| @@ -1,291 +1,82 @@ | ||
| 1 | 1 | <?php |
| 2 | -// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- live reaction analytics writes; cache would defeat the purpose. | |
| 2 | + | |
| 3 | 3 | namespace WPDeveloper\BetterDocs\REST; |
| 4 | - | |
| 5 | -if ( ! defined( 'ABSPATH' ) ) { | |
| 6 | - exit; | |
| 7 | -} | |
| 8 | - | |
| 9 | 4 | use WP_REST_Request; |
| 10 | 5 | use WPDeveloper\BetterDocs\Core\BaseAPI; |
| 11 | 6 | |
| 12 | 7 | class Feedback extends BaseAPI { |
| 13 | - /** | |
| 14 | - * The reaction/feedback beacon is public (logged-out visitors react), so it is | |
| 15 | - * gated by a wp_rest nonce the frontend sends via the X-WP-Nonce header — | |
| 16 | - * mirroring the analytics view beacon ({@see REST\AnalyticsTracker}). Without | |
| 17 | - * this it inherited BaseAPI::permission_check() (return true) and could be | |
| 18 | - * scripted anonymously to forge reaction counts and flood the Pro feedback | |
| 19 | - * table (one row per call via the betterdocs_feedback_recorded action). A light | |
| 20 | - * salted-IP throttle bounds abuse even if a nonce is harvested from a page. | |
| 21 | - */ | |
| 22 | - public function permission_check( $request = null ) { | |
| 23 | - if ( ! $request instanceof WP_REST_Request ) { | |
| 24 | - return false; | |
| 25 | - } | |
| 8 | + /** | |
| 9 | + * @return mixed | |
| 10 | + */ | |
| 11 | + public function register() { | |
| 12 | + $this->post( '/feedback/(?P<id>\d+)', [$this, 'save'], [ | |
| 13 | + 'id' => [ | |
| 14 | + 'type' => 'integer', | |
| 15 | + 'validate_callback' => function ( $param, $request, $key ) { | |
| 16 | + return ! empty( $param ) && is_numeric( $param ) && get_post( $param ) !== null; | |
| 17 | + }, | |
| 18 | + 'required' => false, | |
| 19 | + 'default' => null | |
| 20 | + ], | |
| 21 | + 'feelings' => [ | |
| 22 | + 'type' => 'string', | |
| 23 | + 'validate_callback' => function ( $param, $request, $key ) { | |
| 24 | + $allowed_feelings = [ 'happy', 'sad', 'normal' ]; | |
| 25 | + return in_array( $param, $allowed_feelings ); | |
| 26 | + }, | |
| 27 | + 'required' => true | |
| 28 | + ] | |
| 29 | + ] ); | |
| 30 | + } | |
| 26 | 31 | |
| 27 | - $nonce = $request->get_header( 'x_wp_nonce' ); | |
| 28 | - if ( empty( $nonce ) ) { | |
| 29 | - $nonce = $request->get_param( '_wpnonce' ); | |
| 30 | - } | |
| 31 | - if ( ! wp_verify_nonce( $nonce, 'wp_rest' ) ) { | |
| 32 | - return false; | |
| 33 | - } | |
| 32 | + public function save( WP_REST_Request $request ) { | |
| 33 | + global $wpdb; | |
| 34 | + $docs_id = isset( $request['id'] ) ? esc_sql( intval( $request['id'] ) ) : null; | |
| 35 | + $feelings = isset( $request['feelings'] ) ? esc_sql( $request['feelings'] ) : 'happy'; | |
| 36 | + if ( $docs_id !== null && get_post( $docs_id ) && get_option( 'betterdocs_db_version' ) == true ) { | |
| 37 | + $post_id = $wpdb->get_results( | |
| 38 | + $wpdb->prepare( | |
| 39 | + "SELECT * | |
| 40 | + FROM {$wpdb->prefix}betterdocs_analytics | |
| 41 | + WHERE created_at = %s AND post_id = %d", | |
| 42 | + date( 'Y-m-d' ), | |
| 43 | + $docs_id | |
| 44 | + ) | |
| 45 | + ); | |
| 34 | 46 | |
| 35 | - // Defense-in-depth: cap reactions per client (salted IP hash, raw IP never | |
| 36 | - // stored) so a harvested nonce can't be scripted into a table flood. | |
| 37 | - $ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : ''; | |
| 38 | - $key = 'bd_feedback_rl_' . substr( wp_hash( $ip ), 0, 20 ); | |
| 39 | - $hits = (int) get_transient( $key ); | |
| 40 | - if ( $hits >= 120 ) { | |
| 41 | - return new \WP_Error( 'bd_feedback_throttled', __( 'Too many reactions — please try again in a moment.', 'betterdocs' ), [ 'status' => 429 ] ); | |
| 42 | - } | |
| 43 | - set_transient( $key, $hits + 1, 10 * MINUTE_IN_SECONDS ); | |
| 47 | + if ( ! empty( $post_id ) ) { | |
| 48 | + $feelings_increment = $post_id[0]->{$feelings}+1; | |
| 44 | 49 | |
| 45 | - return true; | |
| 46 | - } | |
| 50 | + $insert = $wpdb->query( | |
| 51 | + $wpdb->prepare( | |
| 52 | + "UPDATE {$wpdb->prefix}betterdocs_analytics | |
| 53 | + SET " . $feelings . " = " . $feelings_increment . " | |
| 54 | + WHERE created_at = %s AND post_id = %d", | |
| 55 | + [ | |
| 56 | + date( 'Y-m-d' ), | |
| 57 | + $docs_id | |
| 58 | + ] | |
| 59 | + ) | |
| 60 | + ); | |
| 61 | + } else { | |
| 62 | + $insert = $wpdb->query( | |
| 63 | + $wpdb->prepare( | |
| 64 | + "INSERT INTO {$wpdb->prefix}betterdocs_analytics | |
| 65 | + ( post_id, " . $request['feelings'] . ", created_at ) | |
| 66 | + VALUES ( %d, %d, %s )", | |
| 67 | + [ | |
| 68 | + $docs_id, | |
| 69 | + 1, | |
| 70 | + date( 'Y-m-d' ) | |
| 71 | + ] | |
| 72 | + ) | |
| 73 | + ); | |
| 74 | + } | |
| 47 | 75 | |
| 48 | - /** | |
| 49 | - * @return mixed | |
| 50 | - */ | |
| 51 | - public function register() { | |
| 52 | - $this->post( | |
| 53 | - '/feedback/(?P<id>\d+)', | |
| 54 | - [ $this, 'save' ], | |
| 55 | - [ | |
| 56 | - 'id' => [ | |
| 57 | - 'type' => 'integer', | |
| 58 | - 'validate_callback' => function ( $param, $request, $key ) { | |
| 59 | - return ! empty( $param ) && is_numeric( $param ) && get_post( $param ) !== null; | |
| 60 | - }, | |
| 61 | - 'required' => false, | |
| 62 | - 'default' => null | |
| 63 | - ], | |
| 64 | - 'feelings' => [ | |
| 65 | - 'type' => 'string', | |
| 66 | - 'validate_callback' => function ( $param, $request, $key ) { | |
| 67 | - $allowed_feelings = [ 'happy', 'sad', 'normal' ]; | |
| 68 | - return in_array( $param, $allowed_feelings ); | |
| 69 | - }, | |
| 70 | - 'required' => true | |
| 71 | - ] | |
| 72 | - ] | |
| 73 | - ); | |
| 74 | - | |
| 75 | - $this->register_field( | |
| 76 | - 'docs', | |
| 77 | - 'word_count', | |
| 78 | - [ | |
| 79 | - 'get_callback' => [ $this, 'get_word_count' ] | |
| 80 | - ] | |
| 81 | - ); | |
| 82 | - | |
| 83 | - $this->register_field( | |
| 84 | - 'docs', | |
| 85 | - 'total_views', | |
| 86 | - [ | |
| 87 | - 'get_callback' => [ $this, 'get_total_views' ] | |
| 88 | - ] | |
| 89 | - ); | |
| 90 | - | |
| 91 | - $this->register_field( | |
| 92 | - 'docs', | |
| 93 | - 'reactions', | |
| 94 | - [ | |
| 95 | - 'get_callback' => [ $this, 'get_reaction_count' ] | |
| 96 | - ] | |
| 97 | - ); | |
| 98 | - | |
| 99 | - $this->register_field( | |
| 100 | - 'docs', | |
| 101 | - 'author_info', | |
| 102 | - [ | |
| 103 | - 'get_callback' => [ $this, 'get_author_info' ] | |
| 104 | - ] | |
| 105 | - ); | |
| 106 | - | |
| 107 | - $this->register_field( | |
| 108 | - 'docs', | |
| 109 | - 'doc_category_info', | |
| 110 | - [ | |
| 111 | - 'get_callback' => [ $this, 'get_doc_category_info' ] | |
| 112 | - ] | |
| 113 | - ); | |
| 114 | - | |
| 115 | - $this->register_field( | |
| 116 | - 'docs', | |
| 117 | - 'doc_tag_info', | |
| 118 | - [ | |
| 119 | - 'get_callback' => [ $this, 'get_doc_tag_info' ] | |
| 120 | - ] | |
| 121 | - ); | |
| 122 | - | |
| 123 | - // $this->register_field( 'docs', 'author_list', [ | |
| 124 | - // 'get_callback' => [$this, 'get_author_list'] | |
| 125 | - // ] ); | |
| 126 | - } | |
| 127 | - | |
| 128 | - public function get_author_list( $object, $field_name, $request ) { | |
| 129 | - $args = [ | |
| 130 | - 'fields' => [ | |
| 131 | - 'ID', | |
| 132 | - 'user_login', | |
| 133 | - 'display_name' | |
| 134 | - ] | |
| 135 | - ]; | |
| 136 | - $users = get_users( $args ); | |
| 137 | - return $users; | |
| 138 | - } | |
| 139 | - | |
| 140 | - public function analytics_by_post_id( $post_id ) { | |
| 141 | - global $wpdb; | |
| 142 | - | |
| 143 | - return $wpdb->get_results( | |
| 144 | - $wpdb->prepare( | |
| 145 | - "SELECT | |
| 146 | - sum(impressions) as totalViews, | |
| 147 | - sum(unique_visit) as totalUniqueViews, | |
| 148 | - sum(happy + sad + normal) as totalReactions, | |
| 149 | - sum(happy) as totalHappy, | |
| 150 | - sum(normal) as totalNormal, | |
| 151 | - sum(sad) as totalSad | |
| 152 | - FROM {$wpdb->prefix}betterdocs_analytics | |
| 153 | - WHERE post_id = %d", | |
| 154 | - (int) $post_id | |
| 155 | - ) | |
| 156 | - ); | |
| 157 | - } | |
| 158 | - | |
| 159 | - public function get_word_count( $object, $field_name, $request ) { | |
| 160 | - return str_word_count( trim( wp_strip_all_tags( get_post_field( 'post_content', $object['id'] ) ) ) ); | |
| 161 | - } | |
| 162 | - | |
| 163 | - public function get_total_views( $object, $field_name, $request ) { | |
| 164 | - $analytics = $this->analytics_by_post_id( $object['id'] ); | |
| 165 | - | |
| 166 | - if ( ! empty( $analytics ) ) { | |
| 167 | - return isset( $analytics[0]->totalViews ) ? $analytics[0]->totalViews : 0; | |
| 168 | - } else { | |
| 169 | - return 0; | |
| 170 | - } | |
| 171 | - } | |
| 172 | - | |
| 173 | - public function get_reaction_count( $object, $field_name, $request ) { | |
| 174 | - $analytics = $this->analytics_by_post_id( $object['id'] ); | |
| 175 | - | |
| 176 | - if ( ! empty( $analytics ) ) { | |
| 177 | - return [ | |
| 178 | - 'happy' => isset( $analytics[0]->totalHappy ) ? $analytics[0]->totalHappy : 0, | |
| 179 | - 'normal' => isset( $analytics[0]->totalNormal ) ? $analytics[0]->totalNormal : 0, | |
| 180 | - 'sad' => isset( $analytics[0]->totalSad ) ? $analytics[0]->totalSad : 0 | |
| 181 | - ]; | |
| 182 | - } else { | |
| 183 | - return [ | |
| 184 | - 'happy' => 0, | |
| 185 | - 'normal' => 0, | |
| 186 | - 'sad' => 0 | |
| 187 | - ]; | |
| 188 | - } | |
| 189 | - } | |
| 190 | - | |
| 191 | - public function save( WP_REST_Request $request ) { | |
| 192 | - global $wpdb; | |
| 193 | - $docs_id = isset( $request['id'] ) ? (int) $request['id'] : null; | |
| 194 | - $valid_feelings = [ 'happy', 'normal', 'sad' ]; | |
| 195 | - $requested_feeling = isset( $request['feelings'] ) ? (string) $request['feelings'] : 'happy'; | |
| 196 | - $feelings = in_array( $requested_feeling, $valid_feelings, true ) ? $requested_feeling : 'happy'; | |
| 197 | - $analytics_table = $wpdb->prefix . 'betterdocs_analytics'; | |
| 198 | - if ( $docs_id !== null && get_post( $docs_id ) && get_option( 'betterdocs_db_version' ) == true ) { | |
| 199 | - // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction lookup, no cache layer applies. | |
| 200 | - $post_id = $wpdb->get_results( | |
| 201 | - $wpdb->prepare( | |
| 202 | - "SELECT * FROM {$analytics_table} WHERE created_at = %s AND post_id = %d", | |
| 203 | - gmdate( 'Y-m-d' ), | |
| 204 | - $docs_id | |
| 205 | - ) | |
| 206 | - ); | |
| 207 | - // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter | |
| 208 | - | |
| 209 | - if ( ! empty( $post_id ) ) { | |
| 210 | - $feelings_increment = (int) $post_id[0]->{$feelings} + 1; | |
| 211 | - // $feelings is validated above against $valid_feelings allowlist — safe to interpolate as column identifier. | |
| 212 | - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction counter, no cache layer applies. | |
| 213 | - $insert = $wpdb->query( | |
| 214 | - $wpdb->prepare( | |
| 215 | - "UPDATE {$analytics_table} SET {$feelings} = %d WHERE created_at = %s AND post_id = %d", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| 216 | - $feelings_increment, | |
| 217 | - gmdate( 'Y-m-d' ), | |
| 218 | - $docs_id | |
| 219 | - ) | |
| 220 | - ); | |
| 221 | - } else { | |
| 222 | - // $feelings is validated above against $valid_feelings allowlist — safe to interpolate as column identifier. | |
| 223 | - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction counter, no cache layer applies. | |
| 224 | - $insert = $wpdb->query( | |
| 225 | - $wpdb->prepare( | |
| 226 | - "INSERT INTO {$analytics_table} ( post_id, {$feelings}, created_at ) VALUES ( %d, %d, %s )", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| 227 | - $docs_id, | |
| 228 | - 1, | |
| 229 | - gmdate( 'Y-m-d' ) | |
| 230 | - ) | |
| 231 | - ); | |
| 232 | - } | |
| 233 | - | |
| 234 | - if ( $insert == true ) { | |
| 235 | - /** | |
| 236 | - * Fires after a reaction is recorded into the daily aggregate. | |
| 237 | - * Pro hooks this to write a per-item row into the feedback inbox | |
| 238 | - * table (betterdocs_analytics_feedback). | |
| 239 | - * | |
| 240 | - * @param int $docs_id Doc post id. | |
| 241 | - * @param string $feelings happy|sad|normal. | |
| 242 | - */ | |
| 243 | - do_action( 'betterdocs_feedback_recorded', (int) $docs_id, $feelings ); | |
| 244 | - return true; | |
| 245 | - } | |
| 246 | - } | |
| 247 | - return false; | |
| 248 | - } | |
| 249 | - | |
| 250 | - public function get_author_info( $object, $field_name, $request ) { | |
| 251 | - $author_id = isset( $object['author'] ) ? $object['author'] : ''; | |
| 252 | - if ( ! empty( $author_id ) ) { | |
| 253 | - return [ | |
| 254 | - 'name' => get_the_author_meta( 'display_name', $author_id ), | |
| 255 | - 'author_nicename' => get_the_author_meta( 'nicename', $author_id ), | |
| 256 | - 'author_url' => get_author_posts_url( $author_id ) | |
| 257 | - ]; | |
| 258 | - } | |
| 259 | - return []; | |
| 260 | - } | |
| 261 | - | |
| 262 | - public function get_doc_category_info( $object, $field_name, $request ) { | |
| 263 | - $category_term_names = []; | |
| 264 | - $doc_categories = ! empty( $object['doc_category'] ) ? $object['doc_category'] : []; | |
| 265 | - foreach ( $doc_categories as $doc_category_id ) { | |
| 266 | - array_push( | |
| 267 | - $category_term_names, | |
| 268 | - [ | |
| 269 | - 'term_name' => get_term( $doc_category_id )->name, | |
| 270 | - 'term_url' => get_term_link( $doc_category_id ) | |
| 271 | - ] | |
| 272 | - ); | |
| 273 | - } | |
| 274 | - return $category_term_names; | |
| 275 | - } | |
| 276 | - | |
| 277 | - public function get_doc_tag_info( $object, $field_name, $request ) { | |
| 278 | - $doc_tag_term_names = []; | |
| 279 | - $doc_tags = ! empty( $object['doc_tag'] ) ? $object['doc_tag'] : []; | |
| 280 | - foreach ( $doc_tags as $tag_id ) { | |
| 281 | - array_push( | |
| 282 | - $doc_tag_term_names, | |
| 283 | - [ | |
| 284 | - 'term_name' => get_term( $tag_id )->name, | |
| 285 | - 'term_url' => get_term_link( $tag_id ) | |
| 286 | - ] | |
| 287 | - ); | |
| 288 | - } | |
| 289 | - return $doc_tag_term_names; | |
| 290 | - } | |
| 76 | + if ( $insert == true ) { | |
| 77 | + return true; | |
| 78 | + } | |
| 79 | + } | |
| 80 | + return false; | |
| 81 | + } | |
| 291 | 82 | } |
