fix: add ABSPATH direct access protection to 15 PHP files

[faisalahammad]

Summary

Plugin Check flagged 15 PHP files missing the standard defined( 'ABSPATH' ) || exit; direct access protection. Adds the guard to builder view templates, the access plan dialog, and the order view function file. No business logic changed.

Changes

Builder view templates (13 files)

Inserts the ABSPATH guard after the file docblock, before the closing ?>:

Before:

<?php
/**
 * Builder lesson model view
 *
 * @since 3.16.0
 * @version 7.2.0
 */
?>
<script type="text/html" id="tmpl-llms-lesson-template">

After:

<?php
/**
 * Builder lesson model view
 *
 * @since 3.16.0
 * @version 7.2.0
 */
defined( 'ABSPATH' ) || exit;
?>
<script type="text/html" id="tmpl-llms-lesson-template">

Files: lesson.php, elements.php, question.php, question-type.php, editor.php, section.php, course.php, utilities.php, question-choice.php, assignment.php, sidebar.php, lesson-settings.php, quiz.php.

Access plan dialog template

The file contains no <?php opener, so the guard wraps the existing markup at the top of the file:

Before:

<div
	id="llms-access-plan-dialog"

After:

<?php defined( 'ABSPATH' ) || exit; ?>
<div
	id="llms-access-plan-dialog"

Order view function file

The guard sits between the file docblock and the function definition wrapper:

Before:

 * @since 6.0.0
 * @version 6.0.0
 */

if ( ! function_exists( 'llms_template_view_order' ) ) {

After:

 * @since 6.0.0
 * @version 6.0.0
 */

defined( 'ABSPATH' ) || exit;

if ( ! function_exists( 'llms_template_view_order' ) ) {

Why: Plugin Check rejects any PHP file under includes/, libraries/, or the plugin root that can be reached via a direct HTTP request without first going through the WordPress bootstrap. The one-liner is the standard pattern already used across the rest of the codebase (see includes/admin/views/access-plans/access-plan.php, includes/admin/views/dashboard.php, includes/functions/llms-functions-*.php).

Skipped

Two flagged files already have an equivalent guard and were not modified:

• libraries/lifterlms-cli/src/commands.php (uses defined( 'ABSPATH' ) || exit;)
• libraries/lifterlms-rest/uninstall.php (uses defined( 'ABSPATH' ) || exit;)

Testing

1. Run php -l on all 15 modified files: no syntax errors.
2. Run ./vendor/bin/phpcs --standard=phpcs.xml on all 15 files: exit 0, no warnings or errors.
3. Spot-check one builder template (includes/admin/views/builder/lesson.php) in the WP admin Course Builder screen: lesson list renders normally.
4. Spot-check the access plan dialog (includes/admin/views/access-plans/access-plan-dialog.php) in a course's access plan metabox: dialog opens and closes as before.

Build

No new build artifacts. Source-only change.