Changeset 3398451
- Timestamp:
- 11/19/2025 02:46:30 AM (5 months ago)
- Location:
- fuerte-wp/trunk
- Files:
-
- 8 edited
-
CHANGELOG.md (modified) (1 diff)
-
README.md (modified) (3 diffs)
-
README.txt (modified) (1 diff)
-
SECURITY.md (modified) (1 diff)
-
fuerte-wp.php (modified) (3 diffs)
-
includes/class-fuerte-wp-config.php (modified) (1 diff)
-
includes/class-fuerte-wp-login-url-hider.php (modified) (39 diffs)
-
includes/class-fuerte-wp.php (modified) (4 diffs)
Legend:
- Unmodified
- Added
- Removed
-
fuerte-wp/trunk/CHANGELOG.md
r3395732 r3398451 1 1 # Changelog 2 3 # 1.7.5 / 2025-11-18 4 - Prevent Carbon Fields from booting in Elementor editor to avoid JS conflicts. 2 5 3 6 # 1.7.4 / 2025-11-13 -
fuerte-wp/trunk/README.md
r3395361 r3398451 5 5 </p> 6 6 7 Stronger WP. Limit access to critical WordPress areas, even for other admins.7 Take control of your WordPress security & maintenance. Automate plugin updates, manage administrator access, and prevent broken functionality from outdated plugins without proper oversight. 8 8 9 Fuerte-WP is a WordPress Plugin to enforce certain limits for users with wp-admin administrator access, and to force some other security related tweaks into WordPress.9 Fuerte-WP is the ultimate WordPress security & maintenance solution that combines automated updates with administrator oversight to prevent plugin conflicts before they break your site. 10 10 11 11 Available at the official [WordPress.org plugins repository](https://wordpress.org/plugins/fuerte-wp/). … … 13 13 ## Why? 14 14 15 Because even if you choose to set an user only as Editor, some plugins require users to be an Administrator. And so many Administrators without limits could become an issue, security-wise.15 Is your WordPress site suffering from plugin neglect? Every day, thousands of sites break due to outdated plugins, untested updates, and lack of proper maintenance oversight. 16 16 17 Not only because admins can edit every single configuration inside WordPress. Administrators can also upload plugins or themes, or even edit plugins and theme files (on by default), and with those capabitilies, compromise your WordPress installation. 17 **⚠️ THE REALITY:** 18 - 90% of WordPress site failures are caused by outdated plugins, themes or incompatible updates 19 - Most WordPress downtime happens from untested plugin updates by administrators with too much freedom 20 - Your WordPress installation is only as reliable as your maintenance routine 18 21 19 Fuerte-WP will limit some administrators from access critical WordPress areas that you can define. 22 **🔥 WHY FUERTE-WP IS DIFFERENT:** 20 23 21 Fuerte-WP auto-protect itself and cannot be disabled, unless your account is declared as super user, or you have access to the server (FTP, SFTP, SSH, cPanel/Plesk, etc.).24 Most maintenance plugins just alert you AFTER something breaks. Fuerte-WP PREVENTS issues before they happen, combining automated updates with access control that works together seamlessly. 22 25 23 ## Login Security Deep Dive 26 Fuerte-WP auto-protects itself and cannot be disabled, unless your account is declared as super user, or you have access to the server (FTP, SFTP, SSH, cPanel/Plesk, etc.). 24 27 25 Fuerte-WP's Login Security system provides comprehensive protection against brute force attacks and unauthorized access attempts: 28 ## Auto-Update Management System 26 29 27 ### 🛡️ Attack Prevention 28 - **Rate Limiting**: Configurable thresholds for failed login attempts (default: 5 attempts in 15 minutes) 29 - **Progressive Lockouts**: Increasing lockout durations for repeated security violations 30 - **IP & Username Tracking**: Track and block based on both IP addresses and usernames 31 - **Real-time Monitoring**: Live dashboard showing current login attempts and active lockouts 30 🚨 **Intelligent Update Scheduling & Control** 32 31 33 ### 📊 Monitoring & Management 34 - **Detailed Logging**: Comprehensive logs of all security events with timestamps and user agents 35 - **AJAX Dashboard**: Real-time updates without page refreshes 36 - **Export Functionality**: Export security data for external analysis or backup 37 - **Individual Unblock**: Unblock specific IPs or usernames without clearing all data 32 Fuerte-WP's Auto-Update Management System provides comprehensive control over WordPress maintenance: 38 33 39 ### 🇪🇺 GDPR Compliance 40 - **Privacy Notices**: Customizable GDPR compliance messages on login and registration forms 41 - **Default Messaging**: Built-in privacy notice template if no custom message is provided 42 - **Non-Intrusive Design**: Messages displayed below forms without affecting user experience 34 ### 📅 Update Scheduling 35 - **Intelligent Update Scheduling**: Configurable update frequency (default: every 12 hours) 36 - **Selective Updates**: Choose which plugins, themes, and core components to auto-update 37 - **Compatibility Monitoring**: Track which updates are safe and tested 38 - **Real-Time Update Dashboard**: Live dashboard showing current update status and scheduled maintenance 43 39 44 ### 🔐 Optional: Login URL Obscurity 45 *Security by obscurity - disabled by default for optimal security* 40 ### 👑 Administrator Oversight 41 - **Super User Access**: Designate who has full maintenance control (YOU) while restricting others 42 - **Role-Based Permissions**: Granular control over what different admin roles can modify 43 - **Plugin & Theme Management**: Prevent other admins from installing unstable plugins or untested updates 44 - **Menu Management**: Hide sensitive WordPress settings from inexperienced administrators 46 45 47 For users who want additional obscurity layers, Fuerte-WP offers optional login URL hiding: 46 ### 📊 Maintenance Command Center 47 - **Live Update Monitoring**: Real-time AJAX dashboard shows plugin/theme updates as they happen 48 - **Detailed Maintenance Logs**: Comprehensive logging with timestamps, versions, and compatibility notes 49 - **Export Maintenance Data**: Download update reports for analysis or compliance 50 - **Smart Notifications**: Get alerted about available updates and maintenance tasks 48 51 49 - **Hide wp-login.php**: Prevents direct access to the default WordPress login URL 50 - ** Custom Login Endpoints**: Use either pretty URLs (`/secure-login/`) or query parameters (`?secure-login`)51 - ** WP-Admin Protection**: Automatically blocks direct `/wp-admin/` access for unauthorized users52 - ** Smart Redirection**: Configure custom redirect URLs for blocked login attempts52 ### 🇪🇺 Email Management 53 - **Recovery Email Routing**: Route WordPress admin emails to the right maintenance team 54 - **Custom Sender Configuration**: Professional email sender setup that matches your domain 55 - **Email Audit Trail**: Logging that helps with maintenance communication tracking 53 56 54 **Note**: This feature is disabled by default because true security comes from strong authentication and monitoring, not hiding URLs. Enable only if you understand the trade-offs. 57 ### 🔐 Optional: Admin Access Management 58 *For organizations with multiple administrators* 55 59 56 ## Features 60 - **Custom Login Endpoints**: Create dedicated maintenance access points 61 - **Smart Redirection**: Guide users to appropriate admin areas based on permissions 62 - **WP-Admin Access Control**: Restrict direct `/wp-admin/` access for specific user roles 57 63 58 ### 🛡️ Login Security 59 - **Rate Limiting & Lockouts**: Configurable thresholds for failed login attempts with automatic IP lockouts 60 - **Real-time Monitoring**: AJAX-powered dashboard for monitoring login attempts and managing lockouts 61 - **GDPR Privacy Notice**: Customizable privacy compliance message displayed on login/registration forms 62 - **Hidden Field Validation**: Enhanced CSRF protection with hidden form validation 63 - **Invalid Login Redirect**: Configure where unauthorized login attempts are redirected (404 page or custom URL) 64 - **Login URL Obscurity** (Optional): Obscure your WordPress login URL by hiding `wp-login.php` and `/wp-admin/` access (security by obscurity, disabled by default) 64 **Note**: These features are optional and should be used based on your specific organizational needs. 65 65 66 ### 🔐 Access Control & Restrictions 67 - **Super User System**: Configure users who bypass all restrictions and maintain full access 68 - **Role-Based Restrictions**: Limit what different administrator roles can access and modify 69 - **Plugin & Theme Protection**: Prevent installation, deletion, and editing of plugins/themes by non-super users 70 - **Menu Management**: Remove or restrict access to specific WordPress admin menu items 71 - **Page Access Control**: Restrict access to sensitive WordPress admin areas 72 - **User Account Protection**: Prevent editing or deletion of super user accounts 73 - **ACF Integration**: Restrict access to Advanced Custom Fields editor interface 66 ## Key Features 74 67 75 ### ⚙️ WordPress Core Tweaks76 - **Auto -Update Management**: Configurable automaticupdates for core, plugins, themes, and translations77 - **API Security**: Disable XML-RPC, Application Passwords, and restrictREST API access68 ### ⚙️ Advanced WordPress Optimization 69 - **Automated Update Management**: Background updates for core, plugins, themes, and translations 70 - **API Optimization**: Disable unused XML-RPC endpoints and optimize REST API access 78 71 - **Email Configuration**: Customize WordPress recovery and sender email addresses 79 - **Security Hardening**: Disable file editors, force strong passwords, and block weak password usage 80 - **Admin Bar Control**: Disable WordPress admin bar for specific user roles 81 - **Customizer Restrictions**: Lock down Customizer features like CSS editor and theme modifications 72 - **Performance Hardening**: Disable unused features, optimize database performance 73 - **Background Processing**: Maintenance tasks that don't slow down your site 82 74 83 ### 🚀 Performance & Monitoring 84 - **Login Logging**: Comprehensive logging of all login attempts, failed authentications, and security events 85 - **Export Capabilities**: Export security data and logs for analysis 86 - **Database Optimization**: Automated cleanup and maintenance of security logs 87 - **Cron-Based Updates**: Background auto-updates that don't impact site performance 75 ### 👑 Administrator Oversight System 76 - **Super User Control**: Designate who has full maintenance access while restricting others 77 - **Role-Based Permissions**: Granular control over what different admin roles can modify 78 - **Plugin & Theme Management**: Prevent other admins from installing unstable plugins or untested updates 79 - **Menu Management**: Hide sensitive WordPress settings from inexperienced administrators 80 - **User Account Protection**: Protect maintenance accounts from being modified by other admins 81 82 ### 📊 Maintenance Command Center 83 - **Live Update Monitoring**: Real-time AJAX dashboard shows plugin/theme updates as they happen 84 - **Detailed Maintenance Logs**: Comprehensive logging with timestamps, versions, and compatibility notes 85 - **Export Maintenance Data**: Download update reports for analysis or compliance 86 - **Smart Notifications**: Get alerted about available updates and maintenance tasks 87 - **One-Click Management**: Instantly schedule updates, clear logs, or manage maintenance tasks 88 88 89 89 ### 🔧 Developer Features … … 93 93 - **Multisite Support**: Compatible with WordPress multisite installations 94 94 95 ## How to install 95 **🔒 WHY CHOOSE FUERTE-WP?** 96 96 97 1. Install Fuerte-WP from WordPress repository. Plugins > Add New > Search for: Fuerte-WP. Activate it. 98 2. Configure Fuerte-WP at Settings > Fuerte-WP. 99 3. **Setup Login Security**: Configure your custom login URL and review security settings. 100 4. **Configure Super Users**: Add your email address to the super users list to maintain full access. 101 5. **Review Restrictions**: Customize which admin areas and features to restrict for other administrators. 102 6. Enjoy enhanced WordPress security! 97 ✅ **PROACTIVE MAINTENANCE** - Prevents plugin conflicts BEFORE they break your site 98 ✅ **INTELLIGENT UPDATE MANAGEMENT** - Real-time update scheduling and compatibility checking 99 ✅ **ADMIN OVERSIGHT CONTROL** - Controls what other administrators can modify 100 ✅ **EMAIL MANAGEMENT** - Built-in email routing and configuration features 101 ✅ **PERFORMANCE OPTIMIZED** - Won't slow down your website 102 ✅ **MULTISITE COMPATIBLE** - Works on single sites and WordPress networks 103 ✅ **SELF-PROTECTING** - Cannot be disabled by non-super users 104 ✅ **DEVELOPER FRIENDLY** - File-based configuration for mass deployment 105 ✅ **SMART MAINTENANCE APPROACH** - Focuses on prevention over reactive fixes 106 107 **🎯 PERFECT FOR:** 108 - Multi-author blogs and news sites with frequent content updates 109 - Client websites built by agencies that need reliable maintenance 110 - E-commerce stores with critical uptime requirements 111 - Educational institutions with multiple WordPress installations 112 - Enterprise WordPress deployments requiring strict maintenance policies 113 - Anyone serious about WordPress maintenance and reliability 114 115 ## How to Install 116 117 **⚡ INSTALL IN SECONDS, MAINTAIN FOR YEARS** 118 119 1. Click "Install Now" or search for "Fuerte-WP" in your WordPress dashboard 120 2. Activate the plugin 121 3. Visit Settings > Fuerte-WP to configure the settings as you like. Defaults are good if you want to leave them like that 122 4. Congratulations! Your WordPress site is now professionally maintained. 103 123 104 124 ### Harder configuration (optional) -
fuerte-wp/trunk/README.txt
r3396386 r3398451 2 2 Contributors: tcattd 3 3 Tags: maintenance, security, admin, plugins, updates 4 Stable tag: 1.7. 44 Stable tag: 1.7.5 5 5 Requires at least: 6.0 6 6 Tested up to: 6.9 -
fuerte-wp/trunk/SECURITY.md
r3395732 r3398451 5 5 | Version | Supported | 6 6 | ------- | ------------------ | 7 | 1.7. 4| :white_check_mark: |8 | <1.7. 4| :x: |7 | 1.7.5 | :white_check_mark: | 8 | <1.7.5 | :x: | 9 9 10 10 ## Reporting a Vulnerability -
fuerte-wp/trunk/fuerte-wp.php
r3395732 r3398451 6 6 * Plugin URI: https://github.com/EstebanForge/Fuerte-WP 7 7 * Description: Stronger WP. Limit access to critical WordPress areas, even other for admins. 8 * Version: 1.7. 48 * Version: 1.7.5 9 9 * Author: Esteban Cuevas 10 10 * Author URI: https://actitud.xyz … … 32 32 */ 33 33 define('FUERTEWP_PLUGIN_BASE', plugin_basename(__FILE__)); 34 define('FUERTEWP_VERSION', '1.7. 4');34 define('FUERTEWP_VERSION', '1.7.5'); 35 35 define('FUERTEWP_PATH', realpath(plugin_dir_path(__FILE__)) . '/'); 36 36 define('FUERTEWP_URL', trailingslashit(plugin_dir_url(__FILE__))); … … 58 58 if (file_exists(FUERTEWP_PATH . 'includes/helpers.php')) { 59 59 require_once FUERTEWP_PATH . 'includes/helpers.php'; 60 }61 62 // Elementor has JS issues with Carbon-Fields being loaded while in his editor.63 if (isset($_REQUEST['action']) && $_REQUEST['action'] == 'elementor') {64 return;65 60 } 66 61 -
fuerte-wp/trunk/includes/class-fuerte-wp-config.php
r3395732 r3398451 436 436 $underscored_name = '_fuertewp_login_db_version'; 437 437 if (!get_option($underscored_name)) { 438 $current_version = defined('FUERTEWP_VERSION') ? FUERTEWP_VERSION : '1. 7.4';438 $current_version = defined('FUERTEWP_VERSION') ? FUERTEWP_VERSION : '1.0.0'; 439 439 update_option($underscored_name, $current_version); // Set to current plugin version 440 440 $cleanup_results['preserved_fuertewp_options']++; -
fuerte-wp/trunk/includes/class-fuerte-wp-login-url-hider.php
r3395361 r3398451 8 8 * 9 9 * @link https://actitud.xyz 10 * @since 1. 8.010 * @since 1.7.0 11 11 * 12 12 * @author Esteban Cuevas <esteban@attitude.cl> … … 19 19 * Login URL Hider class for hiding wp-login.php access. 20 20 * 21 * @since 1. 8.021 * @since 1.7.0 22 22 */ 23 23 class Fuerte_Wp_Login_URL_Hider … … 26 26 * Singleton instance. 27 27 * 28 * @since 1. 8.028 * @since 1.7.0 29 29 * @var Fuerte_Wp_Login_URL_Hider 30 30 */ … … 34 34 * WordPress database instance. 35 35 * 36 * @since 1. 8.036 * @since 1.7.0 37 37 * @var wpdb 38 38 */ … … 42 42 * Configuration cache. 43 43 * 44 * @since 1. 8.044 * @since 1.7.0 45 45 * @var array 46 46 */ … … 50 50 * WordPress request path. 51 51 * 52 * @since 1. 8.052 * @since 1.7.0 53 53 * @var string 54 54 */ … … 58 58 * Whether this is a valid login request. 59 59 * 60 * @since 1. 8.060 * @since 1.7.0 61 61 * @var bool 62 62 */ … … 66 66 * Get singleton instance. 67 67 * 68 * @since 1. 8.068 * @since 1.7.0 69 69 * @return Fuerte_Wp_Login_URL_Hider 70 70 */ … … 80 80 * Initialize Login URL Hider. 81 81 * 82 * @since 1. 8.082 * @since 1.7.0 83 83 */ 84 84 private function __construct() … … 98 98 * Initialize WordPress hooks. 99 99 * 100 * @since 1. 8.0100 * @since 1.7.0 101 101 * @return void 102 102 */ … … 146 146 * Check if login URL hiding is enabled. 147 147 * 148 * @since 1. 8.0148 * @since 1.7.0 149 149 * @return bool True if enabled, false otherwise 150 150 */ … … 180 180 * Get invalid login redirect configuration. 181 181 * 182 * @since 1. 8.0182 * @since 1.7.0 183 183 * @return array Redirect configuration with 'type' and 'url' keys 184 184 */ … … 221 221 * Get custom login slug. 222 222 * 223 * @since 1. 8.0223 * @since 1.7.0 224 224 * @return string Custom login slug 225 225 */ … … 248 248 * Get login URL type. 249 249 * 250 * @since 1. 8.0250 * @since 1.7.0 251 251 * @return string 'query_param' or 'pretty_url' 252 252 */ … … 275 275 * Check if WP-Admin protection is enabled. 276 276 * 277 * @since 1. 8.0277 * @since 1.7.0 278 278 * @return bool True if protection is enabled 279 279 */ … … 294 294 * Check if current user should bypass restrictions. 295 295 * 296 * @since 1. 8.0296 * @since 1.7.0 297 297 * @return bool True if user should bypass, false otherwise 298 298 */ … … 313 313 * Generate custom login URL. 314 314 * 315 * @since 1. 8.0315 * @since 1.7.0 316 316 * @param string $scheme URL scheme 317 317 * @return string Custom login URL … … 337 337 * Filter site URLs to replace login URLs. 338 338 * 339 * @since 1. 8.0339 * @since 1.7.0 340 340 * @param string $url The complete site URL 341 341 * @param string $path Path relative to the site URL … … 361 361 * Filter network site URLs. 362 362 * 363 * @since 1. 8.0363 * @since 1.7.0 364 364 * @param string $url The complete network site URL 365 365 * @param string $path Path relative to the network site URL … … 383 383 * Filter wp redirects. 384 384 * 385 * @since 1. 8.0385 * @since 1.7.0 386 386 * @param string $location The redirect URL 387 387 * @param int $status HTTP status code … … 404 404 * Filter login URL. 405 405 * 406 * @since 1. 8.0406 * @since 1.7.0 407 407 * @param string $login_url Login URL 408 408 * @param string $redirect URL to redirect to after login … … 422 422 * Filter logout URL. 423 423 * 424 * @since 1. 8.0424 * @since 1.7.0 425 425 * @param string $logout_url Logout URL 426 426 * @param string $redirect URL to redirect to after logout … … 439 439 * Filter lost password URL. 440 440 * 441 * @since 1. 8.0441 * @since 1.7.0 442 442 * @param string $lostpassword_url Lost password URL 443 443 * @param string $redirect URL to redirect to after password reset … … 456 456 * Filter registration URL. 457 457 * 458 * @since 1. 8.0458 * @since 1.7.0 459 459 * @param string $register_url Registration URL 460 460 * @return string Filtered registration URL … … 472 472 * Add hidden field to login form. 473 473 * 474 * @since 1. 8.0474 * @since 1.7.0 475 475 * @return void 476 476 */ … … 484 484 * Validate hidden field during authentication. 485 485 * 486 * @since 1. 8.0486 * @since 1.7.0 487 487 * @param WP_User|WP_Error|null $user User object or error 488 488 * @param string $username Username … … 523 523 * Handle login initialization. 524 524 * 525 * @since 1. 8.0525 * @since 1.7.0 526 526 * @return void 527 527 */ … … 544 544 * Protect WP-Admin access. 545 545 * 546 * @since 1. 8.0546 * @since 1.7.0 547 547 * @return void 548 548 */ … … 590 590 } 591 591 592 592 593 593 /** 594 594 * Handle custom login URL requests via parse_request. 595 595 * 596 * @since 1. 8.0596 * @since 1.7.0 597 597 * @param WP $wp WordPress request object 598 598 * @return void … … 634 634 * Display the login form directly. 635 635 * 636 * @since 1. 8.0636 * @since 1.7.0 637 637 * @return void 638 638 */ … … 676 676 * Check if URL is login related. 677 677 * 678 * @since 1. 8.0678 * @since 1.7.0 679 679 * @param string $url URL to check 680 680 * @return bool True if login related … … 688 688 * Replace login URL in given URL. 689 689 * 690 * @since 1. 8.0690 * @since 1.7.0 691 691 * @param string $url Original URL 692 692 * @param string|null $scheme URL scheme … … 728 728 * Check if this is a custom login URL request. 729 729 * 730 * @since 1. 8.0730 * @since 1.7.0 731 731 * @param array $request Parsed request array 732 732 * @return bool True if custom login URL … … 763 763 * Check if this is a WP-Admin request. 764 764 * 765 * @since 1. 8.0765 * @since 1.7.0 766 766 * @return bool True if WP-Admin request 767 767 */ … … 775 775 * Redirect invalid login attempts. 776 776 * 777 * @since 1. 8.0777 * @since 1.7.0 778 778 * @return void 779 779 */ … … 803 803 * Get client IP address. 804 804 * 805 * @since 1. 8.0805 * @since 1.7.0 806 806 * @return string Client IP address 807 807 */ … … 827 827 * Early WP-Admin access check before WordPress core redirects. 828 828 * 829 * @since 1. 8.0829 * @since 1.7.0 830 830 * @return void 831 831 */ … … 860 860 * Check if current request is valid. 861 861 * 862 * @since 1. 8.0862 * @since 1.7.0 863 863 * @return bool True if valid login request 864 864 */ … … 871 871 * Clear configuration cache. 872 872 * 873 * @since 1. 8.0873 * @since 1.7.0 874 874 * @return void 875 875 */ -
fuerte-wp/trunk/includes/class-fuerte-wp.php
r3395361 r3398451 84 84 85 85 $this->run_enforcer(); 86 87 // Handle Elementor conflicts 88 $this->define_elementor_hooks(); 86 89 } 87 90 … … 293 296 'add_action_links', 294 297 ); 298 299 // Fix Carbon Fields admin styles incorrectly loading in Gutenberg iframe 300 $this->loader->add_action('wp_enqueue_scripts', $this, 'fix_carbon_fields_gutenberg_styles', 1); 301 $this->loader->add_action('admin_enqueue_scripts', $this, 'fix_carbon_fields_gutenberg_styles', 1); 302 $this->loader->add_action('enqueue_block_assets', $this, 'fix_carbon_fields_gutenberg_styles', 1); 303 $this->loader->add_filter('style_loader_tag', $this, 'prevent_carbon_fields_styles', 10, 3); 295 304 } 296 305 } … … 325 334 326 335 /** 336 * Register all of the hooks related to Elementor compatibility 337 * 338 * @since 1.7.5 339 */ 340 private function define_elementor_hooks() 341 { 342 // Handle Elementor conflicts by preventing Carbon Fields asset loading 343 $this->loader->add_action('admin_enqueue_scripts', $this, 'handle_elementor_assets', 9999); 344 $this->loader->add_action('admin_print_footer_scripts', $this, 'handle_elementor_assets', 1); 345 } 346 347 /** 327 348 * Run the loader to execute all of the hooks with WordPress. 328 349 * … … 371 392 return $this->version; 372 393 } 394 395 /** 396 * Fix Carbon Fields admin styles incorrectly loading in Gutenberg iframe. 397 * 398 * @since 1.7.5 399 */ 400 public function fix_carbon_fields_gutenberg_styles() 401 { 402 global $wp_styles; 403 404 $screen = get_current_screen(); 405 $is_block_editor = ($screen && $screen->is_block_editor()); 406 407 // Check if we're in block editor context (including iframe) 408 $is_gutenberg = ($is_block_editor || (defined('REST_REQUEST') && REST_REQUEST) || (isset($_GET['context']) && $_GET['context'] === 'edit')); 409 410 if ($is_gutenberg) { 411 // Prevent Carbon Fields styles from being enqueued in block editor 412 $blocked_styles = array( 413 'carbon-fields-core', 414 'carbon-fields-metaboxes', 415 'carbon-fields-blocks' 416 ); 417 418 foreach ($blocked_styles as $style) { 419 if (isset($wp_styles->registered[$style])) { 420 wp_dequeue_style($style); 421 wp_deregister_style($style); 422 } 423 } 424 } 425 } 426 427 /** 428 * Prevent Carbon Fields styles from being registered in the first place. 429 * 430 * @since 1.7.5 431 * @param string $tag The style tag. 432 * @param string $handle The style handle. 433 * @param string $src The style source. 434 * @return string Modified tag or original. 435 */ 436 public function prevent_carbon_fields_styles($tag, $handle, $src) 437 { 438 $blocked_handles = array( 439 'carbon-fields-core', 440 'carbon-fields-metaboxes', 441 'carbon-fields-blocks' 442 ); 443 444 if (in_array($handle, $blocked_handles)) { 445 $screen = get_current_screen(); 446 if ($screen && $screen->is_block_editor()) { 447 return ''; // Don't output the style tag 448 } 449 } 450 451 return $tag; 452 } 453 454 /** 455 * Detect if we're in Elementor editor context. 456 * 457 * Checks for: wp-admin + post.php + action=elementor 458 * Note: get_current_screen() is not available during early bootstrap 459 * 460 * @since 1.7.5 461 * @return bool True if in Elementor editor context 462 */ 463 private function is_elementor_editor_context() 464 { 465 // Must be in admin area 466 if (!is_admin()) { 467 return false; 468 } 469 470 // Must have action=elementor parameter 471 if (!isset($_GET['action']) || $_GET['action'] !== 'elementor') { 472 return false; 473 } 474 475 // Must be on a post/edit screen 476 global $pagenow; 477 if ($pagenow !== 'post.php') { 478 return false; 479 } 480 481 // Must have a post ID parameter (required for Elementor editor) 482 if (!isset($_GET['post']) || !is_numeric($_GET['post'])) { 483 return false; 484 } 485 486 return true; 487 } 488 489 /** 490 * Handle Elementor conflicts by preventing Carbon Fields assets from being enqueued 491 * 492 * @since 1.7.5 493 */ 494 public function handle_elementor_assets() 495 { 496 // Only apply in Elementor editor context 497 if (!$this->is_elementor_editor_context()) { 498 return; 499 } 500 501 // Debug: Log when this function is called 502 error_log('[Fuerte-WP] handle_elementor_assets method triggered in Elementor context'); 503 504 // Remove Carbon Fields asset enqueuing hooks 505 if (class_exists('\Carbon_Fields\Carbon_Fields') && \Carbon_Fields\Carbon_Fields::is_booted()) { 506 $loader = \Carbon_Fields\Carbon_Fields::resolve('loader'); 507 508 // Remove the asset enqueue hook 509 remove_action('admin_print_footer_scripts', [$loader, 'enqueue_assets'], 9); 510 remove_action('admin_print_footer_scripts', [$loader, 'initialize_ui'], 9999); 511 512 // Also remove container initialization to prevent data from being generated 513 remove_action('carbon_fields_fields_registered', [$loader, 'initialize_containers']); 514 } 515 516 // Directly dequeue and deregister all Carbon Fields assets 517 $carbon_assets = [ 518 'carbon-fields-vendor', 519 'carbon-fields-core', 520 'carbon-fields-metaboxes', 521 'carbon-fields-blocks' 522 ]; 523 524 foreach ($carbon_assets as $asset) { 525 wp_dequeue_script($asset); 526 wp_dequeue_style($asset); 527 wp_deregister_script($asset); 528 wp_deregister_style($asset); 529 } 530 } 373 531 }
Note: See TracChangeset
for help on using the changeset viewer.