← All changes | includes/REST/Feedback.php +37 -41 4.6.1 → 3.8.9 View file →

		@@ -1,12 +1,8 @@
1	1	<?php
2		-// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- live reaction analytics writes; cache would defeat the purpose.
	2	+
3	3	namespace WPDeveloper\BetterDocs\REST;
4	4
5		-if ( ! defined( 'ABSPATH' ) ) {
6		- exit;
7		-}
8		-
9	5	use WP_REST_Request;
10	6	use WPDeveloper\BetterDocs\Core\BaseAPI;
11	7
12	8	class Feedback extends BaseAPI {
		@@ -104,26 +100,24 @@
104	100
105	101	public function analytics_by_post_id( $post_id ) {
106	102	global $wpdb;
107	103
	104	+ $where = "WHERE post_id='" . esc_sql( $post_id ) . "'";
108	105	return $wpdb->get_results(
109		- $wpdb->prepare(
110		- "SELECT
111		- sum(impressions) as totalViews,
112		- sum(unique_visit) as totalUniqueViews,
113		- sum(happy + sad + normal) as totalReactions,
114		- sum(happy) as totalHappy,
115		- sum(normal) as totalNormal,
116		- sum(sad) as totalSad
117		- FROM {$wpdb->prefix}betterdocs_analytics
118		- WHERE post_id = %d",
119		- (int) $post_id
120		- )
	106	+ "SELECT
	107	+ sum(impressions) as totalViews,
	108	+ sum(unique_visit) as totalUniqueViews,
	109	+ sum(happy + sad + normal) as totalReactions,
	110	+ sum(happy) as totalHappy,
	111	+ sum(normal) as totalNormal,
	112	+ sum(sad) as totalSad
	113	+ FROM {$wpdb->prefix}betterdocs_analytics
	114	+ $where"
121	115	);
122	116	}
123	117
124	118	public function get_word_count( $object, $field_name, $request ) {
125		- return str_word_count( trim( wp_strip_all_tags( get_post_field( 'post_content', $object['id'] ) ) ) );
	119	+ return str_word_count( trim( strip_tags( get_post_field( 'post_content', $object['id'] ) ) ) );
126	120	}
127	121
128	122	public function get_total_views( $object, $field_name, $request ) {
129	123	$analytics = $this->analytics_by_post_id( $object['id'] );
		@@ -154,45 +148,47 @@
154	148	}
155	149
156	150	public function save( WP_REST_Request $request ) {
157	151	global $wpdb;
158		- $docs_id = isset( $request['id'] ) ? (int) $request['id'] : null;
159		- $valid_feelings = [ 'happy', 'normal', 'sad' ];
160		- $requested_feeling = isset( $request['feelings'] ) ? (string) $request['feelings'] : 'happy';
161		- $feelings = in_array( $requested_feeling, $valid_feelings, true ) ? $requested_feeling : 'happy';
162		- $analytics_table = $wpdb->prefix . 'betterdocs_analytics';
	152	+ $docs_id = isset( $request['id'] ) ? esc_sql( intval( $request['id'] ) ) : null;
	153	+ $feelings = isset( $request['feelings'] ) ? esc_sql( $request['feelings'] ) : 'happy';
163	154	if ( $docs_id !== null && get_post( $docs_id ) && get_option( 'betterdocs_db_version' ) == true ) {
164		- // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction lookup, no cache layer applies.
165	155	$post_id = $wpdb->get_results(
166	156	$wpdb->prepare(
167		- "SELECT * FROM {$analytics_table} WHERE created_at = %s AND post_id = %d",
168		- gmdate( 'Y-m-d' ),
	157	+ "SELECT *
	158	+ FROM {$wpdb->prefix}betterdocs_analytics
	159	+ WHERE created_at = %s AND post_id = %d",
	160	+ date( 'Y-m-d' ),
169	161	$docs_id
170	162	)
171	163	);
172		- // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter
173	164
174	165	if ( ! empty( $post_id ) ) {
175		- $feelings_increment = (int) $post_id[0]->{$feelings} + 1;
176		- // $feelings is validated above against $valid_feelings allowlist — safe to interpolate as column identifier.
177		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction counter, no cache layer applies.
178		- $insert = $wpdb->query(
	166	+ $feelings_increment = $post_id[0]->{$feelings} + 1;
	167	+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	168	+ $insert = $wpdb->query(
179	169	$wpdb->prepare(
180		- "UPDATE {$analytics_table} SET {$feelings} = %d WHERE created_at = %s AND post_id = %d", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
181		- $feelings_increment,
182		- gmdate( 'Y-m-d' ),
183		- $docs_id
	170	+ "UPDATE {$wpdb->prefix}betterdocs_analytics
	171	+ SET " . $feelings . ' = ' . $feelings_increment . '
	172	+ WHERE created_at = %s AND post_id = %d',
	173	+ [
	174	+ date( 'Y-m-d' ),
	175	+ $docs_id
	176	+ ]
184	177	)
185	178	);
186	179	} else {
187		- // $feelings is validated above against $valid_feelings allowlist — safe to interpolate as column identifier.
188		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction counter, no cache layer applies.
	180	+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
189	181	$insert = $wpdb->query(
190	182	$wpdb->prepare(
191		- "INSERT INTO {$analytics_table} ( post_id, {$feelings}, created_at ) VALUES ( %d, %d, %s )", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
192		- $docs_id,
193		- 1,
194		- gmdate( 'Y-m-d' )
	183	+ "INSERT INTO {$wpdb->prefix}betterdocs_analytics
	184	+ ( post_id, " . $request['feelings'] . ', created_at )
	185	+ VALUES ( %d, %d, %s )',
	186	+ [
	187	+ $docs_id,
	188	+ 1,
	189	+ date( 'Y-m-d' )
	190	+ ]
195	191	)
196	192	);
197	193	}
198	194