Skip to content

Fix download MCP blocked when toggle was off #3569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Crabcyborg merged 1 commit into from
Oct 13, 2026
Merged

Fix download MCP blocked when toggle was off #3569

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions classes/controllers/FrmMcpSkillEnvController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,18 @@ public static function download() {

self::verify_nonce( self::DOWNLOAD_ACTION );

if ( FrmAppHelper::get_post_param( 'frm_mcp_settings_shown', 0, 'absint' ) ) {
$settings = FrmAppHelper::get_settings();
$settings->mcp = FrmAppHelper::get_post_param( 'frm_mcp', array(), 'absint' ) ? 1 : 0;
$settings->store();
FrmMcpController::reset();
}

// MCP may have been enabled after init skipped loading the adapter.
if ( FrmMcpController::is_enabled() ) {
FrmMcpCompat::load_adapter();
}

if (
! FrmMcpController::is_enabled() ||
! FrmMcpCompat::is_usable() ||
Expand Down
84 changes: 84 additions & 0 deletions tests/phpunit/abilities/test_FrmMcpSkillEnvController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,90 @@
*/
class test_FrmMcpSkillEnvController extends FrmUnitTest {

/**
* Check submitted toggle states and authorization boundaries for downloads.
*
* @return void
*/
public function test_download_saves_submitted_mcp_setting() {
foreach ( self::get_download_scenarios() as $scenario ) {
$this->check_download_settings( $scenario[0], $scenario[1], $scenario[2], $scenario[3], $scenario[4] );
}
}

/**
* Downloading saves only the submitted MCP toggle after authorization.
*
* Application Passwords are disabled to stop before the file response exits.
*
* @param int $initial Saved MCP value before downloading.
* @param array $posted Submitted MCP settings.
* @param int $expected Saved MCP value after downloading.
* @param string $role Role of the downloading user.
* @param bool $valid_nonce Whether the download nonce is valid.
*
* @return void
*/
private function check_download_settings( $initial, $posted, $expected, $role, $valid_nonce ) {
$admin_id = $this->factory->user->create( array( 'role' => 'administrator' ) );
wp_set_current_user( $admin_id );
FrmAppHelper::maybe_add_permissions();
$user_id = $this->factory->user->create( array( 'role' => $role ) );
wp_set_current_user( $user_id );

$settings = FrmAppHelper::get_settings();
$original_mcp = $settings->mcp;
$original_post = $_POST;
$settings->mcp = $initial;
$settings->store();
FrmMcpController::reset();
$this->assertSame( (bool) $initial, FrmMcpController::is_enabled(), 'The initial MCP setting should be cached.' );

@deepsource-io deepsource-io Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Call to an undefined method test_FrmMcpSkillEnvController::assertSame()


The method you are trying to call is not defined, which can result in a fatal error.

$original_currency = $settings->currency;

$_POST = $posted;
$_POST[ FrmMcpSkillEnvController::DOWNLOAD_ACTION . '_nonce' ] = $valid_nonce ? wp_create_nonce( FrmMcpSkillEnvController::DOWNLOAD_ACTION ) : 'invalid';
add_filter( 'wp_is_application_passwords_available', '__return_false' );

try {
FrmMcpSkillEnvController::download();
$this->fail( 'The download should stop before creating a credential.' );

@deepsource-io deepsource-io Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Call to an undefined method test_FrmMcpSkillEnvController::fail()


The method you are trying to call is not defined, which can result in a fatal error.

} catch ( WPDieException $exception ) {

@deepsource-io deepsource-io Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caught class WPDieException not found


The Exception class you are trying to use seems to be invalid. This will result in a run time fatal error.

$this->assertSame( 403, $exception->getCode(), 'The blocked download should return a forbidden response.' );

@deepsource-io deepsource-io Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Call to an undefined method test_FrmMcpSkillEnvController::assertSame()


The method you are trying to call is not defined, which can result in a fatal error.

@deepsource-io deepsource-io Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Call to method getCode() on an unknown class WPDieException


The method you are trying to call is not defined, which can result in a fatal error.

$this->assertSame( $expected, $settings->mcp, 'The submitted toggle should be saved only after authorization.' );

@deepsource-io deepsource-io Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Call to an undefined method test_FrmMcpSkillEnvController::assertSame()


The method you are trying to call is not defined, which can result in a fatal error.

$this->assertSame( $expected, get_option( 'frm_options' )->mcp, 'The MCP setting should persist for the next request.' );

@deepsource-io deepsource-io Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Call to an undefined method test_FrmMcpSkillEnvController::assertSame()


The method you are trying to call is not defined, which can result in a fatal error.

$this->assertSame( (bool) $expected, FrmMcpController::is_enabled(), 'The cached MCP setting should reflect the saved value.' );

@deepsource-io deepsource-io Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Call to an undefined method test_FrmMcpSkillEnvController::assertSame()


The method you are trying to call is not defined, which can result in a fatal error.

$this->assertSame( $original_currency, $settings->currency, 'Other settings should remain unchanged.' );

@deepsource-io deepsource-io Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Call to an undefined method test_FrmMcpSkillEnvController::assertSame()


The method you are trying to call is not defined, which can result in a fatal error.

$this->assertSame( array(), FrmMcpSkillEnvController::get_passwords( $user_id ), 'A blocked download should not create a credential.' );

@deepsource-io deepsource-io Bot Oct 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Call to an undefined method test_FrmMcpSkillEnvController::assertSame()


The method you are trying to call is not defined, which can result in a fatal error.

} finally {
$_POST = $original_post;
remove_filter( 'wp_is_application_passwords_available', '__return_false' );
$settings->mcp = $original_mcp;
$settings->store();
FrmMcpController::reset();
}
}

/**
* Submitted toggle states and authorization boundaries for downloads.
*
* @return array
*/
private static function get_download_scenarios() {
$enabled = array(
'frm_mcp_settings_shown' => 1,
'frm_mcp' => array( 1 ),
);

return array(
'unsaved enabled toggle' => array( 0, $enabled, 1, 'administrator', true ),
'unchecked toggle' => array( 1, array( 'frm_mcp_settings_shown' => 1 ), 0, 'administrator', true ),
'no settings submitted' => array( 1, array(), 1, 'administrator', true ),
'no settings marker' => array( 0, array( 'frm_mcp' => array( 1 ) ), 0, 'administrator', true ),
'invalid nonce' => array( 0, $enabled, 0, 'administrator', false ),
'unauthorized user' => array( 0, $enabled, 0, 'subscriber', true ),
);
}

/**
* Values containing shell syntax stay literal when the skill sources the file.
*
Expand Down
Loading