| Server IP : 108.167.142.43 / Your IP : 216.73.217.58 Web Server : Apache System : Linux gator4174.hostgator.com 5.14.0-687.39.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Aug 18 06:09:16 EDT 2026 x86_64 User : delarice ( 2406) PHP Version : 8.3.36 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /home2/delarice/public_html/wp-content/plugins/header-footer-elementor/inc/settings/ |
Upload File : |
--- module: settings owner: UNKNOWN --- # settings ## Responsibility - `hfe-settings-api.php` owns the `/hfe/v1/` REST namespace and the `uae_mcp_settings` option (read/write). `admin-base.php` and `settings-app.php` are thin PHP view templates — the former fires `hfe_render_admin_page_content`, the latter emits the `#hfe-settings-app` React mount div. - Stops at the MCP registry (`inc/abilities`) and the React app (`src/`), which it exposes data to but does not own. ## Why it is this way - The nonce check lives in each callback rather than in the shared `permission_callback` because the permission callback is capability-only by design; the two-layer split is deliberate but easy to break by copying only one half. ## Related ADRs None yet.