← All changes | includes/REST/Feedback.php +85 -37 4.5.2 → 4.9.2 View file →

		@@ -1,7 +1,11 @@
1	1	<?php
	2	+// phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- live reaction analytics writes; cache would defeat the purpose.
	3	+namespace WPDeveloper\BetterDocs\REST;
2	4
3		-namespace WPDeveloper\BetterDocs\REST;
	5	+if ( ! defined( 'ABSPATH' ) ) {
	6	+ exit;
	7	+}
4	8
5	9	use WP_REST_Request;
6	10	use WPDeveloper\BetterDocs\Core\BaseAPI;
7	11
		@@ -6,8 +10,43 @@
6	10	use WPDeveloper\BetterDocs\Core\BaseAPI;
7	11
8	12	class Feedback extends BaseAPI {
9	13	/**
	14	+ * The reaction/feedback beacon is public (logged-out visitors react), so it is
	15	+ * gated by a wp_rest nonce the frontend sends via the X-WP-Nonce header —
	16	+ * mirroring the analytics view beacon ({@see REST\AnalyticsTracker}). Without
	17	+ * this it inherited BaseAPI::permission_check() (return true) and could be
	18	+ * scripted anonymously to forge reaction counts and flood the Pro feedback
	19	+ * table (one row per call via the betterdocs_feedback_recorded action). A light
	20	+ * salted-IP throttle bounds abuse even if a nonce is harvested from a page.
	21	+ */
	22	+ public function permission_check( $request = null ) {
	23	+ if ( ! $request instanceof WP_REST_Request ) {
	24	+ return false;
	25	+ }
	26	+
	27	+ $nonce = $request->get_header( 'x_wp_nonce' );
	28	+ if ( empty( $nonce ) ) {
	29	+ $nonce = $request->get_param( '_wpnonce' );
	30	+ }
	31	+ if ( ! wp_verify_nonce( $nonce, 'wp_rest' ) ) {
	32	+ return false;
	33	+ }
	34	+
	35	+ // Defense-in-depth: cap reactions per client (salted IP hash, raw IP never
	36	+ // stored) so a harvested nonce can't be scripted into a table flood.
	37	+ $ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
	38	+ $key = 'bd_feedback_rl_' . substr( wp_hash( $ip ), 0, 20 );
	39	+ $hits = (int) get_transient( $key );
	40	+ if ( $hits >= 120 ) {
	41	+ return new \WP_Error( 'bd_feedback_throttled', __( 'Too many reactions — please try again in a moment.', 'betterdocs' ), [ 'status' => 429 ] );
	42	+ }
	43	+ set_transient( $key, $hits + 1, 10 * MINUTE_IN_SECONDS );
	44	+
	45	+ return true;
	46	+ }
	47	+
	48	+ /**
10	49	* @return mixed
11	50	*/
12	51	public function register() {
13	52	$this->post(
		@@ -100,24 +139,26 @@
100	139
101	140	public function analytics_by_post_id( $post_id ) {
102	141	global $wpdb;
103	142
104		- $where = "WHERE post_id='" . esc_sql( $post_id ) . "'";
105	143	return $wpdb->get_results(
106		- "SELECT
107		- sum(impressions) as totalViews,
108		- sum(unique_visit) as totalUniqueViews,
109		- sum(happy + sad + normal) as totalReactions,
110		- sum(happy) as totalHappy,
111		- sum(normal) as totalNormal,
112		- sum(sad) as totalSad
113		- FROM {$wpdb->prefix}betterdocs_analytics
114		- $where"
	144	+ $wpdb->prepare(
	145	+ "SELECT
	146	+ sum(impressions) as totalViews,
	147	+ sum(unique_visit) as totalUniqueViews,
	148	+ sum(happy + sad + normal) as totalReactions,
	149	+ sum(happy) as totalHappy,
	150	+ sum(normal) as totalNormal,
	151	+ sum(sad) as totalSad
	152	+ FROM {$wpdb->prefix}betterdocs_analytics
	153	+ WHERE post_id = %d",
	154	+ (int) $post_id
	155	+ )
115	156	);
116	157	}
117	158
118	159	public function get_word_count( $object, $field_name, $request ) {
119		- return str_word_count( trim( strip_tags( get_post_field( 'post_content', $object['id'] ) ) ) );
	160	+ return str_word_count( trim( wp_strip_all_tags( get_post_field( 'post_content', $object['id'] ) ) ) );
120	161	}
121	162
122	163	public function get_total_views( $object, $field_name, $request ) {
123	164	$analytics = $this->analytics_by_post_id( $object['id'] );
		@@ -148,52 +189,59 @@
148	189	}
149	190
150	191	public function save( WP_REST_Request $request ) {
151	192	global $wpdb;
152		- $docs_id = isset( $request['id'] ) ? esc_sql( intval( $request['id'] ) ) : null;
153		- $feelings = isset( $request['feelings'] ) ? esc_sql( $request['feelings'] ) : 'happy';
	193	+ $docs_id = isset( $request['id'] ) ? (int) $request['id'] : null;
	194	+ $valid_feelings = [ 'happy', 'normal', 'sad' ];
	195	+ $requested_feeling = isset( $request['feelings'] ) ? (string) $request['feelings'] : 'happy';
	196	+ $feelings = in_array( $requested_feeling, $valid_feelings, true ) ? $requested_feeling : 'happy';
	197	+ $analytics_table = $wpdb->prefix . 'betterdocs_analytics';
154	198	if ( $docs_id !== null && get_post( $docs_id ) && get_option( 'betterdocs_db_version' ) == true ) {
	199	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction lookup, no cache layer applies.
155	200	$post_id = $wpdb->get_results(
156	201	$wpdb->prepare(
157		- "SELECT *
158		- FROM {$wpdb->prefix}betterdocs_analytics
159		- WHERE created_at = %s AND post_id = %d",
160		- date( 'Y-m-d' ),
	202	+ "SELECT * FROM {$analytics_table} WHERE created_at = %s AND post_id = %d",
	203	+ gmdate( 'Y-m-d' ),
161	204	$docs_id
162	205	)
163	206	);
	207	+ // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,PluginCheck.Security.DirectDB.UnescapedDBParameter
164	208
165	209	if ( ! empty( $post_id ) ) {
166		- $feelings_increment = $post_id[0]->{$feelings} + 1;
167		- // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
168		- $insert = $wpdb->query(
	210	+ $feelings_increment = (int) $post_id[0]->{$feelings} + 1;
	211	+ // $feelings is validated above against $valid_feelings allowlist — safe to interpolate as column identifier.
	212	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction counter, no cache layer applies.
	213	+ $insert = $wpdb->query(
169	214	$wpdb->prepare(
170		- "UPDATE {$wpdb->prefix}betterdocs_analytics
171		- SET " . $feelings . ' = ' . $feelings_increment . '
172		- WHERE created_at = %s AND post_id = %d',
173		- [
174		- date( 'Y-m-d' ),
175		- $docs_id
176		- ]
	215	+ "UPDATE {$analytics_table} SET {$feelings} = %d WHERE created_at = %s AND post_id = %d", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	216	+ $feelings_increment,
	217	+ gmdate( 'Y-m-d' ),
	218	+ $docs_id
177	219	)
178	220	);
179	221	} else {
180		- // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	222	+ // $feelings is validated above against $valid_feelings allowlist — safe to interpolate as column identifier.
	223	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $analytics_table = $wpdb->prefix + literal; per-request reaction counter, no cache layer applies.
181	224	$insert = $wpdb->query(
182	225	$wpdb->prepare(
183		- "INSERT INTO {$wpdb->prefix}betterdocs_analytics
184		- ( post_id, " . $request['feelings'] . ', created_at )
185		- VALUES ( %d, %d, %s )',
186		- [
187		- $docs_id,
188		- 1,
189		- date( 'Y-m-d' )
190		- ]
	226	+ "INSERT INTO {$analytics_table} ( post_id, {$feelings}, created_at ) VALUES ( %d, %d, %s )", // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	227	+ $docs_id,
	228	+ 1,
	229	+ gmdate( 'Y-m-d' )
191	230	)
192	231	);
193	232	}
194	233
195	234	if ( $insert == true ) {
	235	+ /**
	236	+ * Fires after a reaction is recorded into the daily aggregate.
	237	+ * Pro hooks this to write a per-item row into the feedback inbox
	238	+ * table (betterdocs_analytics_feedback).
	239	+ *
	240	+ * @param int $docs_id Doc post id.
	241	+ * @param string $feelings happy|sad|normal.
	242	+ */
	243	+ do_action( 'betterdocs_feedback_recorded', (int) $docs_id, $feelings );
196	244	return true;
197	245	}
198	246	}
199	247	return false;