| @@ -49,10 +49,12 @@ | ||
| 49 | 49 | 'required' => true, |
| 50 | 50 | 'type' => 'string', |
| 51 | 51 | 'description' => 'Post type to search.', |
| 52 | 52 | 'sanitize_callback' => 'sanitize_key', |
| 53 | + // Public route: only a post type visitors can already | |
| 54 | + // see may be searched, never an internal one. | |
| 53 | 55 | 'validate_callback' => function( $param ) { |
| 54 | - return $param === 'any' || post_type_exists( $param ); | |
| 56 | + return 'any' === $param || is_post_type_viewable( (string) $param ); | |
| 55 | 57 | }, |
| 56 | 58 | ), |
| 57 | 59 | ), |
| 58 | 60 | ) |
| @@ -66,9 +68,11 @@ | ||
| 66 | 68 | $current_page_id = $request->get_param( 'current_page_id' ); |
| 67 | 69 | |
| 68 | 70 | $args = array( |
| 69 | 71 | 's' => $searchQuery, |
| 70 | - 'posts_per_page' => -1, | |
| 72 | + // A public, repeatable request must not render every matching post. | |
| 73 | + 'posts_per_page' => max( 1, (int) apply_filters( 'ablocks/search/max_results', 20, $source ) ), | |
| 74 | + 'no_found_rows' => true, | |
| 71 | 75 | 'post_type' => $source, |
| 72 | 76 | 'post_status' => 'publish', |
| 73 | 77 | ); |
| 74 | 78 | |
