← All changes | includes/REST/Feedback.php +37 -85 4.8.2 → 3.8.9 View file →

		@@ -1,52 +1,13 @@
1	1	<?php
2		-// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- live reaction analytics writes; cache would defeat the purpose.
	2	+
3	3	namespace WPDeveloper\BetterDocs\REST;
4	4
5		-if ( ! defined( 'ABSPATH' ) ) {
6		- exit;
7		-}
8		-
9	5	use WP_REST_Request;
10	6	use WPDeveloper\BetterDocs\Core\BaseAPI;
11	7
12	8	class Feedback extends BaseAPI {
13	9	/**
14		- * The reaction/feedback beacon is public (logged-out visitors react), so it is
15		- * gated by a wp_rest nonce the frontend sends via the X-WP-Nonce header —
16		- * mirroring the analytics view beacon ({@see REST\AnalyticsTracker}). Without
17		- * this it inherited BaseAPI::permission_check() (return true) and could be
18		- * scripted anonymously to forge reaction counts and flood the Pro feedback
19		- * table (one row per call via the betterdocs_feedback_recorded action). A light
20		- * salted-IP throttle bounds abuse even if a nonce is harvested from a page.
21		- */
22		- public function permission_check( $request = null ) {
23		- if ( ! $request instanceof WP_REST_Request ) {
24		- return false;
25		- }
26		-
27		- $nonce = $request->get_header( 'x_wp_nonce' );
28		- if ( empty( $nonce ) ) {
29		- $nonce = $request->get_param( '_wpnonce' );
30		- }
31		- if ( ! wp_verify_nonce( $nonce, 'wp_rest' ) ) {
32		- return false;
33		- }
34		-
35		- // Defense-in-depth: cap reactions per client (salted IP hash, raw IP never
36		- // stored) so a harvested nonce can't be scripted into a table flood.
37		- $ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
38		- $key = 'bd_feedback_rl_' . substr( wp_hash( $ip ), 0, 20 );
39		- $hits = (int) get_transient( $key );
40		- if ( $hits >= 120 ) {
41		- return new \WP_Error( 'bd_feedback_throttled', __( 'Too many reactions — please try again in a moment.', 'betterdocs' ), [ 'status' => 429 ] );
42		- }
43		- set_transient( $key, $hits + 1, 10 * MINUTE_IN_SECONDS );
44		-
45		- return true;
46		- }
47		-
48		- /**
49	10	* @return mixed
50	11	*/
51	12	public function register() {
52	13	$this->post(
		@@ -139,26 +100,24 @@
139	100
140	101	public function analytics_by_post_id( $post_id ) {
141	102	global $wpdb;
142	103
	104	+ $where = "WHERE post_id='" . esc_sql( $post_id ) . "'";
143	105	return $wpdb->get_results(
144		- $wpdb->prepare(
145		- "SELECT
146		- sum(impressions) as totalViews,
147		- sum(unique_visit) as totalUniqueViews,
148		- sum(happy + sad + normal) as totalReactions,
149		- sum(happy) as totalHappy,
150		- sum(normal) as totalNormal,
151		- sum(sad) as totalSad
152		- FROM {$wpdb->prefix}betterdocs_analytics
153		- WHERE post_id = %d",
154		- (int) $post_id
155		- )
	106	+ "SELECT
	107	+ sum(impressions) as totalViews,
	108	+ sum(unique_visit) as totalUniqueViews,
	109	+ sum(happy + sad + normal) as totalReactions,
	110	+ sum(happy) as totalHappy,
	111	+ sum(normal) as totalNormal,
	112	+ sum(sad) as totalSad
	113	+ FROM {$wpdb->prefix}betterdocs_analytics
	114	+ $where"
156	115	);
157	116	}
158	117
159	118	public function get_word_count( $object, $field_name, $request ) {
160		- return str_word_count( trim( wp_strip_all_tags( get_post_field( 'post_content', $object['id'] ) ) ) );
	119	+ return str_word_count( trim( strip_tags( get_post_field( 'post_content', $object['id'] ) ) ) );
161	120	}
162	121
163	122	public function get_total_views( $object, $field_name, $request ) {
164	123	$analytics = $this->analytics_by_post_id( $object['id'] );
		@@ -189,59 +148,52 @@
189	148	}
190	149
191	150	public function save( WP_REST_Request $request ) {
192	151	global $wpdb;
193		- $docs_id = isset( $request['id'] ) ? (int) $request['id'] : null;
194		- $valid_feelings = [ 'happy', 'normal', 'sad' ];
195		- $requested_feeling = isset( $request['feelings'] ) ? (string) $request['feelings'] : 'happy';
196		- $feelings = in_array( $requested_feeling, $valid_feelings, true ) ? $requested_feeling : 'happy';
197		- $analytics_table = $wpdb->prefix . 'betterdocs_analytics';
	152	+ $docs_id = isset( $request['id'] ) ? esc_sql( intval( $request['id'] ) ) : null;
	153	+ $feelings = isset( $request['feelings'] ) ? esc_sql( $request['feelings'] ) : 'happy';
198	154	if ( $docs_id !== null && get_post( $docs_id ) && get_option( 'betterdocs_db_version' ) == true ) {
199		- // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction lookup, no cache layer applies.
200	155	$post_id = $wpdb->get_results(
201	156	$wpdb->prepare(
202		- "SELECT * FROM {$analytics_table} WHERE created_at = %s AND post_id = %d",
203		- gmdate( 'Y-m-d' ),
	157	+ "SELECT *
	158	+ FROM {$wpdb->prefix}betterdocs_analytics
	159	+ WHERE created_at = %s AND post_id = %d",
	160	+ date( 'Y-m-d' ),
204	161	$docs_id
205	162	)
206	163	);
207		- // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter
208	164
209	165	if ( ! empty( $post_id ) ) {
210		- $feelings_increment = (int) $post_id[0]->{$feelings} + 1;
211		- // $feelings is validated above against $valid_feelings allowlist — safe to interpolate as column identifier.
212		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction counter, no cache layer applies.
213		- $insert = $wpdb->query(
	166	+ $feelings_increment = $post_id[0]->{$feelings} + 1;
	167	+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	168	+ $insert = $wpdb->query(
214	169	$wpdb->prepare(
215		- "UPDATE {$analytics_table} SET {$feelings} = %d WHERE created_at = %s AND post_id = %d", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
216		- $feelings_increment,
217		- gmdate( 'Y-m-d' ),
218		- $docs_id
	170	+ "UPDATE {$wpdb->prefix}betterdocs_analytics
	171	+ SET " . $feelings . ' = ' . $feelings_increment . '
	172	+ WHERE created_at = %s AND post_id = %d',
	173	+ [
	174	+ date( 'Y-m-d' ),
	175	+ $docs_id
	176	+ ]
219	177	)
220	178	);
221	179	} else {
222		- // $feelings is validated above against $valid_feelings allowlist — safe to interpolate as column identifier.
223		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction counter, no cache layer applies.
	180	+ // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
224	181	$insert = $wpdb->query(
225	182	$wpdb->prepare(
226		- "INSERT INTO {$analytics_table} ( post_id, {$feelings}, created_at ) VALUES ( %d, %d, %s )", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
227		- $docs_id,
228		- 1,
229		- gmdate( 'Y-m-d' )
	183	+ "INSERT INTO {$wpdb->prefix}betterdocs_analytics
	184	+ ( post_id, " . $request['feelings'] . ', created_at )
	185	+ VALUES ( %d, %d, %s )',
	186	+ [
	187	+ $docs_id,
	188	+ 1,
	189	+ date( 'Y-m-d' )
	190	+ ]
230	191	)
231	192	);
232	193	}
233	194
234	195	if ( $insert == true ) {
235		- /**
236		- * Fires after a reaction is recorded into the daily aggregate.
237		- * Pro hooks this to write a per-item row into the feedback inbox
238		- * table (betterdocs_analytics_feedback).
239		- *
240		- * @param int $docs_id Doc post id.
241		- * @param string $feelings happy|sad|normal.
242		- */
243		- do_action( 'betterdocs_feedback_recorded', (int) $docs_id, $feelings );
244	196	return true;
245	197	}
246	198	}
247	199	return false;