FileMaker Functions

cwpSendToFM($data, $layout, $field, $script = null, $fm_opts = [])

Send any array/object as JSON to FileMaker, with optional script trigger. Designed for event-driven data dumps (e.g., after checkout, form submission, etc.).

• Purpose:

  • Quickly send data to FileMaker as a JSON string in a specified field
  • Optionally trigger a FileMaker script after record creation
  • Keeps integration simple and safe (not for arbitrary FM actions)

• Parameters:

  • $data (array|object): Data to send (will be JSON-encoded)
  • $layout (string): FileMaker layout to use
  • $field (string): FileMaker field to store JSON
  • $script (string|null): Optional FileMaker script to run
  • $fm_opts (array): Optional override for FM connection constants (host, db, user, pass)

• Returns:

  • Array with keys: success (bool), message (string), response (FM API response or script result)

• Example:

  $result = cwpSendToFM($checkout_data, 'Web_Orders', 'json_field', 'AfterOrderScript');
  if (!$result['success']) {
      fmcwpShowResponse($result, 'FileMaker Error');
  }

---

handle_filemaker_download()

Purpose:

• Fetch and stream an allowlisted FileMaker file through an authenticated AJAX request.

Handlers:

• Registered actions: fm_download for logged-in and logged-out requests. Both require the configured CWP integration token.

Usage:

• Copy the generated token from CWP Snippets → Integration Security.
• Call via admin-ajax.php with action, url, and optional filename parameters, plus the token in an Authorization: Bearer or X-CWP-Token header.
• Example direct link (browser):

  https://example.com/wp-admin/admin-ajax.php?action=fm_download&url=https%3A%2F%2Ffm-server.example%2Ffile.pdf&filename=file.pdf&token=YOUR_CWP_TOKEN

The query-string token is provided for browser-link compatibility, but headers are preferred because URLs may be stored in browser, proxy, and server logs.

Server-side example (PHP):

$download_url = add_query_arg([
    'action'   => 'fm_download',
    'url'      => $fileUrl,
    'filename' => $fileName,
], admin_url('admin-ajax.php'));
$response = wp_remote_get($download_url, [
    'headers' => ['Authorization' => 'Bearer ' . cwp_get_integration_token()],
]);
// handle $response as usual (wp_remote_retrieve_body, etc.)

Behavior and validation:

• Requires a valid CWP integration token and an HTTPS url parameter.
• Public destinations use WordPress's SSRF-safe URL validation and safe redirect handling. Private/internal FileMaker hosts are denied by default.
• To permit a private FileMaker host, add its exact hostname or IP address under Integration Security → Private download hosts. Explicit private hosts cannot redirect the request to another destination.
• TLS certificate verification is always enabled. The default maximum response size is 25 MB; customize it with cwp_snippets_download_max_bytes up to the hard 100 MB ceiling.
• On success returns the file contents streamed to the client with Content-Disposition: attachment; filename="<filename>".
• On failure the handler calls wp_die() with an error message (appropriate for AJAX downloads).

Security notes:

• Keep the integration token out of plugin source and snippets. Prefer request headers whenever the client supports them.
• Add only trusted, exact hosts to the Private download hosts setting.
• CWP_SNIPPETS_API_TOKEN and CWP_SNIPPETS_DOWNLOAD_HOSTS constants remain available as advanced overrides for managed deployments.
• File names are sanitized before being included in response headers.

Example cURL (server-to-server) to download via the AJAX handler:

curl --request GET \
  --header "Authorization: Bearer YOUR_CWP_TOKEN" \
  "https://example.com/wp-admin/admin-ajax.php?action=fm_download&url=https%3A%2F%2Ffm-server.example%2Ffile.pdf&filename=file.pdf" \
  -o file.pdf

Notes:

• This helper is intended as a convenience for remote FileMaker-hosted files. If you require complex authentication to access the FileMaker file, handle auth inside handle_filemaker_download() or use a server-side proxy with credentials stored securely (not in client-facing code).