WOLF

WPBE_SETTINGS::get_fields() merges the static field list from data/fields.php with one column per taxonomy registered for the current post type, then applies the user's saved column order and titles. New fields that appear later (a new taxonomy, a new meta key) are appended instead of being lost.

Field definitions carry allow_post_types and prohibit_post_types. wrap_field_val() returns a 'restricted' cell when a field does not apply, for example status and comment fields for attachments, mime type only for attachments, sticky only for posts. Attachments are queried with the extra 'inherit' status.

The table is configured with serverSide: true and calls wpbe_get_posts with DataTables paging parameters. WPBE_POSTS::gets() converts start/length into paged/posts_per_page and switches to meta_value_num ordering when the sort column is a numeric or date meta field.

Rows per page are capped at 100 with the code comment 'to avoid 500 error on weak servers'. The free build caps it at 10.

init() runs a role check first and then is_should_init(), which returns true only for page=wpbe or an AJAX action whose name contains 'wpbe_'. On other admin screens only the menu entry, the admin bar button and notices are registered.

Extensions follow a naming convention (ext/<slug>/<slug>.php, class WPBE_<SLUG>) and receive storage, settings and the posts model through init_vars(). The same loader also picks up third-party extensions from wp-content/wpbe_ext.

Settings live in the option wpbe_options_<user_id>. When the 'separate settings' switch is on, the post type is appended to the key, and the registered meta fields list is split per post type the same way. The active post type is remembered per user in the plugin storage.

The switch is disabled in the free build.

When SitePress is present, the wpbe_current_language filter returns ICL_LANGUAGE_CODE, gets() calls $sitepress->switch_lang() before building WP_Query, and the sticky posts option is read and written under sticky_posts_<lang>.

wpbe_bulk_posts_count stores the bulk form under 'wpbe_bulk_<key>' (16 random characters generated in the browser) and returns the IDs matching the current filter, using fields=ids and no_found_rows. The browser slices that list into batches of 50 and posts them one after another to wpbe_bulk_posts, updating a progress bar and an admin-bar indicator. Cancel aborts the pending XHR; wpbe_bulk_finish returns the counted total.

Bulk delete uses the same pattern with batches of 10 and wp_trash_post(), so deleted posts stay recoverable from the trash.

After a run the browser redraws only the touched rows when four or fewer posts were changed and redraws the current page otherwise.

__process_text_data() reads the current value of each post and applies the chosen behavior. Values can contain {TITLE}, {ID}, {MENU_ORDER} and {meta:key}, resolved per post, and case macros such as {DO_STRING_UP} or {DO_STRING_TITLE} that use the mb_* functions, so non-Latin titles are handled.

__process_number_data() supports increase/decrease by value or percent, then optionally combines the result with another meta field of the same post (+, -, *, /, with division by zero replaced by 1) and with a random number from a range scaled by a decimal factor.

Rounding of the fraction to steps of .05 or .10, or to an ending such as .99, happens in update_page_field() in the configured number of decimals; cents are converted through an integer step because float modulo gives wrong results.

WordPress expects IDs for hierarchical taxonomies and names or slugs for tag-like ones. The bulk worker checks is_taxonomy_hierarchical(); for flat taxonomies it converts each ID to a slug, and for 'replace' it writes the first term with append=false and the rest with append=true. 'Remove' uses wp_remove_object_terms().

The history hook is fired manually before term changes, because this path bypasses update_page_field().

The count step writes the header row; each batch appends rows with fputcsv() on a file opened in a+ mode. The code notes that WP_Filesystem has no line-by-line append, which is why raw file functions are used here.

XML export builds an RSS document with the WXR 1.2 namespaces (wp:, content:, excerpt:), terms as <category domain nicename> and meta as wp:postmeta with CDATA, so the file follows the format of the WordPress exporter. File names carry the export date and minute, and files older than two days are deleted by a check throttled with a transient.

The browser generates wpbe_filter_current_key when a filter is applied and sends it with every request; the source comment says this allows bulk by filter in different tabs. wpbe_apply_query_filter_data() reads the stored filter and is applied inside WPBE_POSTS::gets(), so the bulk ID list is built by the same code as the visible table.

For the AND operator each selected term becomes its own clause joined by the outer relation AND, which is the workaround referenced in the code comment. Other operators (IN, NOT IN) pass the term list as is. include_children is controlled by a filter instead of the WordPress default.

The code comment gives the case: with DECIMAL without precision, a search from 100 to 150 also returned 99.xx. The filter uses DECIMAL(30,20), switches to >= when only 'from' is set and to = when both bounds are equal. Date meta goes through normalize_calendar_date() first.

Posts created before a meta key was introduced have no row at all, so an equality check alone misses them. The 'empty' behavior emits a nested meta_query with relation OR.

posts_txt_where() lowercases the input, splits on ^, and builds LOWER(column) REGEXP / NOT REGEXP conditions with begin, end, exact and not modes. Every value is bound through $wpdb->prepare() and the column must be in an allowlist of five wp_posts columns.

Comma-separated items are taken as IDs; an item with a dash is expanded into the full range regardless of order. Date and number ranges on wp_posts columns (menu_order, post_parent, post dates) go through a separate posts_where filter with a column allowlist.

write() is attached to wpbe_before_update_page_field, which update_page_field() fires before every write; the bulk taxonomy path, which writes terms directly, fires it by hand. Taxonomy values are stored as a JSON list of term IDs, array meta as JSON (with JSON_HEX_QUOT and JSON_HEX_TAG for the serialized-meta editor), scalars as is. Each row has user_id and post_type, and the bulk key when it is part of a run.

start_bulk() inserts the head row with the list of edited fields as JSON; each batch adds its size through UPDATE posts_count = posts_count + %d; finish_bulk() marks the run completed. A run cancelled by the user keeps the default state 'terminated', so the list shows it as partial. Both tables are created with dbDelta and the site charset, indexed on bulk_key and user_id, and dropped on uninstall.

The browser asks for the row count of the bulk key, then calls wpbe_history_revert_bulk_portion repeatedly with limit 10 and a progress bar. Each reverted row is deleted, so the next portion picks up the remaining ones; the head row is deleted when the counter reaches the total.

revert() detaches the history writer, decodes the stored value by field type (term ID lists, JSON meta arrays) and writes it back through the same update_page_field() used for edits, so save_post and edit_post fire for a revert as they do for an edit.

get_history() reads the single rows and the bulk heads of the current user and post type, merges them and sorts them by time, newest first, so one list shows both kinds of change.

The free build shows the two latest entries and prunes older single rows and bulk heads when the list is opened.

wpbe_meta_get_keys returns the meta keys of a post ID entered by the admin. A registered key is injected through wpbe_extend_fields, wpbe_filter_* and wpbe_bulk_* hooks, so it appears in the table, the filter panel and the bulk panel at once. Keys are trimmed but not lowercased, because keys like _woocs_sale_price_USD are case-sensitive.

The free build uses the first two registered meta fields only.

The popup sends keys[]/values[] for flat and nested arrays and keys2[][]/values2[][] for lists of objects. __process_jsoned_meta_data() rebuilds the PHP array, decodes values that are valid JSON, and falls back to the raw value for plain strings. update_post_meta() then stores it serialized as WordPress expects. The same path is used by the bulk worker.

over_switcher_swicher_to_val() and over_switcher_val_to_swicher() read a settings string such as 'dist:yes,stest:true' and convert in both directions, so the switcher UI works with values written by other plugins.

The gallery popup posts a URL-encoded form; the handler detects the encoding, parses it with parse_str(), sanitizes it and stores the IDs as a comma-separated string. The bulk worker accepts the same format.

Option 'Use gutenberg'. For post types that use the block editor, the popup loads post.php with wpbe_popup_editor=1; wp_editor_compatibility() hides publish and sidebar controls in that frame and exposes a function that returns wp.data.select('core/editor').getEditedPostContent(). The parent page reads it and saves through the normal field update.

can_manage_data() allows administrators, editors and roles added through the wpbe_author_area_roles filter. If it fails, init() returns before extensions load, so the AJAX actions do not exist for that user. Field updates, bulk edit and bulk delete, the tools panel (create, duplicate, delete, terms), meta settings, the options form, the history list and single reverts also check a nonce.

For non-admin roles get_fields() drops hidden columns, so they are not offered in the table or the bulk panel; update_page_field() checks is_current_user_can_edit_field() and returns 'forbidden' for a hidden field; filter_post_types() narrows the post type selector, and the settings constructor moves the user to an allowed post type. In the free build the visibility checkboxes are rendered disabled.

For roles added through the wpbe_author_area_roles filter, WPBE_AUTHOR_AREA adds 'author' => current user ID through the query filter used by the table, the bulk ID list and export, so these lists show only the user's own posts. Its wpbe_user_can_edit callback blocks post_author for these roles.

Text and range filters accept only listed wp_posts columns and bind values through prepare(). History queries bind user, post type and bulk key, and build NOT IN lists from array_fill() placeholders.

Duplication copies terms by slug and all postmeta except _wp_old_slug in one INSERT ... SELECT %d, %s, %s UNION ALL statement, each row built with prepare(), then sets the copy to draft.

wpbe_update_page_field() sanitizes arrays recursively with wp_kses and the post allowlist. For content, excerpt and rich-text fields it adds iframe with a fixed set of attributes so video embeds survive. A filter can switch to sanitize_text_field() for stricter sites.