Drop the legacy credits_added message label per the hard-cut rule, switch
three remaining Font Awesome 4 icons to FA5 solid, and align two widget
contracts with the badge rule grouping and renderer list from fc04bf65.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add AKSRT\Core\Color::sanitize($value, $allow_alpha) as the single PHP
color sanitizer; replace sanitize_hex_color calls and per-class regexes
(FloatButtons, FieldSchema, ThemeSearch, icon cards, TicketStatusService)
- SchemaProvider / ControllerBase sanitize `color` fields as colors;
alpha kept only when the schema sets showAlpha
- Split SchemaProvider OAuth validation and option matching into sibling
traits to stay under the 1000-line limit
- Add AksColorPicker.vue + utils/color.js mirroring the PHP rules; AksField,
FloatBtnCommonFields and TicketStatusPanel use it
- Widget background color input now uses wpColorPicker
- Remove dead AksCompositeField dimensions/spacing/background branches and
the unused Gutenberg ColorPicker var
- Add color-unification contract test; update harness requires and tests
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The token relay still stood between the button and the file: every click
issued a short-lived token URL, so downloads never reached the real
source address directly.
- Render direct anchors (target=_blank) to the raw source URL in the
download box and the paid card, with inline extract-code buttons
- Retire the relay: delete Content\Download plus its init wiring, header
query-var branch and SEO noindex branch, and drop the dead
download-request flow from cms-download.js (cashier, scan-pay and
error views stay)
- Keep the dl_token table and the download logs page as read-only
history; unscheduling of the orphaned cleanup cron is preserved
The reference theme has no pagination exclusion: /tag/x/page/2 and
friends still show the header slider (and its icon cards). Drop the
local paged>1 early return so the display scope matches.
wp_kses_post() strips the custom <badge> element, so icon card title/desc
lost admin-authored markup (e.g. <badge class="ml6 jb-blue">GO</badge>)
both at save time and render time, diverging from the reference theme
which stores and echoes these fields raw.
- add shared inline whitelist (aksrt_icon_card_kses_tags/aksrt_icon_card_kses)
and route both card renderers plus the media-brand fallback through it
- drop the dead unused $allow array in aksrt_icon_cover_card
- add 'rich_html' sanitize type (FieldSchema + SchemaProvider) and mark
icon card title/desc fields in widget schemas, page display schema and
the page config meta box save path
- align header slider card module with reference show_widget_bg branches
(aksrt-panel/flex1 vs padding-10 wrapper/relative-h)
- update widget contract tests to pin the whitelist behavior
kate522andClaude Fable 5