From a41eddbc496e12e25b5136b0d021e734c4b09338 Mon Sep 17 00:00:00 2001
From: magdev <magdev3.0@gmail.com>
Date: Mon, 2 Feb 2026 17:09:16 +0100
Subject: [PATCH] fix: Block shortcode rendering during page template loading

- Added $loading_page_template flag in TemplateLoader
- template-wrapper.php sets flag before loading theme header/footer
- Shortcodes::render_template() returns early if flag is set
- Prevents recursion from theme components, widgets, or other plugins

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 CHANGELOG.md                           | 14 +++++++++-
 includes/Frontend/Shortcodes.php       |  6 +++++
 includes/Frontend/TemplateLoader.php   | 36 ++++++++++++++++++++++++++
 includes/Frontend/template-wrapper.php |  8 ++++--
 wp-fedistream.php                      |  4 +--
 5 files changed, 63 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3cfd01b..be13b3a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.6] - 2026-02-02
+
+### Fixed
+
+- **Page template loading lock** - Block ALL shortcode rendering during page template loading
+  - Added `$loading_page_template` flag in TemplateLoader
+  - template-wrapper.php now sets this flag before loading theme header/footer
+  - Shortcodes::render_template() checks this flag and returns early if set
+  - This prevents any recursion triggered by theme components, widgets, or other plugins during page template loading
+  - Main template rendering still works (uses Plugin::render() directly, not through Shortcodes)
+
 ## [0.4.5] - 2026-02-02
 
 ### Fixed
@@ -243,7 +254,8 @@ Initial release of WP FediStream - a WordPress plugin for streaming music over A
 
 ---
 
-[Unreleased]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.5...HEAD
+[Unreleased]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.6...HEAD
+[0.4.6]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.5...v0.4.6
 [0.4.5]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.4...v0.4.5
 [0.4.4]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.3...v0.4.4
 [0.4.3]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.2...v0.4.3
diff --git a/includes/Frontend/Shortcodes.php b/includes/Frontend/Shortcodes.php
index f4665b5..fb19644 100644
--- a/includes/Frontend/Shortcodes.php
+++ b/includes/Frontend/Shortcodes.php
@@ -552,6 +552,12 @@ class Shortcodes {
      * @return string
      */
     private function render_template( string $template, array $context ): string {
+        // Block shortcode rendering while loading page template to prevent recursion.
+        // This catches any shortcodes triggered by theme header/footer, widgets, etc.
+        if ( TemplateLoader::is_loading_page_template() ) {
+            return '<!-- FediStream: shortcode blocked during page template loading -->';
+        }
+
         // Check for unlicensed mode.
         if ( $this->unlicensed_mode ) {
             return $this->get_unlicensed_message();
diff --git a/includes/Frontend/TemplateLoader.php b/includes/Frontend/TemplateLoader.php
index effdade..4f3787e 100644
--- a/includes/Frontend/TemplateLoader.php
+++ b/includes/Frontend/TemplateLoader.php
@@ -44,6 +44,42 @@ class TemplateLoader {
      */
     private static int $shortcode_context_depth = 0;
 
+    /**
+     * Flag indicating we're currently loading a FediStream page template.
+     * This completely blocks any nested FediStream shortcode rendering.
+     *
+     * @var bool
+     */
+    private static bool $loading_page_template = false;
+
+    /**
+     * Enter page template loading mode.
+     * This blocks ALL shortcode rendering during page template loading.
+     *
+     * @return void
+     */
+    public static function enter_page_template_loading(): void {
+        self::$loading_page_template = true;
+    }
+
+    /**
+     * Exit page template loading mode.
+     *
+     * @return void
+     */
+    public static function exit_page_template_loading(): void {
+        self::$loading_page_template = false;
+    }
+
+    /**
+     * Check if we're loading a page template.
+     *
+     * @return bool
+     */
+    public static function is_loading_page_template(): bool {
+        return self::$loading_page_template;
+    }
+
     /**
      * Enter shortcode rendering context.
      * Call this before rendering shortcode content to prevent recursive shortcode processing.
diff --git a/includes/Frontend/template-wrapper.php b/includes/Frontend/template-wrapper.php
index 1a6edce..f6bfe19 100644
--- a/includes/Frontend/template-wrapper.php
+++ b/includes/Frontend/template-wrapper.php
@@ -13,7 +13,10 @@ if ( ! defined( 'ABSPATH' ) ) {
 use WP_FediStream\Plugin;
 use WP_FediStream\Frontend\TemplateLoader;
 
-// Enter shortcode context to prevent recursive shortcode processing in post content.
+// Enter page template loading mode - this completely blocks nested FediStream rendering.
+TemplateLoader::enter_page_template_loading();
+
+// Also enter shortcode context to prevent recursive shortcode processing in post content.
 TemplateLoader::enter_shortcode_context();
 
 // Get template context.
@@ -78,7 +81,8 @@ get_header();
 </main>
 
 <?php
-// Exit shortcode context.
+// Exit shortcode context and page template loading mode.
 TemplateLoader::exit_shortcode_context();
+TemplateLoader::exit_page_template_loading();
 
 get_footer();
diff --git a/wp-fedistream.php b/wp-fedistream.php
index f9a256f..72a4093 100644
--- a/wp-fedistream.php
+++ b/wp-fedistream.php
@@ -3,7 +3,7 @@
  * Plugin Name: WP FediStream
  * Plugin URI: https://src.bundespruefstelle.ch/magdev/wp-fedistream
  * Description: Stream music over ActivityPub - Build your own music streaming platform for Musicians and Labels.
- * Version: 0.4.5
+ * Version: 0.4.6
  * Requires at least: 6.4
  * Requires PHP: 8.3
  * Author: Marco Graetsch
@@ -26,7 +26,7 @@ if ( ! defined( 'ABSPATH' ) ) {
  *
  * @var string
  */
-define( 'WP_FEDISTREAM_VERSION', '0.4.5' );
+define( 'WP_FEDISTREAM_VERSION', '0.4.6' );
 
 /**
  * Plugin file path.