| Server IP : 108.167.142.43 / Your IP : 216.73.217.58 Web Server : Apache System : Linux gator4174.hostgator.com 5.14.0-687.39.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Aug 18 06:09:16 EDT 2026 x86_64 User : delarice ( 2406) PHP Version : 8.3.36 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /home2/delarice/public_html/wp-content/plugins/header-footer-elementor/admin/ |
Upload File : |
--- module: admin owner: UNKNOWN --- # admin ## Responsibility - The wp-admin UI layer for HFE: registers the `elementor-hf` CPT, the admin submenu, the template metabox (Type / Display Rules / canvas toggle), list-table columns, editor notices, a widget-usage KPI cron, and all `wp_ajax_*` handlers (widget activation, plugin/theme install, subscription, notices, onboarding analytics). - `admin/bsf-analytics/` is vendored BSF analytics — outside this module. ## Why it is this way - The AJAX nonce contract is split across files: the token is created in `inc/class-hfe-settings-page.php`, localized into `hfe_admin_data`, and consumed in JS. Handlers here only *verify* it, which is why editing the string in one place silently breaks auth everywhere. - Install/theme handlers delegate to WordPress core's own AJAX callbacks, so they must adopt core's `'updates'` nonce and capabilities rather than the plugin's. ## Related ADRs None yet.