A small release with two fixes. If you build pages with Elementor's v4 atomic elements, this one matters.
An edit could quietly empty an atomic element's rich text
Reported in #121 by @kerk12, with a reproduction and a root cause analysis that all held up.
An atomic text value stores the same text twice: once as markup, and once as a node tree that the editor's rich-text control reads from. Updating the text rebuilt the markup but always wrote an empty tree, so the two halves disagreed.
Nothing looked wrong. The page rendered exactly as before, the tool reported success, and no error appeared anywhere. The only symptom was that the element opened empty in the Elementor editor. On a site built largely from atomic elements, a single call to fix a typo could flatten a hand-built element, and you would not find out until someone tried to edit it.
Both halves are now produced from a single parse of the markup, matching how Elementor's own editor builds them, so they cannot drift apart. Ids you set yourself are kept, ids the parser has to invent are written into both halves, and nested formatting survives. Three separate code paths could trigger the flattening and all three are closed.
Already-damaged elements are not repaired automatically. Re-apply the text once and the structure is rebuilt.
PHP snippet warnings now say what to check
Findings come in three levels instead of two. Anything that blocks a snippet still blocks it. Things worth a reviewer's attention, such as writing a site option or sending email, are warnings. Things that are ordinary in working code, such as stopping the request after a redirect or reading request input, are notes.
This was worth changing because almost every well-written snippet is built from functions that were being reported as warnings, so a good snippet arrived covered in them. A reviewer told that ten routine things are warnings learns to skim, and skimming is how the one that mattered gets waved through.
Every message now says what the code does and what to check, rather than just naming a hazard:
Reads request input from
$_GET. Normal, as long as the value is sanitized before use and the surrounding code checks capability and nonce.
Each snippet also leads with a plain verdict, such as "Safe to activate. 3 notes, all ordinary in working code." The Sandbox and PHP Templates screens follow that verdict instead of colouring any finding as an error. The PHP Templates screen in particular used to show a red box whenever a template had any finding at all, including a single routine note.
Free download: emcp-tools-3.13.2.zip below, or update from your WordPress dashboard.