 600;
+}
 …
     cursor: pointer;
     text-decoration: underline;
+}
-.imapie_settings_container .ui-tabs {
-    position: relative;
-    padding: .2em;
+}
-.imapie_settings_container .ui-tabs .ui-tabs-nav {
-    margin: 0;
-    padding: .2em .2em 0;
+}
-.imapie_settings_container .ui-tabs .ui-tabs-nav li {
-    list-style: none;
-    float: left;
-    position: relative;
-    top: 0;
-    margin: 1px .2em 0 0;
-    border-bottom-width: 0;
-    padding: 0;
-    white-space: nowrap;
-    background-color: white;
+}
-.imapie_settings_container .ui-tabs .ui-tabs-nav .ui-tabs-anchor {
-    float: left;
-    padding: .5em 1em;
-    text-decoration: none;
+}
-.imapie_settings_container .ui-tabs .ui-tabs-nav li.ui-tabs-active {
-    margin-bottom: -1px;
-    padding-bottom: 1px;
+}
-.imapie_settings_container .ui-tabs .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor,
-.imapie_settings_container .ui-tabs .ui-tabs-nav li.ui-state-disabled .ui-tabs-anchor,
-.imapie_settings_container .ui-tabs .ui-tabs-nav li.ui-tabs-loading .ui-tabs-anchor {
-    cursor: text;
+}
-.imapie_settings_container .ui-tabs-collapsible .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor {
-    cursor: pointer;
+}
-.imapie_settings_container .ui-tabs .ui-tabs-panel {
-    display: block;
-    border-width: 0;
-    padding: 1em 1.4em;
-    background: none;
+}
-/* Component containers
-----------------------------------*/
-.imapie_settings_container .ui-widget.ui-widget-content {
-    border: 1px solid #c5c5c5;
+}
-.imapie_settings_container .ui-widget-content {
-    border: 1px solid #dddddd;
-    background: #ffffff;
-    color: #333333;
+}
-.imapie_settings_container .ui-widget-content a {
-    color: #333333;
+}
-.imapie_settings_container .ui-widget-header {
-    border: 1px solid #dddddd;
-    background: #e9e9e9;
-    color: #333333;
-    font-weight: bold;
+}
-.imapie_settings_container .ui-widget-header a {
-    color: #333333;
+}
-/* Layout helpers
-----------------------------------*/
-.imapie_settings_container .ui-helper-clearfix:before,
-.imapie_settings_container .ui-helper-clearfix:after {
-    content: "";
-    display: table;
-    border-collapse: collapse;
+}
-.imapie_settings_container .ui-helper-clearfix:after {
-    clear: both;
+}
-.imapie_settings_container .ui-helper-zfix {
-    width: 100%;
-    height: 100%;
-    top: 0;
-    left: 0;
-    position: absolute;
-    opacity: 0;
-    filter: Alpha(Opacity=0);
+}
-.imapie_settings_container .ui-front {
-    z-index: 100;
+}
-.imapie_settings_container .iwc-comment {
-    font-style: italic;
-    color: #a8a8a8;
+}
 …
+}
+.imapie_settings_container .w-200 {
+    width: 200px
+}
+.imapie_settings_container .iwc-comment {
+    font-style: italic;
+    color: #a8a8a8;
+}

integromat-connector/trunk/assets/iwc.js

-                      r2777334
+                      r3361722
     $(document).ready(function () {
+        // API Key reveal/hide functionality
+        let apiKeyTimeout;
+        let countdownInterval;
+        $('#iwc-api-key-toggle').on('click', function() {
+            const $button = $(this);
+            const $input = $('#iwc-api-key-value');
+            const state = $button.data('state');
+            if (state === 'masked') {
+                // Fetch the key dynamically via AJAX
+                revealApiKey($button, $input);
+            } else {
+                // Hide the key
+                hideApiKey($button, $input);
+            }
+        });
+        // API Key regenerate functionality
+        $('#iwc-api-key-regenerate').on('click', function() {
+            showRegenerateModal();
+        });
+        function showRegenerateModal() {
+            // Create modal HTML
+            const modalHtml = `
+                <div id="iwc-regenerate-modal" class="iwc-modal">
+                    <div class="iwc-modal-content">
+                        <div class="iwc-modal-header">
+                            <h3>Regenerate API Key</h3>
+                            <span class="iwc-modal-close">&times;</span>
+                        </div>
+                        <div class="iwc-modal-body">
+                            <div class="iwc-warning-box">
+                                <strong>⚠️ WARNING:</strong> Regenerating the API key will immediately break ALL existing connections between your WordPress site and Make that use this key.
+                            </div>
+                            <p><strong>This action is irreversible.</strong> You will need to:</p>
+                            <ul>
+                                <li>Update all your connections with the new API key on Make</li>
+                                <li>Test all connections after regeneration</li>
+                            </ul>
+                            <div class="iwc-checkbox-group">
+                                <input type="checkbox" id="iwc-confirm-understand" required>
+                                <label for="iwc-confirm-understand">
+                                    I understand that this will break all existing connections and this action cannot be undone.
+                                </label>
+                            </div>
+                            <div class="iwc-form-group">
+                                <label for="iwc-confirm-text">
+                                    Type <strong>"regenerate"</strong> to confirm:
+                                </label>
+                                <input type="text" id="iwc-confirm-text" placeholder="regenerate" autocomplete="off">
+                            </div>
+                            <div class="iwc-form-actions">
+                                <button type="button" class="button iwc-modal-cancel">Cancel</button>
+                                <button type="button" id="iwc-confirm-regenerate" class="button iwc-confirm-btn" disabled>
+                                    Regenerate API Key
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            `;
+            // Remove existing modal if any
+            $('#iwc-regenerate-modal').remove();
+            // Add modal to body
+            $('body').append(modalHtml);
+            // Show modal
+            $('#iwc-regenerate-modal').show();
+            // Focus on checkbox
+            $('#iwc-confirm-understand').focus();
+            // Enable/disable confirm button based on validation
+            function validateForm() {
+                const isChecked = $('#iwc-confirm-understand').is(':checked');
+                const textMatch = $('#iwc-confirm-text').val().toLowerCase() === 'regenerate';
+                $('#iwc-confirm-regenerate').prop('disabled', !(isChecked && textMatch));
+            }
+            $('#iwc-confirm-understand, #iwc-confirm-text').on('change keyup', validateForm);
+            // Handle confirm button
+            $('#iwc-confirm-regenerate').on('click', function() {
+                const $button = $(this);
+                const originalText = $button.text();
+                // Show loading state
+                $button.text('Regenerating...').prop('disabled', true);
+                // Make AJAX request
+                $.post(iwc_ajax.ajax_url, {
+                    action: 'iwc_regenerate_api_key',
+                    confirmation: $('#iwc-confirm-text').val(),
+                    nonce: iwc_ajax.regenerate_nonce
+                })
+                .done(function(response) {
+                    if (response.success) {
+                        // Update the API key field
+                        const $input = $('#iwc-api-key-value');
+                        const $toggleBtn = $('#iwc-api-key-toggle');
+                        // Update data attributes
+                        $input.data('masked', response.data.masked_token);
+                        // Reset to masked state
+                        hideApiKey($toggleBtn, $input);
+                        $input.val(response.data.masked_token);
+                        // Close modal
+                        $('#iwc-regenerate-modal').remove();
+                        // Show success message
+                        showMessage('API key regenerated successfully! Please update your Make.com connections with the new key.', 'success');
+                    } else {
+                        showMessage('Error: ' + (response.data || 'Unknown error occurred'), 'error');
+                    }
+                })
+                .fail(function() {
+                    showMessage('Failed to regenerate API key. Please try again.', 'error');
+                })
+                .always(function() {
+                    $button.text(originalText).prop('disabled', false);
+                });
+            });
+            // Handle modal close
+            $('.iwc-modal-close, .iwc-modal-cancel').on('click', function() {
+                $('#iwc-regenerate-modal').remove();
+            });
+            // Close modal on outside click
+            $('#iwc-regenerate-modal').on('click', function(e) {
+                if (e.target === this) {
+                    $(this).remove();
+                }
+            });
+        }
+        // Log purge functionality
+        $('#iwc-log-purge').on('click', function() {
+            showPurgeModal();
+        });
+        function showPurgeModal() {
+            // Create modal HTML
+            const modalHtml = `
+                <div id="iwc-purge-modal" class="iwc-modal">
+                    <div class="iwc-modal-content">
+                        <div class="iwc-modal-header">
+                            <h3>Purge Log Data</h3>
+                            <span class="iwc-modal-close">&times;</span>
+                        </div>
+                        <div class="iwc-modal-body">
+                            <div class="iwc-warning-box">
+                                <strong>⚠️ WARNING:</strong> This will permanently delete all stored log data.
+                            </div>
+                            <p><strong>This action cannot be undone.</strong> All diagnostic and debug information will be lost.</p>
+                            <p>Are you sure you want to purge all log data?</p>
+                            <div class="iwc-form-actions">
+                                <button type="button" class="button iwc-modal-cancel">Cancel</button>
+                                <button type="button" id="iwc-confirm-purge" class="button iwc-confirm-btn">
+                                    Purge
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            `;
+            // Remove existing modal if any
+            $('#iwc-purge-modal').remove();
+            // Add modal to body
+            $('body').append(modalHtml);
+            // Show modal
+            $('#iwc-purge-modal').show();
+            // Handle confirm button
+            $('#iwc-confirm-purge').on('click', function() {
+                const $button = $(this);
+                const originalText = $button.text();
+                // Show loading state
+                $button.text('Purging...').prop('disabled', true);
+                // Make AJAX request
+                $.post(iwc_ajax.ajax_url, {
+                    action: 'iwc_purge_logs',
+                    nonce: iwc_ajax.purge_nonce
+                })
+                .done(function(response) {
+                    // Close modal
+                    $('#iwc-purge-modal').remove();
+                    if (response.success) {
+                        // Show success message
+                        showLogMessage('Log data purged successfully.', 'success');
+                        // Disable purge and download buttons since no logs exist
+                        $('#iwc-log-purge, .iwc-log-actions a').addClass('disabled').prop('disabled', true);
+                    } else {
+                        showLogMessage('Error: ' + (response.data || 'Unknown error occurred'), 'error');
+                    }
+                })
+                .fail(function() {
+                    $('#iwc-purge-modal').remove();
+                    showLogMessage('Failed to purge log data. Please try again.', 'error');
+                })
+                .always(function() {
+                    $button.text(originalText).prop('disabled', false);
+                });
+            });
+            // Handle modal close
+            $('.iwc-modal-close, .iwc-modal-cancel').on('click', function() {
+                $('#iwc-purge-modal').remove();
+            });
+            // Close modal on outside click
+            $('#iwc-purge-modal').on('click', function(e) {
+                if (e.target === this) {
+                    $(this).remove();
+                }
+            });
+        }
+        function showLogMessage(text, type) {
+            // Remove existing messages
+            $('.iwc-log-message').remove();
+            // Create new message
+            const $message = $('<div class="iwc-message iwc-log-message ' + type + '">' + text + '</div>');
+            // Insert after the log actions container
+            $('.iwc-log-actions').after($message);
+            // Auto-remove after 5 seconds for success messages
+            if (type === 'success') {
+                setTimeout(function() {
+                    $message.fadeOut(500, function() {
+                        $(this).remove();
+                    });
+                }, 5000);
+            }
+        }
+        function showMessage(text, type) {
+            // Remove existing messages
+            $('.iwc-message').remove();
+            // Create new message
+            const $message = $('<div class="iwc-message ' + type + '">' + text + '</div>');
+            // Insert after the API key container
+            $('.iwc-api-key-container').after($message);
+            // Auto-remove after 5 seconds for success messages
+            if (type === 'success') {
+                setTimeout(function() {
+                    $message.fadeOut(500, function() {
+                        $(this).remove();
+                    });
+                }, 5000);
+            }
+        }
+        function showTabMessage(text, type, $form) {
+            // Remove existing tab messages
+            $('.iwc-tab-message').remove();
+            // Create new message with WordPress native notice styling
+            const $message = $('<div class="notice notice-' + type + ' is-dismissible iwc-tab-message"><p>' + text + '</p></div>');
+            // Insert after the submit button in the current form
+            $form.find('.button').after($message);
+            // Auto-remove after 5 seconds for success messages
+            if (type === 'success') {
+                setTimeout(function() {
+                    $message.fadeOut(500, function() {
+                        $(this).remove();
+                    });
+                }, 5000);
+            }
+        }
+        function showSimpleMessage(text, type, $form) {
+            // Remove existing simple messages
+            $('.iwc-simple-message').remove();
+            // Create new message with WordPress native notice styling
+            const $message = $('<div class="notice notice-' + type + ' is-dismissible iwc-simple-message"><p>' + text + '</p></div>');
+            // Insert after the submit button in the current form
+            $form.find('.button').after($message);
+            // Auto-remove after 5 seconds for success messages
+            if (type === 'success') {
+                setTimeout(function() {
+                    $message.fadeOut(500, function() {
+                        $(this).remove();
+                    });
+                }, 5000);
+            }
+        }
+        function revealApiKey($button, $input) {
+            // Show loading state
+            const originalText = $button.text();
+            $button.text('Loading...').prop('disabled', true);
+            // Make AJAX request to fetch the API key
+            $.post(iwc_ajax.ajax_url, {
+                action: 'iwc_reveal_api_key',
+                nonce: iwc_ajax.reveal_nonce
+            })
+            .done(function(response) {
+                if (response.success) {
+                    const revealedKey = response.data.api_key;
+                    // Update input and button state
+                    $input.val(revealedKey).attr('data-state', 'revealed');
+                    $button.text('Hide').data('state', 'revealed').prop('disabled', false);
+                    // Add countdown display
+                    const $countdown = $('<span class="iwc-countdown">Auto-hide in 30s</span>');
+                    $button.after($countdown);
+                    // Countdown timer
+                    let secondsLeft = 30;
+                    countdownInterval = setInterval(function() {
+                        secondsLeft--;
+                        $countdown.text(`Auto-hide in ${secondsLeft}s`);
+                        if (secondsLeft <= 0) {
+                            clearInterval(countdownInterval);
+                        }
+                    }, 1000);
+                    // Auto-hide after 30 seconds
+                    apiKeyTimeout = setTimeout(function() {
+                        clearInterval(countdownInterval);
+                        hideApiKey($button, $input);
+                    }, 30000);
+                } else {
+                    showMessage('Error: ' + (response.data || 'Failed to retrieve API key'), 'error');
+                    $button.text(originalText).prop('disabled', false);
+                }
+            })
+            .fail(function() {
+                showMessage('Failed to retrieve API key. Please try again.', 'error');
+                $button.text(originalText).prop('disabled', false);
+            });
+        }
+        function hideApiKey($button, $input) {
+            const maskedKey = $input.data('masked');
+            $input.val(maskedKey).removeAttr('data-state');
+            $button.text('Reveal').data('state', 'masked').removeClass('iwc-hide-btn').addClass('iwc-reveal-btn');
+            // Remove countdown display
+            $button.siblings('.iwc-countdown').remove();
+            // Clear intervals and timeouts
+            if (countdownInterval) {
+                clearInterval(countdownInterval);
+                countdownInterval = null;
+            }
+            if (apiKeyTimeout) {
+                clearTimeout(apiKeyTimeout);
+                apiKeyTimeout = null;
+            }
+        }
         $('#iwc-api-key-value').on('click', function() {
             $(this).select();
         });
+        // to display tabs
+        $("#imapie_tabs").tabs();
+        // to show waiting animation of the curson when saving
+        $('#imapie_tabs #submit').click(function (e) {
+        // Initialize tabs functionality
+        initializeTabs();
+        function initializeTabs() {
+            // Native tab functionality
+            $('.nav-tab').on('click', function(e) {
+                e.preventDefault();
+                var targetTab = $(this).data('tab');
+                // Remove active class from all tabs and content
+                $('.nav-tab').removeClass('nav-tab-active');
+                $('.iwc-tab-content').removeClass('iwc-tab-active');
+                // Add active class to clicked tab
+                $(this).addClass('nav-tab-active');
+                // Show corresponding content
+                $('#iwc-tab-' + targetTab).addClass('iwc-tab-active');
+                // Store active tab in sessionStorage
+                sessionStorage.setItem('iwc-active-tab', targetTab);
+                // Update ARIA attributes for accessibility
+                $('.nav-tab').attr('aria-selected', 'false');
+                $(this).attr('aria-selected', 'true');
+                $('.iwc-tab-content').attr('aria-hidden', 'true');
+                $('#iwc-tab-' + targetTab).attr('aria-hidden', 'false');
+            });
+            // Restore active tab from sessionStorage on page load
+            var activeTab = sessionStorage.getItem('iwc-active-tab');
+            if (activeTab && $('#iwc-tab-' + activeTab).length) {
+                $('.nav-tab').removeClass('nav-tab-active');
+                $('.iwc-tab-content').removeClass('iwc-tab-active');
+                $('[data-tab="' + activeTab + '"]').addClass('nav-tab-active');
+                $('#iwc-tab-' + activeTab).addClass('iwc-tab-active');
+                // Update ARIA attributes
+                $('.nav-tab').attr('aria-selected', 'false');
+                $('[data-tab="' + activeTab + '"]').attr('aria-selected', 'true');
+                $('.iwc-tab-content').attr('aria-hidden', 'true');
+                $('#iwc-tab-' + activeTab).attr('aria-hidden', 'false');
+            } else {
+                // Ensure first tab is active if no stored tab
+                $('.nav-tab:first').addClass('nav-tab-active');
+                $('.iwc-tab-content:first').addClass('iwc-tab-active');
+                // Set ARIA attributes for default state
+                $('.nav-tab:first').attr('aria-selected', 'true');
+                $('.nav-tab:not(:first)').attr('aria-selected', 'false');
+                $('.iwc-tab-content:first').attr('aria-hidden', 'false');
+                $('.iwc-tab-content:not(:first)').attr('aria-hidden', 'true');
+            }
+        }
+        // to show waiting animation of the cursor when saving
+        $('.iwc-tab-content .button').click(function (e) {
+            e.preventDefault();
+            // Get the form within the active tab
+            var $activeTab = $('.iwc-tab-content.iwc-tab-active');
+            var $form = $activeTab.find('form');
+            // Validate form before submission
+            var hasErrors = false;
+            var $requiredFields = $form.find('[required]');
+            $requiredFields.each(function() {
+                var $field = $(this);
+                if (!$field.val() || $field.val().trim() === '') {
+                    $field.addClass('error');
+                    hasErrors = true;
+                } else {
+                    $field.removeClass('error');
+                }
+            });
+            if (hasErrors) {
+                alert('Please fill in all required fields.');
+                return false;
+            }
             $('.imapie_settings_container').addClass('wait');
+            $.when(
+                $.post('options.php', $('#impaie_form_post').serialize()),
+                $.post('options.php', $('#impaie_form_user').serialize()),
+                $.post('options.php', $('#impaie_form_comment').serialize()),
+                $.post('options.php', $('#impaie_form_term').serialize())
+            ).done(function (a1, a2, a3, a4) {
+                $('.imapie_settings_container').removeClass('wait');
+            });
+            // Submit the active form
+            var formData = $form.serialize();
+            $.post('options.php', formData)
+                .done(function() {
+                    $('.imapie_settings_container').removeClass('wait');
+                    // Show success message after the submit button
+                    showTabMessage('Settings saved successfully.', 'success', $form);
+                })
+                .fail(function(xhr, status, error) {
+                    $('.imapie_settings_container').removeClass('wait');
+                    console.error('Form submission failed:', error);
+                    // Show error message after the submit button
+                    showTabMessage('Error saving settings. Please try again.', 'error', $form);
+                });
             return false;
         });
+        // Custom Taxonomies form submission handling
+        $('#impaie_form_taxonomy .button').click(function (e) {
+            e.preventDefault();
+            // Get the Custom Taxonomies form
+            var $form = $('#impaie_form_taxonomy');
+            // Validate form before submission
+            var hasErrors = false;
+            var $requiredFields = $form.find('[required]');
+            $requiredFields.each(function() {
+                var $field = $(this);
+                if (!$field.val() || $field.val().trim() === '') {
+                    $field.addClass('error');
+                    hasErrors = true;
+                } else {
+                    $field.removeClass('error');
+                }
+            });
+            if (hasErrors) {
+                alert('Please fill in all required fields.');
+                return false;
+            }
+            $('.imapie_settings_container').addClass('wait');
+            // Submit the form
+            var formData = $form.serialize();
+            $.post('options.php', formData)
+                .done(function() {
+                    $('.imapie_settings_container').removeClass('wait');
+                    // Show success message after the submit button
+                    showSimpleMessage('Settings saved successfully.', 'success', $form);
+                })
+                .fail(function(xhr, status, error) {
+                    $('.imapie_settings_container').removeClass('wait');
+                    console.error('Form submission failed:', error);
+                    // Show error message after the submit button
+                    showSimpleMessage('Error saving settings. Please try again.', 'error', $form);
+                });
+            return false;
+        });
         $('.uncheck_all').click(function (e) {
+            let uncheckAllStatus = $(this).attr('data-status');
+            if (uncheckAllStatus == 0) {
+                $(this).attr('data-status', 1);
+            e.preventDefault();
+            let $button = $(this);
+            let uncheckAllStatus = $button.attr('data-status') || '0';
+            let isChecking = uncheckAllStatus === '0';
+            if (isChecking) {
+                $button.attr('data-status', '1');
+                $button.text($button.data('uncheck-text') || 'Uncheck All');
             } else {
+                $(this).attr('data-status', 0);
+            }
+            $(this).closest('form').find('input[type="checkbox"]').each(function () {
+                if (uncheckAllStatus == 0) {
+                    $(this).prop('checked', true);
+                } else {
+                    $(this).prop('checked', false);
+                }
+            });
+                $button.attr('data-status', '0');
+                $button.text($button.data('check-text') || 'Check All');
+            }
+            // Target checkboxes in the current active tab only
+            var $activeTab = $('.iwc-tab-content.iwc-tab-active');
+            if ($activeTab.length) {
+                $activeTab.find('input[type="checkbox"]').each(function () {
+                    $(this).prop('checked', isChecking);
+                });
+            } else {
+                // Fallback for non-tabbed pages (like General Settings)
+                $button.closest('form').find('input[type="checkbox"]').each(function () {
+                    $(this).prop('checked', isChecking);
+                });
+            }
             return false;
+        });
+        // Add accessibility improvements
+        $('input[type="checkbox"]').on('change', function() {
+            $(this).attr('aria-checked', this.checked);
+        });
+        // Add form validation feedback
+        $('form input, form select, form textarea').on('blur', function() {
+            var $field = $(this);
+            if ($field.is('[required]') && (!$field.val() || $field.val().trim() === '')) {
+                $field.addClass('error').attr('aria-invalid', 'true');
+            } else {
+                $field.removeClass('error').attr('aria-invalid', 'false');
+            }
         });
     });

integromat-connector/trunk/class/class-api-token.php

-                      r2783423
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class Api_Token {
 …
     public static function initiate() {
         if ( self::get() == '' ) {
+            update_site_option( self::API_TOKEN_IDENTIFIER, self::generate( self::API_TOKEN_LENGTH ) );
+            // Use WordPress secure password generation for better entropy
+            $secure_token = wp_generate_password( self::API_TOKEN_LENGTH, true, true );
+            update_site_option( self::API_TOKEN_IDENTIFIER, $secure_token );
+        }
+    }
 …
      */
     public static function is_valid( $token ) {
+        return ( $token == get_site_option( self::API_TOKEN_IDENTIFIER ) );
+        // Use hash_equals to prevent timing attacks
+        $stored_token = get_site_option( self::API_TOKEN_IDENTIFIER );
+        return hash_equals( $stored_token, $token );
+    }
     /**
      * Generate random string
+     * Regenerate API token
+     *
+     * @param int    $length
+     * @param string $charlist
+     * @return string
+     * @return string New token
      * @throws \Exception
      */
+    public static function generate( $length = 10, $charlist = '0-9a-z' ) {
+        $charlist = count_chars(
+            preg_replace_callback(
+                '#.-.#',
+                function ( $m ) {
+                    return implode( '', range( $m[0][0], $m[0][2] ) );
+                },
+                $charlist
+            ),
+        );
+        $ch_len   = strlen( $charlist );
+        $res      = '';
+        for ( $i = 0; $i < $length; $i++ ) {
+            $res .= $charlist[ random_int( 0, $ch_len - 1 ) ];
+        }
+        return $res;
+    public static function regenerate() {
+        $new_token = wp_generate_password( self::API_TOKEN_LENGTH, true, true );
+        update_site_option( self::API_TOKEN_IDENTIFIER, $new_token );
+        return $new_token;
+    }

integromat-connector/trunk/class/class-guard.php

-                      r2793954
+                      r3361722
 <?php
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class Guard {
 …
      * @return bool
      */
+    public static function is_protected() {
+        $entities  = array( 'posts', 'users', 'comments', 'tags', 'categories', 'media' );
+        $json_base = str_replace( get_site_url(), '', get_rest_url( null, 'wp/v2/' ) );
+        $endpoint  = str_replace( $json_base, '', sanitize_url( $_SERVER['REQUEST_URI'] ) );
+        $f         = explode( '/', $endpoint );
+        return in_array( $f[0], $entities, true ) && in_array( $_SERVER['REQUEST_METHOD'], array( 'POST', 'PUT', 'DELETE' ) );
+    public static function is_protected() {
+        // Only guard if IWC-API-KEY header is present
+        if ( ! isset( $_SERVER['HTTP_IWC_API_KEY'] ) || empty( $_SERVER['HTTP_IWC_API_KEY'] ) ) {
+            return false; // No protection if no IWC-API-KEY header
+        }
+        // Validate required server variables
+        if ( ! isset( $_SERVER['REQUEST_URI'] ) || ! isset( $_SERVER['REQUEST_METHOD'] ) ) {
+            return true; // Err on the side of caution
+        }
+        $entities      = array( 'posts', 'users', 'comments', 'tags', 'categories', 'media' );
+        $json_base     = str_replace( get_site_url(), '', get_rest_url( null, 'wp/v2/' ) );
+        $request_uri   = sanitize_url( wp_unslash( $_SERVER['REQUEST_URI'] ) );
+        $endpoint      = str_replace( $json_base, '', $request_uri );
+        $request_method = sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) );
+        // Parse endpoint safely
+        $endpoint_parts = explode( '/', trim( $endpoint, '/' ) );
+        $first_part     = isset( $endpoint_parts[0] ) ? sanitize_text_field( $endpoint_parts[0] ) : '';
+        $protected_methods = array( 'POST', 'PUT', 'DELETE', 'PATCH' );
+        return in_array( $first_part, $entities, true ) && in_array( $request_method, $protected_methods, true );
+    }
+}

integromat-connector/trunk/class/class-logger.php

-                      r2784613
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class Logger {
     const MAXFILESIZEMB = 5;
+    const CIPHERMETHOD  = 'AES-256-ECB';
+    const CIPHERMETHOD  = 'AES-256-CBC'; // More secure than ECB mode
+    const ENCRYPTION_KEY_LENGTH = 32;
+    const BYTES_IN_MB = 1000000;
+    const API_KEY_PREVIEW_LENGTH = 5;
+    /**
+     * Get secure log file location outside web root
+     *
+     * @return string
+     */
     private static function get_file_location() {
+        return WP_CONTENT_DIR . '/uploads/iwclog.dat';
+        // Store logs outside web-accessible directory for security
+        $upload_dir = wp_upload_dir();
+        $log_dir    = $upload_dir['basedir'] . '/iwc-logs';
+        // Create directory if it doesn't exist
+        if ( ! file_exists( $log_dir ) ) {
+            wp_mkdir_p( $log_dir );
+            // Add .htaccess to deny web access
+            file_put_contents( $log_dir . '/.htaccess', "Deny from all\n" );
+            // Add index.php to prevent directory listing
+            file_put_contents( $log_dir . '/index.php', "<?php\n// Silence is golden.\n" );
+        }
+        return $log_dir . '/iwclog.dat';
+    }
+    /**
+     * Get encryption key for log data
+     *
+     * @return string
+     */
+    private static function get_encryption_key() {
+        $key = get_site_option( 'iwc_log_encryption_key' );
+        if ( empty( $key ) ) {
+            // Generate a new encryption key
+            $key = wp_generate_password( self::ENCRYPTION_KEY_LENGTH, true, true );
+            update_site_option( 'iwc_log_encryption_key', $key );
+        }
+        return $key;
+    }
+    /**
+     * Generate IV for encryption
+     *
+     * @return string
+     */
+    private static function generate_iv() {
+        return openssl_random_pseudo_bytes( openssl_cipher_iv_length( self::CIPHERMETHOD ) );
+    }
 …
         } else {
             $fsize = filesize( self::get_file_location() );
             if ( $fsize > ( self::MAXFILESIZEMB * 1000000 ) ) {
+            if ( $fsize > ( self::MAXFILESIZEMB * self::BYTES_IN_MB ) ) {
                 self::create_file();
+            }
 …
     private static function create_file() {
+        $init                            = 'Log file initiated @ ' . date( 'Y-m-d G:i:s' ) . "\n=SERVER INFO START=";
+        $server_data                     = $_SERVER;
+        $server_data['REQUEST_URI']      = self::strip_request_query( sanitize_url( $_SERVER['REQUEST_URI'] ) );
+        $server_data['HTTP_IWC_API_KEY'] = ( isset( $server_data['HTTP_IWC_API_KEY'] ) ? substr( sanitize_text_field( $_SERVER['HTTP_IWC_API_KEY'] ), 0, 5 ) . '...' : 'Not Provided' );
+        $server_data['SERVER_SOFTWARE']    = sanitize_text_field( $_SERVER['SERVER_SOFTWARE'] );
+        $server_data['REQUEST_URI']        = sanitize_url( $_SERVER['REQUEST_URI'] );
+        $server_data['REDIRECT_UNIQUE_ID'] = sanitize_text_field( $_SERVER['REDIRECT_UNIQUE_ID'] );
+        $server_data['REDIRECT_STATUS']                  = sanitize_text_field( $_SERVER['REDIRECT_STATUS'] );
+        $server_data['UNIQUE_ID']                        = sanitize_text_field( $_SERVER['UNIQUE_ID'] );
+        $server_data['HTTP_X_DATADOG_SAMPLING_PRIORITY'] = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_SAMPLING_PRIORITY'] );
+        $server_data['HTTP_X_DATADOG_SAMPLED']           = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_SAMPLED'] );
+        $server_data['HTTP_X_DATADOG_PARENT_ID']         = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_PARENT_ID'] );
+        $server_data['HTTP_X_DATADOG_TRACE_ID'] = sanitize_text_field( $_SERVER['HTTP_X_DATADOG_TRACE_ID'] );
+        $server_data['CONTENT_TYPE']            = sanitize_text_field( $_SERVER['CONTENT_TYPE'] );
+        $server_data['HTTP_USER_AGENT']         = sanitize_text_field( $_SERVER['HTTP_USER_AGENT'] );
+        $server_data['HTTP_X_FORWARDED_PORT']   = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_PORT'] );
+        $server_data['HTTP_X_FORWARDED_SSL']   = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_SSL'] );
+        $server_data['HTTP_X_FORWARDED_PROTO'] = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_PROTO'] );
+        $server_data['HTTP_X_FORWARDED_FOR']   = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_FOR'] );
+        $server_data['HTTP_X_REAL_IP']         = sanitize_text_field( $_SERVER['HTTP_X_REAL_IP'] );
+        $server_data['HTTP_CONNECTION']        = sanitize_text_field( $_SERVER['HTTP_CONNECTION'] );
+        $server_data['HTTP_HOST']              = sanitize_text_field( $_SERVER['HTTP_HOST'] );
+        $server_data['HTTP_X_FORWARDED_HOST']  = sanitize_text_field( $_SERVER['HTTP_X_FORWARDED_HOST'] );
+        $server_data['PATH']                   = sanitize_text_field( $_SERVER['PATH'] );
+        $server_data['DYLD_LIBRARY_PATH']      = sanitize_text_field( $_SERVER['DYLD_LIBRARY_PATH'] );
+        $server_data['SERVER_SIGNATURE']       = sanitize_text_field( $_SERVER['SERVER_SIGNATURE'] );
+        $server_data['SERVER_NAME']            = sanitize_text_field( $_SERVER['SERVER_NAME'] );
+        $server_data['SERVER_ADDR']            = sanitize_text_field( $_SERVER['SERVER_ADDR'] );
+        $server_data['SERVER_PORT']            = sanitize_text_field( $_SERVER['SERVER_PORT'] );
+        $server_data['REMOTE_ADDR']            = sanitize_text_field( $_SERVER['REMOTE_ADDR'] );
+        $server_data['DOCUMENT_ROOT']          = sanitize_text_field( $_SERVER['DOCUMENT_ROOT'] );
+        $server_data['REQUEST_SCHEME']         = sanitize_text_field( $_SERVER['REQUEST_SCHEME'] );
+        $server_data['CONTEXT_PREFIX']         = sanitize_text_field( $_SERVER['CONTEXT_PREFIX'] );
+        $server_data['CONTEXT_DOCUMENT_ROOT']  = sanitize_text_field( $_SERVER['CONTEXT_DOCUMENT_ROOT'] );
+        $server_data['SERVER_ADMIN']           = sanitize_email( $_SERVER['SERVER_ADMIN'] );
+        $server_data['SCRIPT_FILENAME']        = sanitize_text_field( $_SERVER['SCRIPT_FILENAME'] );
+        $server_data['REMOTE_PORT']            = sanitize_text_field( $_SERVER['REMOTE_PORT'] );
+        $server_data['REDIRECT_URL']           = sanitize_text_field( $_SERVER['REDIRECT_URL'] );
+        $server_data['GATEWAY_INTERFACE']      = sanitize_text_field( $_SERVER['GATEWAY_INTERFACE'] );
+        $server_data['SERVER_PROTOCOL']        = sanitize_text_field( $_SERVER['SERVER_PROTOCOL'] );
+        $server_data['REQUEST_METHOD']         = sanitize_text_field( $_SERVER['REQUEST_METHOD'] );
+        $server_data['SCRIPT_NAME']            = sanitize_text_field( $_SERVER['SCRIPT_NAME'] );
+        $server_data['PHP_SELF']               = sanitize_text_field( $_SERVER['PHP_SELF'] );
+        $server_data['REQUEST_TIME_FLOAT']     = sanitize_text_field( $_SERVER['REQUEST_TIME_FLOAT'] );
+        $server_data['REQUEST_TIME']           = sanitize_text_field( $_SERVER['REQUEST_TIME'] );
+        /*
+        unset( $server_data['QUERY_STRING'] );
+        unset( $server_data['REDIRECT_QUERY_STRING'] );
+        unset( $server_data['HTTP_AUTHORIZATION'] );
+        unset( $server_data['REDIRECT_HTTP_AUTHORIZATION'] );
+        unset( $server_data['HTTP_COOKIE'] );
+        if ( isset( $server_data['PHP_AUTH_USER'] ) ) {
+            $server_data['PHP_AUTH_USER'] = '*******';
+        }
+        if ( isset( $server_data['PHP_AUTH_PW'] ) ) {
+            $server_data['PHP_AUTH_PW'] = '*******';
+        }
+        */
+        $init .= str_replace( 'Array', '', print_r( $server_data, true ) ) . "=SERVER INFO END=\n\n";
+        file_put_contents( self::get_file_location(), self::encrypt( $init ) );
+        // Create an empty log file without server info or CSV header
+        file_put_contents( self::get_file_location(), self::encrypt( '' ) );
         if ( ! self::file_exists() ) {
+            die( '{"code": "log_write_fail", "message": "Log file can not be created. Check permissions."}' );
+        }
+            wp_die( wp_json_encode( array( 'code' => 'log_write_fail', 'message' => 'Log file can not be created. Check permissions.' ) ) );
+        }
+    }
+    /**
+     * Generate server info and CSV header for download
+     *
+     * @return string
+     */
+    private static function get_server_info_and_header() {
+        $init                            = "====== SERVER INFO START ======\n\n";
+        $server_data                     = array();
+        // Safely extract server data with existence checks and unslashing
+        $server_data['REQUEST_URI']      = isset( $_SERVER['REQUEST_URI'] ) ? self::strip_request_query( sanitize_url( wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) : 'Not Available';
+        $server_data['HTTP_IWC_API_KEY'] = isset( $_SERVER['HTTP_IWC_API_KEY'] ) ? substr( sanitize_text_field( wp_unslash( $_SERVER['HTTP_IWC_API_KEY'] ) ), 0, self::API_KEY_PREVIEW_LENGTH ) . '...' : 'Not Provided';
+        // List of server variables to extract using the helper method
+        $server_vars = array(
+            'SERVER_SOFTWARE', 'REDIRECT_UNIQUE_ID', 'REDIRECT_STATUS', 'UNIQUE_ID',
+            'HTTP_X_DATADOG_SAMPLING_PRIORITY', 'HTTP_X_DATADOG_SAMPLED', 'HTTP_X_DATADOG_PARENT_ID',
+            'HTTP_X_DATADOG_TRACE_ID', 'CONTENT_TYPE', 'HTTP_USER_AGENT', 'HTTP_X_FORWARDED_PORT',
+            'HTTP_X_FORWARDED_SSL', 'HTTP_X_FORWARDED_PROTO', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_REAL_IP',
+            'HTTP_CONNECTION', 'HTTP_HOST', 'HTTP_X_FORWARDED_HOST', 'PATH', 'DYLD_LIBRARY_PATH',
+            'SERVER_SIGNATURE', 'SERVER_NAME', 'SERVER_ADDR', 'SERVER_PORT', 'REMOTE_ADDR',
+            'DOCUMENT_ROOT', 'REQUEST_SCHEME', 'CONTEXT_PREFIX', 'CONTEXT_DOCUMENT_ROOT',
+            'SCRIPT_FILENAME', 'REMOTE_PORT', 'REDIRECT_URL', 'GATEWAY_INTERFACE',
+            'SERVER_PROTOCOL', 'REQUEST_METHOD', 'SCRIPT_NAME', 'PHP_SELF', 'REQUEST_TIME_FLOAT', 'REQUEST_TIME'
+        );
+        // Handle all server variables using helper method
+        foreach ( $server_vars as $var ) {
+            $server_data[ $var ] = self::get_sanitized_server_var( $var );
+        }
+        // Special handling for SERVER_ADMIN using email sanitization
+        $server_data['SERVER_ADMIN'] = isset( $_SERVER['SERVER_ADMIN'] ) ? sanitize_email( wp_unslash( $_SERVER['SERVER_ADMIN'] ) ) : 'Not Available';
+        foreach ( $server_data as $key => $value ) {
+            $init .= $key . ': ' . $value . "\n";
+        }
+        $init .= "\n====== SERVER INFO END ======\n\n";
+        $init .= "date,method,uri,ip,codes,logged_in\n";
+        return $init;
+    }
 …
+    }
+    /**
+     * Encrypt data using secure AES-256-CBC
+     *
+     * @param string $data
+     * @return string
+     */
     private static function encrypt( $data ) {
+        return openssl_encrypt( $data, self::CIPHERMETHOD, self::get_enc_key() );
+    }
+        $key = self::get_encryption_key();
+        $iv  = self::generate_iv();
+        $encrypted = openssl_encrypt( $data, self::CIPHERMETHOD, $key, 0, $iv );
+        // Prepend IV to encrypted data
+        return base64_encode( $iv . $encrypted );
+    }
+    /**
+     * Decrypt data using secure AES-256-CBC
+     *
+     * @param string $data
+     * @return string
+     */
     private static function decrypt( $data ) {
+        return openssl_decrypt( $data, self::CIPHERMETHOD, self::get_enc_key() );
+        $key  = self::get_encryption_key();
+        $data = base64_decode( $data );
+        $iv_length = openssl_cipher_iv_length( self::CIPHERMETHOD );
+        $iv        = substr( $data, 0, $iv_length );
+        $encrypted = substr( $data, $iv_length );
+        return openssl_decrypt( $encrypted, self::CIPHERMETHOD, $key, 0, $iv );
+    }
+    /**
+     * Helper method to safely get and sanitize server variables
+     *
+     * @param string $var_name The server variable name
+     * @return string Sanitized value or 'Not Available'
+     */
+    private static function get_sanitized_server_var( $var_name ) {
+        return isset( $_SERVER[ $var_name ] ) ? sanitize_text_field( wp_unslash( $_SERVER[ $var_name ] ) ) : 'Not Available';
+    }
 …
     private static function get_record( $codes ) {
+        $request_method = self::get_sanitized_server_var( 'REQUEST_METHOD' );
+        if ( $request_method === 'Not Available' ) {
+            $request_method = 'Unknown';
+        }
+        $request_uri = isset( $_SERVER['REQUEST_URI'] ) ? self::strip_request_query( sanitize_url( wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) : 'Unknown';
+        $remote_addr = self::get_sanitized_server_var( 'REMOTE_ADDR' );
+        if ( $remote_addr === 'Not Available' ) {
+            $remote_addr = 'Unknown';
+        }
         $r = array(
+            'request' => sanitize_text_field( $_SERVER['REQUEST_METHOD'] ) . ' ' . self::strip_request_query( sanitize_url( $_SERVER['REQUEST_URI'] ) ),
+            'ip'      => sanitize_url( $_SERVER['REMOTE_ADDR'] ),
+            'codes'   => $codes . '(' . (string) is_user_logged_in() . ')',
+            'date' => gmdate( 'Y-m-d\TH:i:s.v\Z' ),
+            'method' => $request_method,
+            'uri' => $request_uri,
+            'ip'      => $remote_addr,
+            'codes'   => $codes,
+            'logged_in' => (string) is_user_logged_in(),
         );
+        $r = str_replace( array( '[', 'Array', ']' ), '', print_r( $r, true ) );
+        $r = str_replace( ' =>', ':', $r );
+        return date( 'Y-m-d G:i:s' ) . ' ' . $r . "\n";
+        return trim( implode(',', $r) ) . "\n";
+    }
 …
     public static function get_plain_file_content() {
         if ( ! file_exists( self::get_file_location() ) ) {
             die( '{"code": "log_read_fail", "message": "Log file does not exist."}' );
+            wp_die( wp_json_encode( array( 'code' => 'log_read_fail', 'message' => 'Log file does not exist.' ) ) );
+        }
         $enc_data = file_get_contents( self::get_file_location() );
 …
+    }
-    private static function get_enc_key() {
-        $key = get_option( 'iwc_api_key' );
-        if ( empty( $key ) ) {
-            file_put_contents( self::get_file_location(), 'iwc_api_key Not Found' );
+        }
-        return $key;
+    }
     public static function download() {
         $log_data = self::get_plain_file_content();
+        // Prepend server info and CSV header to the log data for download
+        $download_data = self::get_server_info_and_header() . $log_data;
         header( 'Content-Type: application/octet-stream' );
         header( 'Content-Transfer-Encoding: Binary' );
         header( 'Content-disposition: attachment; filename="log.txt"' );
+        echo $log_data;
+        // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- We want to output raw log data
+        echo $download_data;
         exit;
+    }
+    /**
+     * Purge all log data
+     *
+     * @return bool Success status
+     */
+    public static function purge() {
+        $log_file = self::get_file_location();
+        if ( file_exists( $log_file ) ) {
+            // Remove the log file using WordPress function
+            $result = wp_delete_file( $log_file );
+            if ( $result ) {
+                // Also remove the encryption key to ensure complete cleanup
+                delete_site_option( 'iwc_log_encryption_key' );
+                return true;
+            }
+            return false;
+        }
+        // If file doesn't exist, consider it a success
+        return true;
+    }
+}

integromat-connector/trunk/class/class-rest-request.php

-                      r2915666
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class Rest_Request {
+    public static function dispatch() {
+        preg_match( '#\/wp-json/(.*)\??.*#i', $_SERVER['REQUEST_URI'], $route_match );
+        if ( ! isset( $route_match[1] ) ) {
+            return;
+        }
+        $f          = explode( '?', $route_match[1] );
+        $rest_route = '/' . $f[0];
+        // Authentication isn’t performed when making internal requests.
+        $request = new \WP_REST_Request( $_SERVER['REQUEST_METHOD'], $rest_route );
+        $request->set_query_params( $_GET );
+        if ( 'POST' === $_SERVER['REQUEST_METHOD'] ) {
+            $body = json_decode( file_get_contents( 'php://input' ), true );
+            $request->set_body_params( $body );
+    public static function dispatch() {
+        // Check payload size early
+        if ( \Integromat\Rate_Limiter::is_payload_too_large() ) {
+            Rest_Response::render_error( 413, 'Request payload too large', 'payload_too_large' );
+            return;
+        }
+        // Add authentication check for security (use API-specific permissions)
+        if ( ! current_user_can( 'iwc_read_posts' ) ) {
+            Rest_Response::render_error( 403, 'Insufficient API permissions', 'rest_forbidden' );
+            return;
+        }
+        // Validate and sanitize REQUEST_URI
+        if ( ! isset( $_SERVER['REQUEST_URI'] ) || empty( $_SERVER['REQUEST_URI'] ) ) {
+            Rest_Response::render_error( 400, 'Invalid request URI', 'rest_invalid_request' );
+            return;
+        }
+        $request_uri = sanitize_url( wp_unslash( $_SERVER['REQUEST_URI'] ) );
+        // Extract the REST route from the request URI with better validation
+        if ( ! preg_match( '#\/wp-json/(.*?)(\?.*)?$#i', $request_uri, $route_match ) ) {
+            Rest_Response::render_error( 400, 'Invalid REST API request', 'rest_invalid_route' );
+            return;
+        }
+        if ( ! isset( $route_match[1] ) || empty( $route_match[1] ) ) {
+            Rest_Response::render_error( 400, 'Missing REST route', 'rest_missing_route' );
+            return;
+        }
+        $rest_route = '/' . sanitize_text_field( $route_match[1] );
+        // Validate HTTP method
+        $allowed_methods = array( 'GET', 'POST', 'PUT', 'DELETE', 'PATCH' );
+        $request_method  = isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : '';
+        if ( ! in_array( $request_method, $allowed_methods, true ) ) {
+            Rest_Response::render_error( 405, 'Method not allowed', 'rest_method_not_allowed' );
+            return;
+        }
+        // Authentication isn't performed when making internal requests.
+        $request = new \WP_REST_Request( $request_method, $rest_route );
+        // Sanitize and validate query parameters
+        $query_params = array();
+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
+        if ( ! empty( $_GET ) ) {
+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
+            foreach ( $_GET as $key => $value ) {
+                $clean_key = sanitize_key( $key );
+                if ( is_array( $value ) ) {
+                    $query_params[ $clean_key ] = array_map( 'sanitize_text_field', wp_unslash( $value ) );
+                } else {
+                    $query_params[ $clean_key ] = sanitize_text_field( wp_unslash( $value ) );
+                }
+            }
+        }
+        $request->set_query_params( $query_params );
+        if ( 'POST' === $request_method ) {
+            $input = file_get_contents( 'php://input' );
+            if ( false === $input ) {
+                Rest_Response::render_error( 400, 'Unable to read request body', 'rest_invalid_request' );
+                return;
+            }
+            // Validate JSON if not empty
+            if ( ! empty( $input ) ) {
+                $body = json_decode( $input, true );
+                if ( json_last_error() !== JSON_ERROR_NONE ) {
+                    Rest_Response::render_error( 400, 'Invalid JSON in request body: ' . json_last_error_msg(), 'rest_invalid_json' );
+                    return;
+                }
+                // Sanitize body data
+                $body = self::sanitize_recursive( $body );
+                $request->set_body_params( $body );
+            }
+            // phpcs:ignore WordPress.Security.NonceVerification.Missing -- REST API endpoint, authentication handled separately
             if ( ! empty( $_FILES['file'] ) ) {
                 self::upload_media();
+                return; // upload_media handles its own response
+            }
+        }
 …
         $response_data = $server->response_to_data( $response, false );
+        // Save custom meta.
+        if ( 'POST' === $_SERVER['REQUEST_METHOD'] ) {
+            if ( ! empty( $body['meta'] ) ) {
+                $content_type = self::get_content_type( $rest_route );
+                self::update_meta( $response_data['id'], $content_type, $body['meta'] );
+            }
+        }
+        // Save custom meta for POST requests
+        if ( 'POST' === $request_method && ! empty( $body['meta'] ) ) {
+            $content_type = self::get_content_type( $rest_route );
+            if ( isset( $response_data['id'] ) && is_numeric( $response_data['id'] ) ) {
+                self::update_meta( absint( $response_data['id'] ), $content_type, $body['meta'] );
+            }
+        }
         self::send_response( $response, $response_data );
+    }
+    /**
+     * Recursively sanitize array data
+     *
+     * @param mixed $data
+     * @return mixed
+     */
+    private static function sanitize_recursive( $data ) {
+        if ( is_array( $data ) ) {
+            $sanitized = array();
+            foreach ( $data as $key => $value ) {
+                $clean_key = sanitize_key( $key );
+                $sanitized[ $clean_key ] = self::sanitize_recursive( $value );
+            }
+            return $sanitized;
+        } elseif ( is_string( $data ) ) {
+            return sanitize_text_field( $data );
+        } elseif ( is_numeric( $data ) ) {
+            return is_float( $data ) ? floatval( $data ) : intval( $data );
+        } elseif ( is_bool( $data ) ) {
+            return (bool) $data;
+        }
+        return $data;
+    }
 …
      */
     private static function send_response( $response, $response_data ) {
+        $response_json = wp_json_encode( $response_data );
+        // Add security headers
+        header( 'X-Content-Type-Options: nosniff' );
+        header( 'X-Frame-Options: DENY' );
+        header( 'X-XSS-Protection: 1; mode=block' );
+        header( 'Referrer-Policy: strict-origin-when-cross-origin' );
         if ( ! empty( $response->headers ) ) {
             foreach ( $response->headers as $key => $val ) {
+                header( "$key: $val" );
+            }
+        }
+        header( 'Content-type: application/json' );
+                // Sanitize headers to prevent header injection attacks
+                $clean_key = preg_replace('/[^\w-]/', '', $key);
+                $clean_val = preg_replace('/[\r\n]/', '', $val);
+                if ( ! empty( $clean_key ) && ! empty( $clean_val ) ) {
+                    header( "$clean_key: $clean_val" );
+                }
+            }
+        }
+        header( 'Content-type: application/json; charset=utf-8' );
         if ( is_object( $response_data ) && is_object( $response_data->data ) && (int) $response_data->data->status > 0 ) {
             http_response_code( $response_data->data->status );
+        }
+        die( $response_json );
+        // Respond with JSON-encoded data and exit
+        echo wp_json_encode( $response_data );
+        exit();
+    }
     private static function upload_media() {
+        $udir              = wp_upload_dir();
+        $media_file_source = $udir['path'] . '/' . sanitize_file_name( $_FILES['file']['name'] );
+        if ( (int) $_FILES['file']['size'] === 0 ) {
+            Rest_Response::render_error( 500, 'The uploaded file exceeds the upload_max_filesize directive in php.ini.', 'rest_upload_unknown_error' );
+        }
+        if ( (int) $_FILES['file']['error'] > 0 ) {
+            Rest_Response::render_error( 500, 'An error has occured when uploading file to the server.', 'rest_upload_unknown_error' );
+        }
+        copy( realpath( $_FILES['file']['tmp_name'] ), $media_file_source );
+        $title       = isset( $_REQUEST['title'] ) ? sanitize_title( $_REQUEST['title'] ) : '';
+        $description = isset( $_REQUEST['description'] ) ? sanitize_text_field( $_REQUEST['description'] ) : '';
+        $caption     = isset( $_REQUEST['caption'] ) ? sanitize_text_field( $_REQUEST['caption'] ) : '';
+        $alt_text    = isset( $_REQUEST['alt_text'] ) ? sanitize_text_field( $_REQUEST['alt_text'] ) : '';
+        $post_id     = isset( $_REQUEST['post'] ) ? (int) $_REQUEST['post'] : '';
+        $upload_dir = wp_upload_dir();
+        $filename   = basename( $media_file_source );
+        if ( wp_mkdir_p( $upload_dir['path'] ) ) {
+            $file = $upload_dir['path'] . '/' . $filename;
+        // Add authentication check for file uploads using API-specific permissions
+        if ( ! current_user_can( 'iwc_upload_files' ) ) {
+            Rest_Response::render_error( 403, 'Insufficient permissions for file upload', 'rest_forbidden' );
+            return;
+        }
+        // Validate file upload data exists and is properly formatted
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- REST API endpoint, authentication handled separately
+        if ( empty( $_FILES['file'] ) || ! is_array( $_FILES['file'] ) ) {
+            Rest_Response::render_error( 400, 'No file uploaded', 'rest_upload_no_file' );
+            return;
+        }
+        // Check for upload errors first
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- REST API endpoint, authentication handled separately
+        $upload_error = isset( $_FILES['file']['error'] ) ? absint( $_FILES['file']['error'] ) : UPLOAD_ERR_NO_FILE;
+        if ( $upload_error !== UPLOAD_ERR_OK ) {
+            $error_messages = array(
+                UPLOAD_ERR_INI_SIZE   => 'File exceeds upload_max_filesize directive',
+                UPLOAD_ERR_FORM_SIZE  => 'File exceeds MAX_FILE_SIZE directive',
+                UPLOAD_ERR_PARTIAL    => 'File was only partially uploaded',
+                UPLOAD_ERR_NO_FILE    => 'No file was uploaded',
+                UPLOAD_ERR_NO_TMP_DIR => 'Missing temporary folder',
+                UPLOAD_ERR_CANT_WRITE => 'Failed to write file to disk',
+                UPLOAD_ERR_EXTENSION  => 'File upload stopped by extension',
+            );
+            $error_message = isset( $error_messages[ $upload_error ] ) ? $error_messages[ $upload_error ] : 'Unknown upload error';
+            Rest_Response::render_error( 400, $error_message, 'rest_upload_error' );
+            return;
+        }
+        // Sanitize file upload data (preserve tmp_name as-is for file operations)
+        // phpcs:disable WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- REST API endpoint, authentication handled separately, tmp_name is a system-generated temporary file path, safe to use unsanitized
+        $uploaded_file = array(
+            'name'     => isset( $_FILES['file']['name'] ) ? sanitize_file_name( wp_unslash( $_FILES['file']['name'] ) ) : '',
+            'type'     => isset( $_FILES['file']['type'] ) ? sanitize_mime_type( wp_unslash( $_FILES['file']['type'] ) ) : '',
+            'tmp_name' => isset( $_FILES['file']['tmp_name'] ) ? $_FILES['file']['tmp_name'] : '', // Keep tmp_name unsanitized for file operations
+            'error'    => $upload_error,
+            'size'     => isset( $_FILES['file']['size'] ) ? $_FILES['file']['size'] : 0, // Don't convert to int yet
+        );
+        //phpcs:enable WordPress.Security.NonceVerification.Missing,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+        // Validate file exists and has content using file system check
+        if ( empty( $uploaded_file['tmp_name'] ) || ! file_exists( $uploaded_file['tmp_name'] ) ) {
+            Rest_Response::render_error( 400, 'No file uploaded or file not found', 'rest_upload_no_file' );
+            return;
+        }
+        // Get actual file size from filesystem (more reliable than $_FILES size)
+        $actual_file_size = filesize( $uploaded_file['tmp_name'] );
+        if ( $actual_file_size === false || $actual_file_size === 0 ) {
+            Rest_Response::render_error( 400, 'File is empty or unreadable', 'rest_upload_no_file' );
+            return;
+        }
+        // Update the size with actual file size
+        $uploaded_file['size'] = $actual_file_size;
+        // Use our enhanced file validator
+        $validation_result = \Integromat\File_Validator::validate_upload( $uploaded_file );
+        if ( is_wp_error( $validation_result ) ) {
+            Rest_Response::render_error( 400, $validation_result->get_error_message(), $validation_result->get_error_code() );
+            return;
+        }
+        // Use WordPress secure upload handling
+        $upload_overrides = array(
+            'test_form' => false,
+            'test_size' => true,
+        );
+        // Move uploaded file using WordPress function
+        require_once ABSPATH . 'wp-admin/includes/file.php';
+        $movefile = wp_handle_upload( $uploaded_file, $upload_overrides );
+        if ( $movefile && ! isset( $movefile['error'] ) ) {
+            // Get additional metadata
+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
+            $title       = isset( $_REQUEST['title'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['title'] ) ) : '';
+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
+            $description = isset( $_REQUEST['description'] ) ? sanitize_textarea_field( wp_unslash( $_REQUEST['description'] ) ) : '';
+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
+            $caption     = isset( $_REQUEST['caption'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['caption'] ) ) : '';
+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
+            $alt_text    = isset( $_REQUEST['alt_text'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['alt_text'] ) ) : '';
+            // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- REST API endpoint, authentication handled separately
+            $post_id     = isset( $_REQUEST['post'] ) ? absint( $_REQUEST['post'] ) : 0;
+            $filename   = basename( $movefile['file'] );
+            // Prepare attachment data
+            $attachment = array(
+                'post_mime_type' => $movefile['type'],
+                'post_title'     => ( ! empty( $title ) ? $title : sanitize_file_name( $filename ) ),
+                'post_content'   => $description,
+                'post_excerpt'   => $caption,
+                'post_status'    => 'inherit',
+            );
+            // Insert attachment
+            $attachment_id = wp_insert_attachment( $attachment, $movefile['file'] );
+            if ( is_wp_error( $attachment_id ) ) {
+                Rest_Response::render_error( 500, 'Failed to create attachment', 'rest_upload_attachment_error' );
+                return;
+            }
+            // Set alt text if provided
+            if ( ! empty( $alt_text ) ) {
+                update_post_meta( $attachment_id, '_wp_attachment_image_alt', sanitize_text_field( $alt_text ) );
+            }
+            // Generate attachment metadata
+            require_once ABSPATH . 'wp-admin/includes/media.php';
+            require_once ABSPATH . 'wp-admin/includes/image.php';
+            $attachment_data = wp_generate_attachment_metadata( $attachment_id, $movefile['file'] );
+            wp_update_attachment_metadata( $attachment_id, $attachment_data );
+            // Relate to a post if specified
+            if ( $post_id > 0 && get_post( $post_id ) ) {
+                set_post_thumbnail( $post_id, $attachment_id );
+            }
+            // Prepare response
+            $meta = wp_get_attachment_metadata( $attachment_id );
+            $post = get_post( $attachment_id );
+            if ( is_array( $meta ) ) {
+                $response_data = array_merge( $meta, (array) $post );
+            } else {
+                $response_data = (array) $post;
+            }
+            self::send_response( (object) array(), $response_data );
         } else {
+            $file = $upload_dir['basedir'] . '/' . $filename;
+        }
+        $wp_file_type  = wp_check_filetype( $filename, null );
+        $allowed_types = get_allowed_mime_types();
+        if ( ! in_array( $wp_file_type['type'], $allowed_types ) ) {
+            Rest_Response::render_error( 500, 'Sorry, this file type is not permitted for security reasons.', 'rest_upload_unknown_error' );
+        }
+        $attachment    = array(
+            'post_mime_type' => $wp_file_type['type'],
+            'post_title'     => ( ! empty( $title ) ? $title : sanitize_file_name( $filename ) ),
+            'post_content'   => ( ! empty( $description ) ? $description : '' ),
+            'post_excerpt'   => ( ! empty( $caption ) ? $caption : '' ),
+            'post_status'    => 'inherit',
+            $error_message = isset( $movefile['error'] ) ? sanitize_text_field( $movefile['error'] ) : 'Unknown upload error';
+            Rest_Response::render_error( 500, 'Upload failed: ' . $error_message, 'rest_upload_unknown_error' );
+        }
+    }
+    private static function update_meta( $content_id, $content_type, $meta_fields ) {
+        // Define meta function mapping for better maintainability
+        $meta_functions = array(
+            'comments'   => array( 'update' => 'update_comment_meta', 'delete' => 'delete_comment_meta' ),
+            'tags'       => array( 'update' => 'update_term_meta', 'delete' => 'delete_term_meta' ),
+            'categories' => array( 'update' => 'update_term_meta', 'delete' => 'delete_term_meta' ),
+            'users'      => array( 'update' => 'update_user_meta', 'delete' => 'delete_user_meta' ),
+            'default'    => array( 'update' => 'update_post_meta', 'delete' => 'delete_post_meta' ),
         );
+        $attachment_id = wp_insert_attachment( $attachment, $file );
+        if ( ! empty( $alt_text ) ) {
+            update_post_meta( $attachment_id, '_wp_attachment_image_alt', $alt_text );
+        }
+        require_once ABSPATH . 'wp-admin/includes/media.php';
+        require_once ABSPATH . 'wp-admin/includes/image.php';
+        $attachment_data = wp_generate_attachment_metadata( $attachment_id, $file );
+        wp_update_attachment_metadata( $attachment_id, $attachment_data );
+        // Relate to a post.
+        if ( ! empty( $post_id ) && (int) $post_id > 0 ) {
+            set_post_thumbnail( $post_id, $attachment_id );
+        }
+        $meta = wp_get_attachment_metadata( $attachment_id );
+        $post = get_post( $attachment_id );
+        if ( is_array( $meta ) ) {
+            $response_data = array_merge( $meta, (array) $post );
+        } else {
+            $response_data = (array) $post;
+        }
+        self::send_response( (object) array(), wp_json_encode( $response_data ) );
+    }
+    private static function update_meta( $content_id, $content_type, $meta_fields ) {
+        // Skip updating meta for media and pages
+        if ( in_array( $content_type, array( 'media', 'pages' ), true ) ) {
+            return;
+        }
+        // Get appropriate functions for this content type
+        $functions = isset( $meta_functions[ $content_type ] ) ? $meta_functions[ $content_type ] : $meta_functions['default'];
         foreach ( $meta_fields as $meta_key => $meta_value ) {
+            switch ( $content_type ) {
+                case 'media':
+                case 'pages':
+                    return;
+                    break;
+                case 'comments':
+                    $function_update = 'update_comment_meta';
+                    $function_delete = 'delete_comment_meta';
+                    break;
+                case 'tags':
+                case 'categories':
+                    $function_update = 'update_term_meta';
+                    $function_delete = 'delete_term_meta';
+                    break;
+                case 'users':
+                    $function_update = 'update_user_meta';
+                    $function_delete = 'delete_user_meta';
+                    break;
+                default:
+                    $function_update = 'update_post_meta';
+                    $function_delete = 'delete_post_meta';
+                    break;
+            }
+            switch ( $meta_value ) {
+                case 'IMT.REMOVE':
+                    $function_delete( $content_id, $meta_key );
+                    break;
+                default:
+                    $function_update( $content_id, $meta_key, $meta_value );
+                    break;
+            }
+        }
+    }
+            if ( $meta_value === 'IMT.REMOVE' ) {
+                $functions['delete']( $content_id, $meta_key );
+            } else {
+                $functions['update']( $content_id, $meta_key, $meta_value );
+            }
+        }
+    }
     /**
 …
+        }
+    }
+}

integromat-connector/trunk/class/class-rest-response.php

-                      r2783423
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class Rest_Response {
 …
      * @param string $error_message
      * @param string $error_code
+     * @param array  $headers Optional headers to include
      */
+    public static function render_error( $status_code, $error_message, $error_code ) {
+        $out = '{
+            "code": "' . $error_code . '",
+            "message": "' . $error_message . '",
+            "data": {
+                "status": ' . $status_code . '
+            }
+        }';
+    public static function render_error( $status_code, $error_message, $error_code, $headers = array(), $details = array() ) {
         http_response_code( $status_code );
         header( 'Content-type: application/json' );
+        // use wp_send_json_error instead?
+        die( trim( $out ) );
+        $error = array(
+            "code" => $error_code,
+            "message" => $error_message,
+            "data" => array_merge( array ( "status" => $status_code ), $details ),
+        );
+        foreach ( $headers as $name => $value ) {
+            $clean_name = preg_replace( '/[^\w-]/', '', $name );
+            $clean_value = preg_replace( '/[\r\n]/', '', $value );
+            if ( ! empty( $clean_name ) && ! empty( $clean_value ) ) {
+                header( "$clean_name: $clean_value" );
+            }
+        }
+        echo wp_json_encode( $error );
+        exit;
+    }
+}

integromat-connector/trunk/class/class-user.php

-                      r2883308
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class User {
 …
      */
     public static function get_administrator_user() {
+        $users = get_users( array( 'role__in' => array( 'administrator') ) );
+        $users = get_users( array( 'role__in' => array( 'administrator' ), 'number' => 5 ) );
         if ( empty( $users ) ) {
             return 0;
 …
         // Prioritize user ID 1 (default admin).
         foreach ( $users as $user ) {
             if ( $user->data->ID == 1 && in_array( 'administrator', $user->roles ) ) {
+            if ( $user->data->ID == 1 && in_array( 'administrator', $user->roles, true ) ) {
                 return $user->data->ID;
             };
+            }
+        }
         // Search for another admin, if user ID 1 doesn't exist or hasn't administrator role.
         foreach ( $users as $user ) {
             if ( in_array( 'administrator', $user->roles ) ) {
+            if ( in_array( 'administrator', $user->roles, true ) ) {
                 return $user->data->ID;
             };
+            }
+        }
 …
     /**
      * Log user in
+     * Set current user context for API requests with specific permissions
+     *
      * @param int $user_id
+     * @param string $endpoint The REST endpoint being accessed
+     * @param string $method HTTP method
+     * @return bool Success status
      */
+    public static function login( $user_id ) {
+        wp_clear_auth_cookie();
+    public static function set_api_user_context( $user_id, $endpoint = '', $method = 'GET' ) {
+        // Validate user exists and has administrator role
+        $user = get_user_by( 'id', $user_id );
+        if ( ! $user || ! in_array( 'administrator', $user->roles, true ) ) {
+            return false;
+        }
+        // Set user context without full authentication
         wp_set_current_user( $user_id );
+        // If endpoint and method provided, check API-specific permissions
+        // Note: Api_Permissions::check_permission() will internally verify if this is a Make request
+        if ( ! empty( $endpoint ) && ! empty( $method ) ) {
+            if ( ! \Integromat\Api_Permissions::check_permission( $endpoint, $method ) ) {
+                // Log permission failure
+                if ( get_option( 'iwc-logging-enabled' ) == 'true' ) {
+                    \Integromat\Logger::write( 11 );
+                }
+                return false;
+            }
+        }
+        return true;
+    }

integromat-connector/trunk/index.php

-                      r3257687
+                      r3361722
 /**
  * @package Integromat_Connector
  * @version 1.5.10
+ * @version 1.6.0
  */
 …
 Author: Celonis s.r.o.
 Author URI: https://www.make.com/en?utm_source=wordpress&utm_medium=partner&utm_campaign=wordpress-partner-make
+Version: 1.5.10
+Version: 1.6.0
+License: GPL v2 or later
+License URI: https://www.gnu.org/licenses/gpl-2.0.html
 */
 …
 define('IWC_PLUGIN_NAME_SAFE', 'integromat-wordpress-connector');
 define('IWC_MENUITEM_IDENTIFIER', 'integromat_custom_fields');
+define('IWC_PLUGIN_VERSION', '1.6.0');
 require __DIR__ . '/class/class-user.php';
 …
 require __DIR__ . '/class/class-guard.php';
 require __DIR__ . '/class/class-logger.php';
+require __DIR__ . '/class/class-api-permissions.php';
+require __DIR__ . '/class/class-rate-limiter.php';
+require __DIR__ . '/class/class-file-validator.php';
 require __DIR__ . '/api/authentication.php';
 …
 $controller = new \Integromat\Controller();
 $controller->init();
+// Initialize API permissions
+\Integromat\Api_Permissions::init();
 // Custom CSS, JS.
 …
         wp_enqueue_style(
             'integromat_css',
+            plugin_dir_url(__FILE__) . 'assets/iwc.css'
+            plugin_dir_url(__FILE__) . 'assets/iwc.css',
+            [],
+            IWC_PLUGIN_VERSION
         );
         wp_enqueue_script(
             'integromat_js',
             plugin_dir_url(__FILE__) . 'assets/iwc.js',
+            ['jquery-ui-tabs']
+            ['jquery'],
+            IWC_PLUGIN_VERSION,
+            true
         );
+        // Localize script for AJAX
+        wp_localize_script('integromat_js', 'iwc_ajax', array(
+            'ajax_url' => admin_url('admin-ajax.php'),
+            'regenerate_nonce' => wp_create_nonce('iwc_regenerate_nonce'),
+            'purge_nonce' => wp_create_nonce('iwc_purge_nonce'),
+            'reveal_nonce' => wp_create_nonce('iwc_reveal_nonce')
+        ));
+    }
 );
+// AJAX handler for API key regeneration
+add_action('wp_ajax_iwc_regenerate_api_key', function() {
+    // Verify nonce
+    if (!wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'] ?? '')), 'iwc_regenerate_nonce')) {
+        wp_send_json_error('Security check failed', 403);
+        return;
+    }
+    // Verify current user capabilities
+    if (!current_user_can('manage_options')) {
+        wp_send_json_error('Insufficient permissions', 403);
+        return;
+    }
+    // Verify confirmation text
+    $confirmation = sanitize_text_field(wp_unslash($_POST['confirmation'] ?? ''));
+    if (strtolower($confirmation) !== 'regenerate') {
+        wp_send_json_error('Confirmation text does not match');
+        return;
+    }
+    try {
+        // Regenerate the API key
+        $new_token = \Integromat\Api_Token::regenerate();
+        $masked_token = str_repeat('•', 20) . substr($new_token, -4);
+        wp_send_json_success(array(
+            'message' => 'API key regenerated successfully',
+            'new_token' => $new_token,
+            'masked_token' => $masked_token
+        ));
+    } catch (Exception $e) {
+        wp_send_json_error('Failed to regenerate API key: ' . $e->getMessage());
+    }
+});
+// AJAX handler for revealing API key
+add_action('wp_ajax_iwc_reveal_api_key', function() {
+    // Verify nonce
+    if (!wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'] ?? '')), 'iwc_reveal_nonce')) {
+        wp_send_json_error('Security check failed', 403);
+        return;
+    }
+    // Verify current user capabilities
+    if (!current_user_can('manage_options')) {
+        wp_send_json_error('Insufficient permissions', 403);
+        return;
+    }
+    try {
+        // Log the API key reveal action for security audit
+        if (class_exists('\\Integromat\\Logger')) {
+            $current_user = wp_get_current_user();
+            \Integromat\Logger::write('API key revealed by user: ' . $current_user->user_login . ' (ID: ' . $current_user->ID . ')');
+        }
+        // Get the current API key
+        $api_token = \Integromat\Api_Token::get();
+        if (empty($api_token)) {
+            wp_send_json_error('No API key found');
+            return;
+        }
+        wp_send_json_success(array(
+            'api_key' => $api_token
+        ));
+    } catch (Exception $e) {
+        wp_send_json_error('Failed to retrieve API key: ' . $e->getMessage());
+    }
+});
+// AJAX handler for log purging
+add_action('wp_ajax_iwc_purge_logs', function() {
+    // Verify nonce
+    if (!wp_verify_nonce(sanitize_text_field(wp_unslash($_POST['nonce'] ?? '')), 'iwc_purge_nonce')) {
+        wp_send_json_error('Security check failed', 403);
+        return;
+    }
+    // Verify current user capabilities
+    if (!current_user_can('manage_options')) {
+        wp_send_json_error('Insufficient permissions', 403);
+        return;
+    }
+    try {
+        // Purge the logs
+        $result = \Integromat\Logger::purge();
+        if ($result) {
+            wp_send_json_success('All log data has been successfully purged');
+        } else {
+            wp_send_json_error('Failed to purge log data');
+        }
+    } catch (Exception $e) {
+        wp_send_json_error('Failed to purge logs: ' . $e->getMessage());
+    }
+});
+// Activation and deactivation hooks for API permissions
+register_activation_hook( __FILE__, function() {
+    \Integromat\Api_Permissions::add_api_capabilities();
+    iwc_set_default_settings();
+});
+register_deactivation_hook( __FILE__, function() {
+    \Integromat\Api_Permissions::remove_api_capabilities();
+    iwc_cleanup_on_deactivation();
+});
+/**
+ * Cleanup when plugin is deactivated
+ */
+function iwc_cleanup_on_deactivation() {
+    // Remove version tracking
+    delete_option('iwc_plugin_version');
+    // Note: We intentionally don't remove user settings or API tokens
+    // to preserve user configuration if they reactivate the plugin
+}
+/**
+ * Set default settings when plugin is activated
+ */
+function iwc_set_default_settings() {
+    // Check if this is a fresh installation or upgrade
+    $current_version = get_option('iwc_plugin_version');
+    // Only set defaults on fresh installation
+    if (empty($current_version)) {
+        // General settings - logging disabled by default
+        add_option('iwc-logging-enabled', 'false');
+        // API permissions - disabled by default
+        add_option('iwc_api_permissions_enabled', '0');
+        // Individual API permissions - all disabled by default
+        $api_permissions = array(
+            'iwc_read_posts', 'iwc_create_posts', 'iwc_edit_posts', 'iwc_delete_posts',
+            'iwc_read_users', 'iwc_create_users', 'iwc_edit_users', 'iwc_delete_users',
+            'iwc_read_comments', 'iwc_create_comments', 'iwc_edit_comments', 'iwc_delete_comments',
+            'iwc_upload_files', 'iwc_read_media', 'iwc_edit_media', 'iwc_delete_media',
+            'iwc_read_terms', 'iwc_create_terms', 'iwc_edit_terms', 'iwc_delete_terms',
+        );
+        foreach ($api_permissions as $permission) {
+            add_option('iwc_permission_' . $permission, '0');
+        }
+        // Security settings - all disabled by default for backward compatibility
+        add_option('iwc_rate_limit_enabled', '0');
+        add_option('iwc_rate_limit_requests', '100');
+        add_option('iwc_payload_limit_enabled', '0');
+        add_option('iwc_max_payload_size', '10');
+        add_option('iwc_strict_file_validation', '0');
+        add_option('iwc_allowed_file_extensions', 'jpg,jpeg,png,gif,webp,svg,bmp,ico,pdf,doc,docx,xls,xlsx,ppt,pptx,txt,rtf,odt,ods,zip,rar,7z,tar,gz,mp3,wav,mp4,avi,mov,wmv,flv,webm,json,xml,csv');
+        add_option('iwc_log_security_events', '0');
+    }
+    // Generate API token if it doesn't exist (always check this)
+    if (empty(\Integromat\Api_Token::get())) {
+        \Integromat\Api_Token::initiate();
+    }
+    // Update plugin version
+    update_option('iwc_plugin_version', IWC_PLUGIN_VERSION);
+}

integromat-connector/trunk/readme.txt

-                      r3355938
+                      r3361722
 Tags: make, integromat, rest, api, rest api
 Requires at least: 5.0
 Tested up to:  6.7.2
+Tested up to: 6.8
 Requires PHP: 7.2
 Stable tag: 1.5.10
+Stable tag: 1.6.0
 License: GPLv2 or later
 …
 == Changelog ==
+= 1.6.0 =
+* Security improvement: Granular API permissions
+* Security improvement: Configurable rate limiting
+* New feature: Enhanced file upload validation
+* New feature: Request payload size limits
+* New feature: API key rotation
+* New feature: Purge log
+* Fix multiple vulnerabilities
 = 1.5.10 =
 * Fix a bug introduced in previous fix regarding PHP 7 compatibility

integromat-connector/trunk/settings/class-controller.php

-                      r2883308
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class Controller {
 …
             function () {
                 global $pagenow;
+                if ( 'options.php' === $pagenow || $pagenow === 'admin.php' && isset( $_GET['page'] ) && $_GET['page'] === IWC_MENUITEM_IDENTIFIER ) {
+                // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Admin page check, no form processing
+                if ( 'options.php' === $pagenow || ( 'admin.php' === $pagenow && isset( $_GET['page'] ) && sanitize_text_field( wp_unslash( $_GET['page'] ) ) === IWC_MENUITEM_IDENTIFIER ) ) {
                     // Posts.
                     require_once __DIR__ . '/object-types/class-post-meta.php';
 …
+                }
+                if ( $pagenow == 'options.php' || $pagenow == 'admin.php' && isset( $_GET['page'] ) && $_GET['page'] == 'integromat_custom_toxonomies' ) {
+                // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Admin page check, no form processing
+                if ( 'options.php' === $pagenow || ( 'admin.php' === $pagenow && isset( $_GET['page'] ) && sanitize_text_field( wp_unslash( $_GET['page'] ) ) === 'integromat_custom_toxonomies' ) ) {
                     // Taxonomies.
                     require_once __DIR__ . '/object-types/custom-taxonomy.php';
 …
                 require_once __DIR__ . '/object-types/general.php';
                 add_general_menu();
+                // Security settings
+                require_once __DIR__ . '/object-types/security.php';
+                add_security_menu();
+            }
         );

integromat-connector/trunk/settings/class-meta-object.php

-                      r2783423
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class Meta_Object {
 …
     public function get_meta_items( $table ) {
         global $wpdb;
+        $query = "
+            SELECT DISTINCT(meta_key)
+            FROM $table
+            ORDER BY meta_key
+        ";
+        return $wpdb->get_col( $query );
+        // Validate table name against known WordPress meta tables for security
+        $allowed_tables = array(
+            $wpdb->postmeta,
+            $wpdb->usermeta,
+            $wpdb->commentmeta,
+            $wpdb->termmeta
+        );
+        if ( ! in_array( $table, $allowed_tables, true ) ) {
+            return array();
+        }
+        // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared -- No WordPress function exists to get distinct meta keys from meta tables, one-time admin query, table name validated against whitelist
+        $query = "SELECT DISTINCT(meta_key) FROM `" . esc_sql( $table ) . "` ORDER BY meta_key";
+        $result = $wpdb->get_col( $query );
+        // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared
+        return is_array( $result ) ? $result : array();
+    }

integromat-connector/trunk/settings/events.php

-                      r2785241
+                      r3361722
         // Download a log file.
         if ( isset( $_GET['iwcdlogf'] ) ) {
             if ( isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( $_REQUEST['_wpnonce'], 'log-nonce' ) ) {
+            if ( isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'log-nonce' ) ) {
                 \Integromat\Logger::download();
             } else {
                 die( __( 'Wrong nonce', 'textdomain' ) );
+                wp_die( esc_html__( 'Security check failed', 'integromat-connector' ), esc_html__( 'Error', 'integromat-connector' ), array( 'response' => 403 ) );
+            }
+        }

integromat-connector/trunk/settings/object-types/class-comments-meta.php

-                      r2783423
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class Comments_Meta extends Meta_Object {
 …
         global $wpdb;
         $this->meta_item_keys = $this->get_meta_items($wpdb->commentmeta);
+        register_setting('integromat_api_comment', 'integromat_api_options_comment');
+        register_setting('integromat_api_comment', 'integromat_api_options_comment', array(
+            'sanitize_callback' => array( $this, 'sanitize_comment_options' ),
+        ));
         add_settings_section(
             'integromat_api_section_comments',
             __('', 'integromat_api_comment'),
+            __('Comments Metadata Settings', 'integromat-connector'),
             function ()  {
                 ?>
                     <p><?php esc_html_e('Select comments metadata to include in REST API response', 'integromat_api_comment'); ?></p>
+                    <p><?php esc_html_e('Select comments metadata to include in REST API response', 'integromat-connector'); ?></p>
                     <p><a class="uncheck_all" data-status="0">Un/check all</a></p>
                 <?php
 …
                 IWC_FIELD_PREFIX . $meta_item,
                 __($meta_item, 'integromat_api_comment'),
+                esc_html($meta_item),
                 function ($args) use($meta_item) {
                     $options = get_option('integromat_api_options_comment');
 …
+    }
+    /**
+     * Sanitize comment options
+     *
+     * @param array $input
+     * @return array
+     */
+    public function sanitize_comment_options( $input ) {
+        if ( ! is_array( $input ) ) {
+            return array();
+        }
+        $sanitized = array();
+        foreach ( $input as $key => $value ) {
+            $sanitized[ sanitize_key( $key ) ] = sanitize_text_field( $value );
+        }
+        return $sanitized;
+    }
+}

integromat-connector/trunk/settings/object-types/class-post-meta.php

-                      r2783423
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class Posts_Meta extends Meta_Object {
 …
     public function init() {
         $this->meta_item_keys = $this->get_post_meta_items();
+        register_setting( 'integromat_api_post', 'integromat_api_options_post' );
+        register_setting( 'integromat_api_post', 'integromat_api_options_post', array(
+            'sanitize_callback' => array( $this, 'sanitize_post_options' ),
+        ) );
         add_settings_section(
             'integromat_api_section_posts',
             __( '', 'integromat_api_post' ), // h1 title as the first argument.
+            __( 'Posts Metadata Settings', 'integromat-connector' ), // h1 title as the first argument.
             function () {
                 ?>
                     <p><?php esc_html_e( 'Select posts metadata to include in REST API response', 'integromat_api_post' ); ?></p>
+                    <p><?php esc_html_e( 'Select posts metadata to include in REST API response', 'integromat-connector' ); ?></p>
                     <p><a class="uncheck_all" data-status="0">Un/check all</a></p>
                 <?php
 …
             add_settings_field(
                 IWC_FIELD_PREFIX . $meta_item,
                 __( $meta_item, 'integromat_api_post' ),
+                esc_html( $meta_item ),
                 function ( $args ) use ( $meta_item, $object_type, $last_object_type ) {
                     $options = get_option( 'integromat_api_options_post' );
 …
                 add_settings_field(
                     IWC_FIELD_PREFIX . $meta_item,
                     __( $meta_item, 'integromat_api_post' ),
+                    esc_html( $meta_item ),
                     function ( $args ) use ( $meta_item ) {
                         $options    = get_option( 'integromat_api_options_post' );
 …
     public function get_post_meta_items() {
         global $wpdb;
+        $query     = '
+            SELECT
+                DISTINCT(m.meta_key),
+                p.post_type
+            FROM ' . $wpdb->base_prefix . 'postmeta m
+            INNER JOIN ' . $wpdb->base_prefix . 'posts p ON p.ID = m.post_id
+        ';
+        // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared -- No WordPress function exists for JOIN queries to get distinct meta keys with post types, one-time admin query, table names validated
+        $query = "SELECT DISTINCT(m.meta_key), p.post_type
+            FROM `" . esc_sql( $wpdb->postmeta ) . "` m
+            INNER JOIN `" . esc_sql( $wpdb->posts ) . "` p ON p.ID = m.post_id";
         $meta_keys = $wpdb->get_results( $query );
+        return $meta_keys;
+        // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared
+        return is_array( $meta_keys ) ? $meta_keys : array();
+    }
+    /**
+     * Sanitize post options
+     *
+     * @param array $input
+     * @return array
+     */
+    public function sanitize_post_options( $input ) {
+        if ( ! is_array( $input ) ) {
+            return array();
+        }
+        $sanitized = array();
+        foreach ( $input as $key => $value ) {
+            $sanitized[ sanitize_key( $key ) ] = sanitize_text_field( $value );
+        }
+        return $sanitized;
+    }
+}

integromat-connector/trunk/settings/object-types/class-term-meta.php

-                      r2783423
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class Terms_Meta extends Meta_Object {
 …
         global $wpdb;
         $this->meta_item_keys = $this->get_meta_items( $wpdb->termmeta );
+        register_setting( 'integromat_api_term', 'integromat_api_options_term' );
+        register_setting( 'integromat_api_term', 'integromat_api_options_term', array(
+            'sanitize_callback' => array( $this, 'sanitize_term_options' ),
+        ) );
         add_settings_section(
             'integromat_api_section_terms',
             __( '', 'integromat_api_term' ),
+            __( 'Terms Metadata Settings', 'integromat-connector' ),
             function () {
                 ?>
                 <p><?php esc_html_e( 'Select terms metadata to include in REST API response', 'integromat_api_term' ); ?></p>
+                <p><?php esc_html_e( 'Select terms metadata to include in REST API response', 'integromat-connector' ); ?></p>
                 <p><a class="uncheck_all" data-status="0">Un/check all</a></p>
                 <?php
 …
             add_settings_field(
                 IWC_FIELD_PREFIX . $meta_item,
                 __( $meta_item, 'integromat_api_term' ),
+                esc_html( $meta_item ),
                 function ( $args ) use ( $meta_item ) {
                     $options = get_option( 'integromat_api_options_term' );
 …
+        }
+    }
+    /**
+     * Sanitize term options
+     *
+     * @param array $input
+     * @return array
+     */
+    public function sanitize_term_options( $input ) {
+        if ( ! is_array( $input ) ) {
+            return array();
+        }
+        $sanitized = array();
+        foreach ( $input as $key => $value ) {
+            $sanitized[ sanitize_key( $key ) ] = sanitize_text_field( $value );
+        }
+        return $sanitized;
+    }
+}

integromat-connector/trunk/settings/object-types/class-user-meta.php

-                      r2783423
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 class Users_Meta extends Meta_Object {
 …
         global $wpdb;
         $this->meta_item_keys = $this->get_meta_items( $wpdb->usermeta );
+        register_setting( 'integromat_api_user', 'integromat_api_options_user' );
+        register_setting( 'integromat_api_user', 'integromat_api_options_user', array(
+            'sanitize_callback' => array( $this, 'sanitize_user_options' ),
+        ) );
         add_settings_section(
             'integromat_api_section_users',
             __( '', 'integromat_api_user' ),
+            __( 'Users Metadata Settings', 'integromat-connector' ),
             function () {
                 ?>
                 <p><?php esc_html_e( 'Select users metadata to include in REST API response', 'integromat_api_user' ); ?></p>
+                <p><?php esc_html_e( 'Select users metadata to include in REST API response', 'integromat-connector' ); ?></p>
                 <p><a class="uncheck_all" data-status="0">Un/check all</a></p>
                 <?php
 …
             add_settings_field(
                 IWC_FIELD_PREFIX . $meta_item,
                 __( $meta_item, 'integromat_api_user' ),
+                esc_html( $meta_item ),
                 function ( $args ) use ( $meta_item ) {
                     $options = get_option( 'integromat_api_options_user' );
 …
+    }
+    /**
+     * Sanitize user options
+     *
+     * @param array $input
+     * @return array
+     */
+    public function sanitize_user_options( $input ) {
+        if ( ! is_array( $input ) ) {
+            return array();
+        }
+        $sanitized = array();
+        foreach ( $input as $key => $value ) {
+            $sanitized[ sanitize_key( $key ) ] = sanitize_text_field( $value );
+        }
+        return $sanitized;
+    }
+}

integromat-connector/trunk/settings/object-types/custom-taxonomy.php

-                      r2883308
+                      r3361722
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 function add_taxonomies() {
+    register_setting( 'integromat_api_taxonomy', 'integromat_api_options_taxonomy' );
+    register_setting( 'integromat_api_taxonomy', 'integromat_api_options_taxonomy', array(
+        'sanitize_callback' => __NAMESPACE__ . '\sanitize_taxonomy_options',
+    ) );
     add_settings_section(
 …
         function () {
             ?>
                 <p><?php esc_html_e( 'Select taxonomies to enable or disable in REST API response.', 'integromat_api_post' ); ?></p>
+                <p><?php esc_html_e( 'Select taxonomies to enable or disable in REST API response.', 'integromat-connector' ); ?></p>
                 <p><a class="uncheck_all" data-status="0">Un/check all</a></p>
             <?php
 …
+    }
+}
+/**
+ * Sanitize taxonomy options
+ *
+ * @param array $input
+ * @return array
+ */
+function sanitize_taxonomy_options( $input ) {
+    if ( ! is_array( $input ) ) {
+        return array();
+    }
+    $sanitized = array();
+    foreach ( $input as $key => $value ) {
+        $sanitized[ sanitize_key( $key ) ] = sanitize_text_field( $value );
+    }
+    return $sanitized;
+}

integromat-connector/trunk/settings/object-types/general.php

-                      r2785241
+                      r3361722
 <?php
 namespace Integromat;
+defined( 'ABSPATH' ) || die( 'No direct access allowed' );
 function add_general_menu() {
+    register_setting( 'integromat_main', 'iwc-logging-enabled' ); // register the same name in settings as before to pick it up in old installations.
+    register_setting( 'integromat_main', 'iwc-logging-enabled', array(
+        'sanitize_callback' => 'sanitize_text_field',
+    ) ); // register the same name in settings as before to pick it up in old installations.
+    // Register API permissions settings in main group for general page
+    register_setting( 'integromat_main', 'iwc_api_permissions_enabled', array(
+        'sanitize_callback' => 'sanitize_text_field',
+        'default' => '0',
+    ) );
+    // Register individual API permission settings in main group
+    $api_permissions = array(
+        'iwc_read_posts', 'iwc_create_posts', 'iwc_edit_posts', 'iwc_delete_posts',
+        'iwc_read_users', 'iwc_create_users', 'iwc_edit_users', 'iwc_delete_users',
+        'iwc_read_comments', 'iwc_create_comments', 'iwc_edit_comments', 'iwc_delete_comments',
+        'iwc_upload_files', 'iwc_read_media', 'iwc_edit_media', 'iwc_delete_media',
+        'iwc_read_terms', 'iwc_create_terms', 'iwc_edit_terms', 'iwc_delete_terms',
+    );
+    foreach ($api_permissions as $permission) {
+        register_setting( 'integromat_main', 'iwc_permission_' . $permission, array(
+            'sanitize_callback' => 'sanitize_text_field',
+            'default' => '0',
+        ) );
+    }
     add_settings_section(
 …
         function ( $args ) {
             $api_token = $args['api_key'];
+            ?>
+                <input type="text"
+                    id="iwc-api-key-value"
+                    readonly="readonly"
+                    value="<?php echo esc_attr( $api_token ); ?>"
+                    class="w-300">
+            $masked_token = str_repeat('•', 20) . substr($api_token, -4); // Show last 4 characters
+            ?>
+                <div class="iwc-api-key-container">
+                    <input type="text"
+                        id="iwc-api-key-value"
+                        readonly="readonly"
+                        value="<?php echo esc_attr( $masked_token ); ?>"
+                        data-masked="<?php echo esc_attr( $masked_token ); ?>"
+                        class="w-300">
+                    <button type="button"
+                        id="iwc-api-key-toggle"
+                        class="button"
+                        data-state="masked">
+                        Reveal
+                    </button>
+                    <button type="button"
+                        id="iwc-api-key-regenerate"
+                        class="button iwc-confirm-btn"
+                        title="Generate a new API key (this will break existing connections)">
+                        Regenerate
+                    </button>
+                </div>
                 <p class="comment">Use this token when creating a new connection in the WordPress app.</p>
             <?php
 …
             'api_key' => \Integromat\Api_Token::get(),
+        )
+    );
+    add_settings_field(
+        'api_permissions_control',
+        'API Permissions',
+        function ( $args ) {
+            $api_permissions_enabled = get_option( 'iwc_api_permissions_enabled', '0' );
+            ?>
+            <div class="iwc-api-permissions-container">
+                <label>
+                    <input type="checkbox" name="iwc_api_permissions_enabled" value="1" <?php checked( $api_permissions_enabled, '1' ); ?> />
+                    Enable granular API permissions (recommended)
+                </label>
+                <div class="notice notice-info" style="margin: 10px 0; padding: 10px; background: #e7f3ff; border: 1px solid #72aee6; border-left: 4px solid #0073aa;">
+                    <p style="margin: 0; font-size: 13px;">
+                        <strong>ℹ️ Important:</strong> If you are using the "Make an API Call" module in your scenarios, DO NOT enable granular permissions.
+                    </p>
+                </div>
+                <div class="notice notice-warning" style="margin: 10px 0; padding: 10px; background: #fff3cd; border: 1px solid #ffeaa7; border-left: 4px solid #ffb900;">
+                    <p style="margin: 0; font-size: 13px;">
+                        <strong>⚠️ Warning:</strong> Changing API permissions may break existing Make scenarios.
+                        Test your scenarios after making changes and ensure required permissions are enabled for your integrations to work properly.
+                    </p>
+                </div>
+                <div id="iwc-permissions-details" style="margin-top: 15px; <?php echo $api_permissions_enabled === '1' ? '' : 'display:none;'; ?>">
+                    <div style="margin-bottom: 10px;">
+                        <button type="button" class="button button-small iwc-perm-enable-all">All</button>
+                        <button type="button" class="button button-small iwc-perm-disable-all">None</button>
+                    </div>
+                    <div class="iwc-permissions-grid" style="display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 15px; border: 1px solid #ddd; padding: 15px; background: #f9f9f9;">
+                        <?php
+                        $permission_groups = array(
+                            'Posts' => array('read', 'create', 'update', 'delete'),
+                            'Users' => array('read', 'create', 'update', 'delete'),
+                            'Comments' => array('read', 'create', 'update', 'delete'),
+                            'Media' => array('read', 'upload', 'update', 'delete'),
+                            'Terms' => array('read', 'create', 'update', 'delete'),
+                        );
+                        foreach ($permission_groups as $group_name => $operations) {
+                            echo '<div class="iwc-permission-group">';
+                            echo '<h4 style="margin: 0 0 8px 0; font-size: 13px;">' . esc_html($group_name) . '</h4>';
+                            foreach ($operations as $operation) {
+                                // Map display name to actual capability name
+                                $capability_operation = ($operation === 'update') ? 'edit' : $operation;
+                                $capability = ($group_name === 'Media' && $operation === 'upload') ? 'iwc_upload_files' : 'iwc_' . $capability_operation . '_' . strtolower($group_name);
+                                $permission_enabled = get_option('iwc_permission_' . $capability, '0');
+                                $is_dangerous = in_array($operation, array('delete', 'upload'));
+                                $color = $is_dangerous ? 'color: #d63384;' : '';
+                                echo '<label style="display: block; margin-bottom: 4px; font-size: 12px; ' . esc_attr($color) . '">';
+                                echo '<input type="checkbox" name="iwc_permission_' . esc_attr($capability) . '" value="1" ' . checked($permission_enabled, '1', false) . ' style="margin-right: 5px;" />';
+                                echo esc_html(ucfirst($operation));
+                                echo '</label>';
+                            }
+                            echo '</div>';
+                        }
+                        ?>
+                    </div>
+                    <p class="description" style="margin-top: 10px;">
+                        <strong style="color: #d63384;">Dangerous permissions:</strong> Delete and upload operations.
+                    </p>
+                </div>
+            </div>
+            <script>
+            jQuery(document).ready(function($) {
+                // Toggle permissions detail visibility
+                $('input[name="iwc_api_permissions_enabled"]').change(function() {
+                    if ($(this).is(':checked')) {
+                        $('#iwc-permissions-details').show();
+                    } else {
+                        $('#iwc-permissions-details').hide();
+                    }
+                });
+                // Bulk controls
+                $('.iwc-perm-enable-all').click(function() {
+                    $('.iwc-permissions-grid input[type="checkbox"]').prop('checked', true);
+                });
+                $('.iwc-perm-disable-all').click(function() {
+                    $('.iwc-permissions-grid input[type="checkbox"]').prop('checked', false);
+                });
+            });
+            </script>
+            <?php
+        },
+        'integromat_main',
+        'integromat_main_section',
+        array()
     );
 …
             $href    = $args['enabled'] ? "href={$url}&_wpnonce={$nonce}" : '';
             ?>
+                <a class="button <?php echo esc_attr( $enabled ); ?>" <?php echo esc_url( $href ); ?> >Download</a>
+                <div class="iwc-log-actions">
+                    <a class="button <?php echo esc_attr( $enabled ); ?>" <?php echo esc_url( $href ); ?> >Download</a>
+                    <button type="button"
+                        id="iwc-log-purge"
+                        class="button iwc-confirm-btn <?php echo esc_attr( $enabled ); ?>"
+                        <?php echo $args['enabled'] ? '' : 'disabled'; ?>
+                        title="Delete all stored log data">
+                        Purge
+                    </button>
+                </div>
                 <p class="iwc-comment ">
                     Although we try to remove them, there could still be some potentially sensitive information (like authentication tokens or passwords) contained in the file.
                     Please check the section between  =SERVER INFO START=  and  =SERVER INFO END= delimiters (located at the start of the file) and possibly remove the sensitive data (or whole section) before sending this file to someone else.
+                    Although we try to remove them, there could still be some potentially sensitive information (like authentication tokens or passwords) contained in the downloaded file.
+                    The downloaded file includes server information and CSV headers that are generated at download time. Please check the section between  =SERVER INFO START=  and  =SERVER INFO END= delimiters (located at the start of the downloaded file) and possibly remove the sensitive data (or whole section) before sending this file to someone else.
                 </p>
             <?php

integromat-connector/trunk/settings/render.php

-                      r2911623
+                      r3361722
     function () {
         add_menu_page(
             'Make',
+            'General Settings',
             'Make',
             'manage_options',
 …
             },
             'data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBzdGFuZGFsb25lPSJubyI/Pgo8IURPQ1RZUEUgc3ZnIFBVQkxJQyAiLS8vVzNDLy9EVEQgU1ZHIDIwMDEwOTA0Ly9FTiIKICJodHRwOi8vd3d3LnczLm9yZy9UUi8yMDAxL1JFQy1TVkctMjAwMTA5MDQvRFREL3N2ZzEwLmR0ZCI+CjxzdmcgdmVyc2lvbj0iMS4wIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciCiB3aWR0aD0iNTEyLjAwMDAwMHB0IiBoZWlnaHQ9IjUxMi4wMDAwMDBwdCIgdmlld0JveD0iMCAwIDUxMi4wMDAwMDAgNTEyLjAwMDAwMCIKIHByZXNlcnZlQXNwZWN0UmF0aW89InhNaWRZTWlkIG1lZXQiPgoKPGcgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMC4wMDAwMDAsNTEyLjAwMDAwMCkgc2NhbGUoMC4xMDAwMDAsLTAuMTAwMDAwKSIKZmlsbD0iIzAwMDAwMCIgc3Ryb2tlPSJub25lIj4KPHBhdGggZD0iTTAgMjU2MCBsMCAtMjU2MCAyNTYwIDAgMjU2MCAwIDAgMjU2MCAwIDI1NjAgLTI1NjAgMCAtMjU2MCAwIDAKLTI1NjB6IG0yNzkwIDEwMDUgYzI2OSAtNTQgMzAzIC02NSAzMTQgLTEwNCAzIC05IC03OSAtNDQ1IC0xODMgLTk2OSAtMTQwCi03MDkgLTE5MyAtOTU3IC0yMDYgLTk3MiAtMTAgLTExIC0zMCAtMjAgLTQ0IC0yMCAtNDcgMCAtNTM2IDEwMSAtNTU4IDExNgotMTMgOCAtMjUgMjQgLTI4IDM3IC0zIDEyIDgwIDQ1MSAxODMgOTc2IDE3MCA4NTYgMTkxIDk1NiAyMTIgOTczIDEyIDEwIDI1CjE4IDI5IDE4IDQgMCAxMzAgLTI1IDI4MSAtNTV6IG0tNzIzIC04OSBjMjIwIC0xMTAgMjYzIC0xMzggMjYzIC0xNzYgMCAtMjQKLTg3MCAtMTc1MyAtODkyIC0xNzcyIC0xMSAtMTAgLTMwIC0xOCAtNDIgLTE4IC0yMyAwIC00ODcgMjMxIC01MTggMjU4IC0xMCA4Ci0xOCAyOSAtMTggNDUgMCAyMCAxNTAgMzI4IDQzNiA4OTYgMjQwIDQ3NiA0NDAgODcxIDQ0NiA4NzggMTIgMTUgNDcgMjEgNzQKMTIgMTEgLTQgMTI0IC01OSAyNTEgLTEyM3ogbTE3NTggODkgbDI1IC0yNCAwIC05NzUgYzAgLTY5MyAtMyAtOTgyIC0xMSAtOTk5Ci0yMCAtNDQgLTQ0IC00NyAtMzI1IC00NyAtMjg2IDAgLTMxNSA1IC0zMjggNTIgLTMgMTMgLTYgNDYxIC02IDk5NiBsMCA5NzMKMjUgMjQgMjQgMjUgMjg2IDAgMjg2IDAgMjQgLTI1eiIvPgo8L2c+Cjwvc3ZnPg=='
+            // 'data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+DQo8IURPQ1RZUEUgc3ZnIFBVQkxJQyAiLS8vVzNDLy9EVEQgU1ZHIDIwMDEwOTA0Ly9FTiIgImh0dHA6Ly93d3cudzMub3JnL1RSLzIwMDEvUkVDLVNWRy0yMDAxMDkwNC9EVEQvc3ZnMTAuZHRkIj4NCjxzdmcgdmVyc2lvbj0iMS4wIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxMDI0LjAwMDAwMHB0IiBoZWlnaHQ9IjEwMjQuMDAwMDAwcHQiIHZpZXdCb3g9IjAgMCAxMDI0LjAwMDAwMCAxMDI0LjAwMDAwMCIgcHJlc2VydmVBc3BlY3RSYXRpbz0ieE1pZFlNaWQgbWVldCI+DQo8bWV0YWRhdGE+DQpDcmVhdGVkIGJ5IHBvdHJhY2UgMS4xMSwgd3JpdHRlbiBieSBQZXRlciBTZWxpbmdlciAyMDAxLTIwMTMNCjwvbWV0YWRhdGE+DQo8ZyB0cmFuc2Zvcm09InRyYW5zbGF0ZSgwLjAwMDAwMCwxMDI0LjAwMDAwMCkgc2NhbGUoMC4xMDAwMDAsLTAuMTAwMDAwKSIgZmlsbD0iI0ZGRkZGRiIgc3Ryb2tlPSJub25lIj4NCjxwYXRoIGQ9Ik00ODU4IDEwMjM1IGMtMiAtMiAtNTAgLTYgLTEwOCAtOSAtNTggLTQgLTExNiAtOCAtMTMwIC0xMSAtMTQgLTIgLTUyIC02IC04NSAtOSAtNjEgLTYgLTc4IC04IC0xOTcgLTI3IGwtNjggLTExIC0xIC0zNiBjMCAtMzkgMCAtMTU5NyAxIC0xNjY4IGwwIC00MSA1MyAxNCBjNTUgMTQgMjk0IDU5IDM2MiA2NyAxMjcgMTYgMjE0IDIwIDQzMCAyMSAyMzkgMCAzNjMgLTcgNDkwIC0yOCAxNyAtMyA1MCAtOSA3NSAtMTIgNTkgLTEwIDU5IC05IDE3OCAtMzUgNTcgLTEyIDEwNiAtMjAgMTA5IC0xNiA3IDcgMTAgMTczNiAyIDE3MzYgLTMgMCAtNTIgNyAtMTEwIDE2IC01NyA5IC0xMjMgMTcgLTE0NiAxOSAtMjMgMiAtNjUgNyAtOTUgMTAgLTI5IDQgLTc1IDkgLTEwMyAxMSAtNjMgNSAtNjUyIDEzIC02NTcgOXoiLz4NCjxwYXRoIGQ9Ik0zMzUwIDk5MjQgYy0zNiAtMTQgLTc3IC0yOSAtOTEgLTM0IC0xNSAtNCAtNDIgLTE1IC02MCAtMjMgLTE5IC04IC04MyAtMzYgLTE0NCAtNjMgLTE2NCAtNzEgLTQ0NiAtMjE4IC01OTAgLTMwNyAtNDAxIC0yNDkgLTcwMiAtNDkwIC0xMDEwIC04MDcgLTEyNiAtMTI5IC0xNjkgLTE3NiAtMjA5IC0yMjUgLTIwIC0yNCAtNDMgLTUwIC00OSAtNTcgLTQzIC00NCAtMjQ0IC0zMTIgLTMyNiAtNDM2IC0xMTQgLTE3MCAtMTU2IC0yMzggLTI1NCAtNDE3IC0xMDggLTE5NyAtMjQyIC00OTUgLTMxMyAtNjk3IC0xNCAtNDAgLTI4IC04MCAtMzEgLTg4IC0zIC04IC03IC0xOSAtOSAtMjUgLTIgLTUgLTE3IC01NSAtMzQgLTExMCAtOTMgLTI5NiAtMTcxIC02NjkgLTE5NiAtOTM1IC0yIC0zMCAtNyAtNjQgLTkgLTc1IC0xMSAtNTQgLTIwIC0yNzUgLTE5IC01MTAgMCAtMjczIDcgLTQwNyAyOSAtNTg1IDIgLTE5IDcgLTYwIDExIC05MCA5IC04NCA2MSAtMzY5IDkwIC00ODkgMTk0IC04MjYgNTczIC0xNTU4IDExNDkgLTIyMjAgNzggLTkwIDI3MSAtMjg2IDM4OSAtMzk2IDE4MCAtMTY3IDQ4MCAtMzk2IDcwOSAtNTQxIDMzNCAtMjEyIDY3MSAtMzczIDEwNjcgLTUxMyAxMDYgLTM4IDM1NyAtMTEzIDQxNyAtMTI2IDEwIC0yIDU2IC0xMyAxMDMgLTI0IDEyMCAtMjggMzQ0IC02OCA0ODAgLTg2IDI1MyAtMzIgMzY0IC0zOSA2NzAgLTM5IDIzOCAwIDQwOCA2IDUwMCAxOSAxNCAyIDUyIDYgODUgMTAgNjEgNiA3NSA4IDE1NSAyMCA5MCAxMyAxMDcgMTYgMjE1IDM2IDEyMiAyMyAyOTMgNjEgMzcwIDgzIDE2MiA0NyAyMDcgNjAgMjc1IDgzIDgwNCAyNjcgMTUwOCA3MTIgMjA5NSAxMzIzIDY4IDcxIDk2IDEwMSAxOTIgMjEwIDMxIDM1IDE1OSAxOTQgMjA2IDI1NSAyNDggMzI2IDUwNyA3ODcgNjY3IDExOTAgODQgMjExIDE4OSA1NDggMjI2IDcyNCA4IDQxIDE3IDc3IDE5IDgxIDQgNiAxMyA1MSAyMCA5NSAxIDExIDEyIDc0IDIzIDE0MCAxMSA2NiAyNiAxNjMgMzIgMjE1IDYgNTIgMTMgMTA5IDE1IDEyNSAyNiAyMDQgMjYgODA1IDAgMTAxMCAtMiAxNyAtNiA1MyAtOSA4MCAtNSA0NiAtMTYgMTI0IC0zMSAyMzAgLTE2IDEwOSAtNDggMjYxIC05MiA0NDAgLTE3NyA3MjIgLTU0OCAxNDQ2IC0xMDM5IDIwMzAgLTE0NiAxNzQgLTM0MyAzNzkgLTQ4NSA1MDUgLTQwIDM2IC04MCA3MiAtODggODAgLTkgOCAtMzkgMzMgLTY2IDU1IC0yOCAyMiAtNTIgNDIgLTU1IDQ1IC02MSA2MSAtMzY2IDI3NyAtNTc1IDQwNyAtOTQgNTggLTI4NyAxNjMgLTQxNSAyMjYgLTIzNiAxMTUgLTUxMyAyMjcgLTUyNyAyMTMgLTEyIC0xMiAtOSAtMTg0NyAyIC0xODYxIDYgLTcgNTQgLTQwIDEwOCAtNzQgMjk3IC0xODUgNTk5IC00NTQgODI3IC03MzYgMzU2IC00MzkgNjE0IC05OTkgNzA2IC0xNTM1IDQgLTI1IDggLTQ3IDkgLTUwIDEgLTMgNSAtMzIgOSAtNjUgNCAtMzIgOSAtNjcgMTEgLTc2IDI2IC0xMzMgMjYgLTc5NyAwIC04MzggLTIgLTQgLTYgLTM1IC05IC02OSAtMyAtMzUgLTggLTY3IC0xMCAtNzAgLTIgLTQgLTcgLTI3IC0xMCAtNTIgLTMgLTI1IC04IC01NCAtMTEgLTY1IC03IC0yOCAtMzYgLTE1NiAtNDAgLTE3OSAtMTEgLTQ4IC0xMDEgLTMyMCAtMTM2IC00MDggLTI2MiAtNjU3IC03MjkgLTEyMjMgLTEzMjkgLTE2MDkgLTk4IC02NCAtMjI1IC0xMzcgLTI5MCAtMTY4IC0yNSAtMTIgLTUyIC0yNSAtNjAgLTMwIC01NCAtMzIgLTMzNSAtMTQ3IC0zODIgLTE1NiAtOSAtMiAtMjUgLTggLTM1IC0xMyAtNTEgLTI4IC00MzUgLTExOSAtNTc4IC0xMzggLTI3IC0zIC02MSAtOCAtNzUgLTEwIC0yMDYgLTI3IC02NzcgLTI3IC04NDAgMCAtMTQgMyAtNDcgNyAtNzUgMTEgLTE1MiAxOSAtNTE1IDEwNiAtNTY3IDEzNSAtMTAgNiAtMjQgMTAgLTMxIDEwIC0yNCAwIC0yNjQgOTggLTM5MCAxNTkgLTI3MCAxMzAgLTUxNiAyOTIgLTc0OCA0OTEgLTgzIDcxIC0yODEgMjY5IC0zNDQgMzQ0IC0yOCAzMiAtNTUgNjQgLTYwIDcwIC0xMDEgMTEwIC0zMDQgNDIxIC00MTIgNjMxIC03NCAxNDQgLTE4MiA0MTQgLTIyMCA1NTAgLTMxIDEwOSAtNjIgMjMzIC03MiAyODUgLTYgMzAgLTE0IDY2IC0xNiA4MCAtNyAzMiAtMjMgMTQzIC0zMCAxOTUgLTI4IDIyNSAtMjggNjYwIDEgODUwIDIgMTcgNiA0NiA4IDY1IDU4IDQ0MiAyNDkgOTUyIDUxMSAxMzYwIDQ3IDc0IDE5OCAyODEgMjI2IDMxMCA4IDggMzYgNDIgNjQgNzUgNzEgODYgMjc3IDI4OSAzNzYgMzcxIDE0NSAxMjEgMjM5IDE4OCA0NTkgMzI4IGwzNCAyMyAxIDkzNiBjMCA1MTYgMCA5MzcgMCA5MzYgMCAwIC0yOSAtMTEgLTY1IC0yNXoiLz4NCjxwYXRoIGQ9Ik00OTY4IDc2NzUgYy0yIC0xIC00MCAtNSAtODQgLTkgLTQ1IC0zIC04OCAtOCAtOTUgLTEwIC04IC0zIC0zNyAtNyAtNjYgLTEwIC0yOCAtMyAtODAgLTEyIC0xMTUgLTIwIC0zNSAtOCAtNzUgLTE3IC05MCAtMjAgLTI3IC00IC0yMzkgLTY3IC0yNDcgLTcyIC0yIC0yIC00IC0zOTE5IC0yIC0zOTcwIDEgLTcgMTEgLTE0IDI0IC0xNyAxMiAtMyA2MCAtMTcgMTA2IC0zMSAxMTIgLTM1IDI2NCAtNjcgMzg2IC04MSAyOCAtNCA2MSAtOSA3NSAtMTIgNTYgLTEyIDQ1MyAtOCA1NTIgNSAxNDcgMTkgMzI4IDU3IDQ1MyA5NCBsMTA3IDMzIDAgMTk1NSBjLTEgMTA3NSAtMSAxOTcxIC0xIDE5OTEgbC0xIDM1IC0xMjcgMzcgYy03MSAxOSAtMTY0IDQzIC0yMDggNTIgLTQ0IDkgLTg3IDE4IC05NSAyMCAtOCAxIC00NCA2IC04MCAxMCAtMzYgNCAtNzQgOSAtODUgMTIgLTIxIDQgLTQwMyAxMiAtNDA3IDh6Ii8+DQo8L2c+DQo8L3N2Zz4='
+        );
+        // Override the default submenu item to change "Make" to "General"
+        add_submenu_page(
+            'integromat',
+            'General Settings',
+            'General',
+            'manage_options',
+            'integromat',
+            function () {
+                if ( ! current_user_can( 'manage_options' ) ) {
+                    return;
+                }
+                settings_errors( 'integromat_api_messages' );
+                include_once __DIR__ . '/template/general_menu.phtml';
+            }
         );
 …
+            }
         );
+        // Security settings page
+        add_submenu_page(
+            'integromat',
+            'Security Settings',
+            'Security',
+            'manage_options',
+            'integromat_security',
+            function () {
+                if ( ! current_user_can( 'manage_options' ) ) {
+                    return;
+                }
+                settings_errors( 'integromat_security_messages' );
+                include_once __DIR__ . '/template/security_settings.phtml';
+            }
+        );
+    }
 );

integromat-connector/trunk/settings/template/customFields.phtml

-                      r2529734
+                      r3361722
+<?php defined( 'ABSPATH' ) || die( 'No direct access allowed' ); ?>
 <h1><?php echo esc_html(get_admin_page_title()); ?></h1>
 <div class="imapie_settings_container">
     <div id="imapie_tabs">
         <ul>
             <li><a href="#tabs-1">Posts</a></li>
             <li><a href="#tabs-2">Comments</a></li>
             <li><a href="#tabs-3">Users</a></li>
             <li><a href="#tabs-4">Terms</a></li>
         </ul>
+<div id="imt-content-panel" class="imapie_settings_container">
+    <!-- Native WordPress Tab Navigation -->
+    <nav class="nav-tab-wrapper" id="iwc-tab-nav" role="tablist">
+        <a href="#iwc-tab-posts" class="nav-tab nav-tab-active" data-tab="posts" role="tab" aria-selected="true" aria-controls="iwc-tab-posts">Posts</a>
+        <a href="#iwc-tab-comments" class="nav-tab" data-tab="comments" role="tab" aria-selected="false" aria-controls="iwc-tab-comments">Comments</a>
+        <a href="#iwc-tab-users" class="nav-tab" data-tab="users" role="tab" aria-selected="false" aria-controls="iwc-tab-users">Users</a>
+        <a href="#iwc-tab-terms" class="nav-tab" data-tab="terms" role="tab" aria-selected="false" aria-controls="iwc-tab-terms">Terms</a>
+    </nav>
+        <div id="tabs-1">
+            <form action="options.php" method="post" id="impaie_form_post">
+                <?php
+                settings_fields('integromat_api_post');
+                do_settings_sections('integromat_api_post');
+                submit_button('Save Settings');
+                ?>
+            </form>
+        </div>
+    <!-- Posts Tab -->
+    <div id="iwc-tab-posts" class="iwc-tab-content iwc-tab-active" role="tabpanel" aria-hidden="false" aria-labelledby="iwc-tab-posts">
+        <form action="options.php" method="post" id="impaie_form_post">
+            <?php
+            settings_fields('integromat_api_post');
+            do_settings_sections('integromat_api_post');
+            submit_button('Save Settings');
+            ?>
+        </form>
+    </div>
+        <div id="tabs-2">
+            <form action="options.php" method="post" id="impaie_form_comment">
+                <?php
+                settings_fields('integromat_api_comment');
+                do_settings_sections('integromat_api_comment');
+                submit_button('Save Settings');
+                ?>
+            </form>
+        </div>
+    <!-- Comments Tab -->
+    <div id="iwc-tab-comments" class="iwc-tab-content" role="tabpanel" aria-hidden="true" aria-labelledby="iwc-tab-comments">
+        <form action="options.php" method="post" id="impaie_form_comment">
+            <?php
+            settings_fields('integromat_api_comment');
+            do_settings_sections('integromat_api_comment');
+            submit_button('Save Settings');
+            ?>
+        </form>
+    </div>
+        <div id="tabs-3">
+            <form action="options.php" method="post" id="impaie_form_user">
+                <?php
+                settings_fields('integromat_api_user');
+                do_settings_sections('integromat_api_user');
+                submit_button('Save Settings');
+                ?>
+            </form>
+        </div>
+    <!-- Users Tab -->
+    <div id="iwc-tab-users" class="iwc-tab-content" role="tabpanel" aria-hidden="true" aria-labelledby="iwc-tab-users">
+        <form action="options.php" method="post" id="impaie_form_user">
+            <?php
+            settings_fields('integromat_api_user');
+            do_settings_sections('integromat_api_user');
+            submit_button('Save Settings');
+            ?>
+        </form>
+    </div>
         <div id="tabs-4">
             <form action="options.php" method="post" id="impaie_form_term">
                 <input type="hidden" name="object_type" value="term">
                 <?php
                 settings_fields('integromat_api_term');
                 do_settings_sections('integromat_api_term');
                 submit_button('Save Settings');
                 ?>
             </form>
         </div>
+    <!-- Terms Tab -->
+    <div id="iwc-tab-terms" class="iwc-tab-content" role="tabpanel" aria-hidden="true" aria-labelledby="iwc-tab-terms">
+        <form action="options.php" method="post" id="impaie_form_term">
+            <input type="hidden" name="object_type" value="term">
+            <?php
+            settings_fields('integromat_api_term');
+            do_settings_sections('integromat_api_term');
+            submit_button('Save Settings');
+            ?>
+        </form>
     </div>
 </div>

integromat-connector/trunk/settings/template/custom_taxonomies.phtml

r2777334	r3361722
	1	<?php defined( 'ABSPATH' ) \|\| die( 'No direct access allowed' ); ?>
1	2	<h1><?php echo esc_html(get_admin_page_title()); ?></h1>
2	3

integromat-connector/trunk/settings/template/general_menu.phtml

r2777334	r3361722
	1	<?php defined( 'ABSPATH' ) \|\| die( 'No direct access allowed' ); ?>
1	2	<h1><?php echo esc_html(get_admin_page_title()); ?></h1>
2	3	<div id="imt-content-panel" class="imapie_settings_container">

Plugin Directory

Context Navigation

1.6.0

Legend:

integromat-connector/trunk/api/authentication.php

integromat-connector/trunk/assets/iwc.css

integromat-connector/trunk/assets/iwc.js

integromat-connector/trunk/class/class-api-token.php

integromat-connector/trunk/class/class-guard.php

integromat-connector/trunk/class/class-logger.php

integromat-connector/trunk/class/class-rest-request.php

integromat-connector/trunk/class/class-rest-response.php

integromat-connector/trunk/class/class-user.php

integromat-connector/trunk/index.php

integromat-connector/trunk/readme.txt

integromat-connector/trunk/settings/class-controller.php

integromat-connector/trunk/settings/class-meta-object.php

integromat-connector/trunk/settings/events.php

integromat-connector/trunk/settings/object-types/class-comments-meta.php

integromat-connector/trunk/settings/object-types/class-post-meta.php

integromat-connector/trunk/settings/object-types/class-term-meta.php

integromat-connector/trunk/settings/object-types/class-user-meta.php

integromat-connector/trunk/settings/object-types/custom-taxonomy.php

integromat-connector/trunk/settings/object-types/general.php

integromat-connector/trunk/settings/render.php

integromat-connector/trunk/settings/template/customFields.phtml

integromat-connector/trunk/settings/template/custom_taxonomies.phtml

integromat-connector/trunk/settings/template/general_menu.phtml

Download in other formats: