FileMaker Functions

cwpSendToFM($data, $layout, $field, $script = null, $fm_opts = [])

Send any array/object as JSON to FileMaker, with optional script trigger. Designed for event-driven data dumps (e.g., after checkout, form submission, etc.).

  • Purpose:

    • Quickly send data to FileMaker as a JSON string in a specified field
    • Optionally trigger a FileMaker script after record creation
    • Keeps integration simple and safe (not for arbitrary FM actions)

  • Parameters:

    • $data (array|object): Data to send (will be JSON-encoded)
    • $layout (string): FileMaker layout to use
    • $field (string): FileMaker field to store JSON
    • $script (string|null): Optional FileMaker script to run
    • $fm_opts (array): Optional override for FM connection constants (host, db, user, pass)

  • Returns:

    • Array with keys: success (bool), message (string), response (FM API response or script result)

  • Example:

    $result = cwpSendToFM($checkout_data, 'Web_Orders', 'json_field', 'AfterOrderScript');
if (!$result['success']) {
    fmcwpShowResponse($result, 'FileMaker Error');
}

handle_filemaker_download()

Purpose:

  • Fetch and stream an allowlisted FileMaker file through an authenticated AJAX request.

Handlers:

  • Registered actions: fm_download for logged-in and logged-out requests. Both require the configured CWP integration token.

Usage:

  • Copy the generated token from CWP Snippets → Integration Security.
  • Call via admin-ajax.php with action, url, and optional filename parameters, plus the token in an Authorization: Bearer or X-CWP-Token header.
  • Example direct link (browser):
    https://example.com/wp-admin/admin-ajax.php?action=fm_download&url=https%3A%2F%2Ffm-server.example%2Ffile.pdf&filename=file.pdf&token=YOUR_CWP_TOKEN

The query-string token is provided for browser-link compatibility, but headers are preferred because URLs may be stored in browser, proxy, and server logs.

Server-side example (PHP):

$download_url = add_query_arg([
    'action'   => 'fm_download',
    'url'      => $fileUrl,
    'filename' => $fileName,
], admin_url('admin-ajax.php'));
$response = wp_remote_get($download_url, [
    'headers' => ['Authorization' => 'Bearer ' . cwp_get_integration_token()],
]);
// handle $response as usual (wp_remote_retrieve_body, etc.)

Behavior and validation:

  • Requires a valid CWP integration token and an HTTPS url parameter.
  • Public destinations use WordPress's SSRF-safe URL validation and safe redirect handling. Private/internal FileMaker hosts are denied by default.
  • To permit a private FileMaker host, add its exact hostname or IP address under Integration Security → Private download hosts. Explicit private hosts cannot redirect the request to another destination.
  • TLS certificate verification is always enabled. The default maximum response size is 25 MB; customize it with cwp_snippets_download_max_bytes up to the hard 100 MB ceiling.
  • On success returns the file contents streamed to the client with Content-Disposition: attachment; filename="<filename>".
  • On failure the handler calls wp_die() with an error message (appropriate for AJAX downloads).

Security notes:

  • Keep the integration token out of plugin source and snippets. Prefer request headers whenever the client supports them.
  • Add only trusted, exact hosts to the Private download hosts setting.
  • CWP_SNIPPETS_API_TOKEN and CWP_SNIPPETS_DOWNLOAD_HOSTS constants remain available as advanced overrides for managed deployments.
  • File names are sanitized before being included in response headers.

Example cURL (server-to-server) to download via the AJAX handler:

curl --request GET \
  --header "Authorization: Bearer YOUR_CWP_TOKEN" \
  "https://example.com/wp-admin/admin-ajax.php?action=fm_download&url=https%3A%2F%2Ffm-server.example%2Ffile.pdf&filename=file.pdf" \
  -o file.pdf

Notes:

  • This helper is intended as a convenience for remote FileMaker-hosted files. If you require complex authentication to access the FileMaker file, handle auth inside handle_filemaker_download() or use a server-side proxy with credentials stored securely (not in client-facing code).