fix: Hard main template rendering lock

- Added $rendering_main_template flag that blocks all other renders
- Reduced MAX_RENDER_DEPTH from 5 to 2
- template-wrapper.php passes is_main_template=true to enable hard lock
- Any render attempt during main template rendering is blocked

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,63 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.7] - 2026-02-02
+
+### Fixed
+
+- **Hard main template rendering lock** - Added additional protection at Plugin::render() level
+  - Added `$rendering_main_template` flag that completely blocks any other render calls while main template is rendering
+  - Reduced MAX_RENDER_DEPTH from 5 to 2 (allows one level of {% include %} but prevents deeper recursion)
+  - template-wrapper.php now passes `is_main_template = true` to enable the hard lock
+  - Any render attempt during main template rendering is immediately blocked
+
+## [0.4.6] - 2026-02-02
+
+### Fixed
+
+- **Page template loading lock** - Block ALL shortcode rendering during page template loading
+  - Added `$loading_page_template` flag in TemplateLoader
+  - template-wrapper.php now sets this flag before loading theme header/footer
+  - Shortcodes::render_template() checks this flag and returns early if set
+  - This prevents any recursion triggered by theme components, widgets, or other plugins during page template loading
+  - Main template rendering still works (uses Plugin::render() directly, not through Shortcodes)
+
+## [0.4.5] - 2026-02-02
+
+### Fixed
+
+- **Multi-layer recursion protection** - Added additional safeguards against infinite Twig rendering
+  - Added render depth tracking in `Plugin::render()` with max depth of 5
+  - Strip shortcodes from content when in shortcode context (prevents any later `do_shortcode()` calls from triggering recursion)
+  - This addresses the Twig StagingExtension.php recursion error
+
+## [0.4.4] - 2026-02-02
+
+### Fixed
+
+- **Fix excerpt-triggered recursion** - `get_the_excerpt()` internally calls `the_content` filter when generating auto-excerpts
+  - When in shortcode context, now uses raw `$post->post_excerpt` or generates simple excerpt with `wp_trim_words()` instead
+  - This was the remaining recursion path causing memory exhaustion in `class-wp-hook.php`
+
+## [0.4.3] - 2026-02-02
+
+### Fixed
+
+- **Further memory leak fix** - v0.4.2 fix was still incomplete
+  - Changed `$in_shortcode_context` boolean to `$shortcode_context_depth` counter to properly handle nested shortcodes
+  - Added shortcode context protection to `template-wrapper.php` for single page views
+  - This fixes the remaining recursion path where `the_content` filter was still being applied when viewing single FediStream posts (artists, albums, tracks, playlists)
+
+## [0.4.2] - 2026-02-02
+
+### Fixed
+
+- **Complete fix for memory leak** - v0.4.1 fix was incomplete
+  - Added `$in_shortcode_context` flag to TemplateLoader to track when we're rendering shortcodes
+  - All shortcode render methods now call `enter_shortcode_context()` before loading data
+  - When in shortcode context, `the_content` filter is always skipped to prevent recursive shortcode processing
+  - This prevents infinite recursion when post content contains FediStream shortcodes
+
 ## [0.4.1] - 2026-02-02
 
 ### Fixed
@@ -207,7 +264,13 @@ Initial release of WP FediStream - a WordPress plugin for streaming music over A
 
 ---
 
-[Unreleased]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.1...HEAD
+[Unreleased]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.7...HEAD
+[0.4.7]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.6...v0.4.7
+[0.4.6]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.5...v0.4.6
+[0.4.5]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.4...v0.4.5
+[0.4.4]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.3...v0.4.4
+[0.4.3]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.2...v0.4.3
+[0.4.2]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.1...v0.4.2
 [0.4.1]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.4.0...v0.4.1
 [0.4.0]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.3.0...v0.4.0
 [0.3.0]: https://src.bundespruefstelle.ch/magdev/wp-fedistream/compare/v0.2.0...v0.3.0

includes/Frontend/Shortcodes.php

@@ -81,6 +81,9 @@ class Shortcodes {
      * @return string
      */
     public function render_artist( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'id'          => 0,
@@ -95,6 +98,7 @@ class Shortcodes {
 
         $post = $this->get_post( $atts, 'fedistream_artist' );
         if ( ! $post ) {
+            TemplateLoader::exit_shortcode_context();
             return '';
         }
 
@@ -119,6 +123,9 @@ class Shortcodes {
      * @return string
      */
     public function render_album( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'id'          => 0,
@@ -132,6 +139,7 @@ class Shortcodes {
 
         $post = $this->get_post( $atts, 'fedistream_album' );
         if ( ! $post ) {
+            TemplateLoader::exit_shortcode_context();
             return '';
         }
 
@@ -155,6 +163,9 @@ class Shortcodes {
      * @return string
      */
     public function render_track( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'id'          => 0,
@@ -168,6 +179,7 @@ class Shortcodes {
 
         $post = $this->get_post( $atts, 'fedistream_track' );
         if ( ! $post ) {
+            TemplateLoader::exit_shortcode_context();
             return '';
         }
 
@@ -191,6 +203,9 @@ class Shortcodes {
      * @return string
      */
     public function render_playlist( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'id'          => 0,
@@ -204,6 +219,7 @@ class Shortcodes {
 
         $post = $this->get_post( $atts, 'fedistream_playlist' );
         if ( ! $post ) {
+            TemplateLoader::exit_shortcode_context();
             return '';
         }
 
@@ -227,6 +243,9 @@ class Shortcodes {
      * @return string
      */
     public function render_latest_releases( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'count'   => 6,
@@ -292,6 +311,9 @@ class Shortcodes {
      * @return string
      */
     public function render_popular_tracks( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'count'   => 10,
@@ -359,6 +381,9 @@ class Shortcodes {
      * @return string
      */
     public function render_artists_grid( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'count'   => 12,
@@ -426,6 +451,9 @@ class Shortcodes {
      * @return string
      */
     public function render_player( array $atts ): string {
+        // Enter shortcode context to prevent recursive shortcode processing during data loading.
+        TemplateLoader::enter_shortcode_context();
+
         $atts = shortcode_atts(
             array(
                 'track'    => 0,
@@ -471,6 +499,7 @@ class Shortcodes {
         }
 
         if ( empty( $tracks ) ) {
+            TemplateLoader::exit_shortcode_context();
             return '';
         }
 
@@ -523,18 +552,31 @@ class Shortcodes {
      * @return string
      */
     private function render_template( string $template, array $context ): string {
+        // Block shortcode rendering while loading page template to prevent recursion.
+        // This catches any shortcodes triggered by theme header/footer, widgets, etc.
+        if ( TemplateLoader::is_loading_page_template() ) {
+            return '<!-- FediStream: shortcode blocked during page template loading -->';
+        }
+
         // Check for unlicensed mode.
         if ( $this->unlicensed_mode ) {
             return $this->get_unlicensed_message();
         }
 
+        // Enter shortcode context to prevent recursive shortcode processing.
+        TemplateLoader::enter_shortcode_context();
+
         try {
-            return $this->plugin->render( $template, $context );
+            $result = $this->plugin->render( $template, $context );
         } catch ( \Exception $e ) {
+            TemplateLoader::exit_shortcode_context();
             if ( WP_DEBUG ) {
                 return '<p class="fedistream-error">' . esc_html( $e->getMessage() ) . '</p>';
             }
             return '';
         }
+
+        TemplateLoader::exit_shortcode_context();
+        return $result;
     }
 }

includes/Frontend/TemplateLoader.php

@@ -35,6 +35,82 @@ class TemplateLoader {
      */
     private const MAX_RECURSION_DEPTH = 3;
 
+    /**
+     * Shortcode rendering context depth counter.
+     * When > 0, the_content filter is skipped to prevent recursive shortcode processing.
+     * Using a counter instead of boolean to handle nested shortcodes properly.
+     *
+     * @var int
+     */
+    private static int $shortcode_context_depth = 0;
+
+    /**
+     * Flag indicating we're currently loading a FediStream page template.
+     * This completely blocks any nested FediStream shortcode rendering.
+     *
+     * @var bool
+     */
+    private static bool $loading_page_template = false;
+
+    /**
+     * Enter page template loading mode.
+     * This blocks ALL shortcode rendering during page template loading.
+     *
+     * @return void
+     */
+    public static function enter_page_template_loading(): void {
+        self::$loading_page_template = true;
+    }
+
+    /**
+     * Exit page template loading mode.
+     *
+     * @return void
+     */
+    public static function exit_page_template_loading(): void {
+        self::$loading_page_template = false;
+    }
+
+    /**
+     * Check if we're loading a page template.
+     *
+     * @return bool
+     */
+    public static function is_loading_page_template(): bool {
+        return self::$loading_page_template;
+    }
+
+    /**
+     * Enter shortcode rendering context.
+     * Call this before rendering shortcode content to prevent recursive shortcode processing.
+     *
+     * @return void
+     */
+    public static function enter_shortcode_context(): void {
+        ++self::$shortcode_context_depth;
+    }
+
+    /**
+     * Exit shortcode rendering context.
+     * Call this after shortcode rendering is complete.
+     *
+     * @return void
+     */
+    public static function exit_shortcode_context(): void {
+        if ( self::$shortcode_context_depth > 0 ) {
+            --self::$shortcode_context_depth;
+        }
+    }
+
+    /**
+     * Check if we're in a shortcode rendering context.
+     *
+     * @return bool
+     */
+    public static function is_in_shortcode_context(): bool {
+        return self::$shortcode_context_depth > 0;
+    }
+
     /**
      * Constructor.
      */
@@ -213,14 +289,37 @@ class TemplateLoader {
         // Track recursion to prevent infinite loops from shortcodes in content.
         ++self::$recursion_depth;
 
-        // At depth > 1, skip the_content filter to prevent shortcode recursion.
-        $is_nested = self::$recursion_depth > 1;
+        // Skip the_content filter if:
+        // 1. We're in a shortcode context (prevents recursive shortcode processing)
+        // 2. We're at depth > 1 (nested data loading)
+        $skip_content_filter = self::$shortcode_context_depth > 0 || self::$recursion_depth > 1;
+
+        // When skipping content filter, also use raw excerpt to avoid get_the_excerpt()
+        // triggering the_content filter internally when generating auto-excerpts.
+        if ( $skip_content_filter ) {
+            $excerpt = $post->post_excerpt;
+            if ( empty( $excerpt ) ) {
+                // Generate a simple excerpt without triggering the_content filter.
+                $excerpt = wp_trim_words( wp_strip_all_tags( $post->post_content ), 55, '…' );
+            }
+        } else {
+            $excerpt = get_the_excerpt( $post );
+        }
+
+        // When skipping content filter, also strip shortcodes to prevent them from
+        // being processed by anything else that might call do_shortcode on the output.
+        if ( $skip_content_filter ) {
+            $content = strip_shortcodes( $post->post_content );
+            $content = wp_kses_post( $content );
+        } else {
+            $content = apply_filters( 'the_content', $post->post_content );
+        }
 
         $data = array(
             'id'        => $post->ID,
             'title'     => get_the_title( $post ),
-            'content'   => $is_nested ? wp_kses_post( $post->post_content ) : apply_filters( 'the_content', $post->post_content ),
-            'excerpt'   => get_the_excerpt( $post ),
+            'content'   => $content,
+            'excerpt'   => $excerpt,
             'permalink' => get_permalink( $post ),
             'thumbnail' => get_the_post_thumbnail_url( $post->ID, 'large' ),
             'date'      => get_the_date( '', $post ),

includes/Frontend/template-wrapper.php

@@ -13,6 +13,12 @@ if ( ! defined( 'ABSPATH' ) ) {
 use WP_FediStream\Plugin;
 use WP_FediStream\Frontend\TemplateLoader;
 
+// Enter page template loading mode - this completely blocks nested FediStream rendering.
+TemplateLoader::enter_page_template_loading();
+
+// Also enter shortcode context to prevent recursive shortcode processing in post content.
+TemplateLoader::enter_shortcode_context();
+
 // Get template context.
 $context = TemplateLoader::get_context();
 
@@ -54,7 +60,8 @@ get_header();
     if ( $template_name ) {
         try {
             // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
-            echo $plugin->render( $template_name, $context );
+            // Pass true for is_main_template to set the hard rendering lock.
+            echo $plugin->render( $template_name, $context, true );
         } catch ( \Exception $e ) {
             if ( WP_DEBUG ) {
                 echo '<div class="fedistream-error">';
@@ -75,4 +82,8 @@ get_header();
 </main>
 
 <?php
+// Exit shortcode context and page template loading mode.
+TemplateLoader::exit_shortcode_context();
+TemplateLoader::exit_page_template_loading();
+
 get_footer();

includes/Plugin.php

@@ -55,6 +55,29 @@ final class Plugin {
      */
     private ?\Twig\Environment $twig = null;
 
+    /**
+     * Current Twig render depth to prevent infinite recursion.
+     *
+     * @var int
+     */
+    private static int $render_depth = 0;
+
+    /**
+     * Maximum allowed Twig render depth.
+     * Set to 2 to allow one level of nested includes but prevent deeper recursion.
+     *
+     * @var int
+     */
+    private const MAX_RENDER_DEPTH = 2;
+
+    /**
+     * Flag to track if we're currently rendering the main page template.
+     * This is a hard lock that prevents ANY other rendering.
+     *
+     * @var bool
+     */
+    private static bool $rendering_main_template = false;
+
     /**
      * Post type instances.
      *
@@ -842,8 +865,35 @@ final class Plugin {
      * @param array  $context  Template context variables.
      * @return string Rendered template.
      */
-    public function render( string $template, array $context = array() ): string {
-        return $this->twig->render( $template . '.twig', $context );
+    public function render( string $template, array $context = array(), bool $is_main_template = false ): string {
+        // If we're already rendering the main template, block any other renders.
+        if ( self::$rendering_main_template && ! $is_main_template ) {
+            return '<!-- FediStream: blocked during main template render -->';
+        }
+
+        // Prevent infinite recursion in Twig rendering.
+        if ( self::$render_depth >= self::MAX_RENDER_DEPTH ) {
+            return '<!-- FediStream: render depth exceeded -->';
+        }
+
+        // Set main template lock if this is the main template.
+        $was_main = self::$rendering_main_template;
+        if ( $is_main_template ) {
+            self::$rendering_main_template = true;
+        }
+
+        ++self::$render_depth;
+
+        try {
+            $result = $this->twig->render( $template . '.twig', $context );
+        } finally {
+            --self::$render_depth;
+            if ( $is_main_template ) {
+                self::$rendering_main_template = $was_main;
+            }
+        }
+
+        return $result;
     }
 
     /**

wp-fedistream.php

@@ -3,7 +3,7 @@
  * Plugin Name: WP FediStream
  * Plugin URI: https://src.bundespruefstelle.ch/magdev/wp-fedistream
  * Description: Stream music over ActivityPub - Build your own music streaming platform for Musicians and Labels.
- * Version: 0.4.1
+ * Version: 0.4.6
  * Requires at least: 6.4
  * Requires PHP: 8.3
  * Author: Marco Graetsch
@@ -26,7 +26,7 @@ if ( ! defined( 'ABSPATH' ) ) {
  *
  * @var string
  */
-define( 'WP_FEDISTREAM_VERSION', '0.4.1' );
+define( 'WP_FEDISTREAM_VERSION', '0.4.7' );
 
 /**
  * Plugin file path.