EMCP Tools 3.13.0: finish a theme template without Elementor Pro
Finish a theme template without Elementor Pro.
EMCP Themer could always route templates. The problem was running out of parts: you would start a Single template, drop in a title, then want an author box, a previous/next link, comments, or a search form for the 404, and none of it was there.
Nine new Themer widgets, all free
Author Box, Post Navigation, Post Comments, Search Form, Sitemap, Post Info, Archive Posts, Featured Image and Post Excerpt.
Author Box shows the avatar, name, biography and links, with every part switchable. Post Navigation can stay within the same category. Post Info builds an ordered metadata row: author, date, time, comment count, terms, or a custom field, in the order you list them. Archive Posts adds pagination.
Author Box and Sitemap also ship as blocks. Comments, search and post navigation do not, because WordPress core already has a block for each.
Nothing you have already built changes. Post Info and Archive Posts sit beside Post Meta and Archive Loop rather than replacing them, so existing templates render exactly as they did. Archive Loop is relabelled "Archive Posts (classic)" so the two are tellable apart.
Dynamic data, on free Elementor
Pick the source from the field itself. In Elementor it appears in the dynamic picker on any field that accepts one; in the block editor it binds to a Heading, Paragraph, Image or Button.
Elementor ships the machinery for dynamic fields but none of the sources, so on a free install that picker is empty. EMCP fills it. Ten free sources: post title, post excerpt, post URL, post date, post ID, featured image, archive title, site title, site logo, site description. Pro adds custom fields (ACF-aware), author name, bio, URL and avatar, taxonomy terms, and a fallback for when a field is empty.
Sources are typed and the type is enforced: an image source cannot be bound to a heading. A binding that cannot work is refused when it is made rather than rendering blank later.
A new list-dynamic-sources tool tells a connected agent what is available and where each source can be used, and the existing widget and block tools accept a binding alongside the usual settings.
New EMCP Modules tab
The Tools screen gains an EMCP Modules tab. The WordPress tab had grown to 21 sections, about half of which were EMCP's own subsystems rather than WordPress management: the theme builder, backup and migrate, redirects, changes and rollback, content search, content mirror, PHP snippets, project memory, cloud sync. Those move to their own tab.
The Themer, Cloud, Marketplace and Image Optimization tools also appear on that screen for the first time. They registered and worked, but had no entry anywhere, so they could not be toggled and were missing from every count.
Nothing changed about what any tool does, its permissions, or whether it is enabled.
Security
The read-only database guard has been rebuilt around a real tokenizer. The old design normalised a query into a plain string and pattern-matched it, which only works while the guard reads a query the same way MySQL does. Five review rounds of an external audit found four places where it did not, three of which could expose data from the user table.
The guard now splits a query into typed pieces and inspects those, refuses anything it cannot account for, and allows a query only if it is safe under every way the server could read it. Server system tables (mysql, information_schema, performance_schema, sys) are now off limits. Ordinary reporting queries are unaffected.
Fixed
Command-line AI apps could not finish signing in, failing with "Invalid client or redirect URI". A command-line app listens on your own machine and can spell it three ways (localhost, 127.0.0.1, ::1) on a port it picks fresh each run. The check tolerated the changing port but insisted the spelling match exactly. All three now count as the same machine. Addresses that leave your machine, including every https one, are still matched exactly as before.
The sign-in error page now says which of the two things went wrong and shows the requested and registered addresses side by side. "Manage connected apps" no longer does nothing when no apps have connected yet.
Free download: emcp-tools-3.13.0.zip below, or update from your WordPress dashboard.
Full details in the changelog and the release write-up.