FTP deploy timed out due to Hostinger blocking FTPS from external CI
servers. Switched to appleboy/scp-action using SSH on port 65002,
which is more reliable for CI/CD pipelines.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The deploy workflow references CI via `uses: ./.github/workflows/ci.yml`
which requires the CI workflow to have an `on: workflow_call` trigger.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add missing WordPress function stubs (current_user_can, esc_url_raw,
is_user_logged_in, get_current_user_id) and load LLM class in test
bootstrap so AdminTest model validation and RestApiTest permission
checks work correctly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- analytics.php line 38: mismatched quotes on session_id array key
- analytics.php line 246: invalid escape before concatenation operator
- analytics.php line 250: COuNT typo → COUNT
- analytics.php line 252: NULIF typo → NULLIF
- rest-api.php line 54: stray # commenting out foreach variable
These bugs predate the content filter feature but were caught by the
new CI pipeline's PHP lint job.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Two-tier filtering during article fetch: keyword/pattern rules as a fast
first pass, then optional LLM classification for borderline cases via
OpenRouter. Configurable sensitivity (strict/moderate/lenient), editable
keyword lists, blocked domain list, and admin stats display. Includes
30 unit tests covering domain blocking, title/body keywords, URL paths,
edge cases, and prompt structure.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Introduces GitHub Actions workflows for continuous integration and
deployment. CI runs PHP linting (7.4, 8.1, 8.3), PHPCS with WordPress
coding standards, PHPUnit tests across PHP versions, and JS syntax
checks. Deployment to Hostinger via FTPS triggers on push to main
after all CI checks pass, with optional LiteSpeed cache purge.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The prepareCanvas wrapper fix (fee4f0f) required a version bump to
bust the LiteSpeed server cache that was serving the old admin-script.js
at the ?ver=1.2.0 URL. A Code Snippets filter on the live server now
rewrites the script version to 1.2.1-<timestamp>.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Chart.js with responsive:true + maintainAspectRatio:false requires
the parent container to have an explicit height. Without it, charts
grow unbounded. The prepareCanvas() helper wraps each canvas in a
height-constrained div before Chart initialization.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Charts were not rendering properly because admin-script.js targeted a
non-existent canvas ID (peptide-analytics-chart) instead of the actual
IDs (pn-trends-chart, pn-devices-chart, pn-sources-chart). The script
also used hardcoded demo data instead of the peptideNewsDashboardData
object exported from PHP.
Changes:
- Rewrite admin-script.js to initialise all three dashboard charts
(line, doughnut, bar) using the correct canvas IDs and PHP data
- Set maintainAspectRatio: false so explicit canvas heights are respected
- Add max-height CSS constraint on chart canvases to prevent unbounded
vertical growth
- Sync JS/CSS to admin/ root directory to match PEPTIDE_NEWS_PLUGIN_URL
asset path
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use $wpdb->prepare() with esc_like() in clear_article_cache()
- Add strict base64_decode() validation with error handling
- Add isset()/is_array()/is_string() checks for nested array access
- Add wp_http_validate_url() SSRF prevention on all image downloads
- Add limit_response_size (5MB) on image URL downloads
- Set chmod 0644 after file_put_contents()
- Use $wpdb->prepare() with esc_like() in clear_article_cache()
- Add wp_http_validate_url() SSRF prevention in download_thumbnail()
- Add limit_response_size (5MB) on image downloads
- Set chmod 0644 after file_put_contents()
- Add transient-based concurrent fetch lock
