← All changes | includes/Shortcodes/SearchForm.php +41 -26 4.5.2 → 4.9.2 View file →

		@@ -1,8 +1,12 @@
1	1	<?php
	2	+namespace WPDeveloper\BetterDocs\Shortcodes;
2	3
3		-namespace WPDeveloper\BetterDocs\Shortcodes;
	4	+if ( ! defined( 'ABSPATH' ) ) {
	5	+ exit;
	6	+}
4	7
	8	+
5	9	use WPDeveloper\BetterDocs\Core\Query;
6	10	use WPDeveloper\BetterDocs\Utils\Helper;
7	11	use WPDeveloper\BetterDocs\Core\Settings;
8	12	use WPDeveloper\BetterDocs\Core\Shortcode;
		@@ -64,13 +68,17 @@
64	68	$current_lang = $lang_codes['current_language'];
65	69
66	70	// Only search in translation table if current language is different from default
67	71	if ( $default_lang !== $current_lang ) {
	72	+ $default_lang = preg_replace( '/[^a-z0-9_]/', '', $default_lang );
	73	+ $current_lang = preg_replace( '/[^a-z0-9_]/', '', $current_lang );
68	74	// TranslatePress table naming: wp_trp_dictionary_{default_lang}_{current_lang}
69	75	$trp_table = $wpdb->prefix . 'trp_dictionary_' . $default_lang . '_' . $current_lang;
70		-
	76	+
71	77	if ( $this->table_exists( $trp_table ) ) {
72		-
	78	+ // $trp_table is composed from $wpdb->prefix + sanitized lang slugs (preg_replace allowlist above);
	79	+ // $like is esc_like()-wrapped with intentional % wildcards; CONCAT() wildcards are query literals, not user input.
	80	+ // phpcs:disable WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQuery,WordPress.DB.PreparedSQL.InterpolatedNotPrepared
73	81	$trp_search = $wpdb->prepare(
74	82	" OR EXISTS (
75	83	SELECT 1 FROM {$trp_table} trp
76	84	WHERE (trp.original LIKE %s OR trp.translated LIKE %s)
		@@ -83,9 +91,10 @@
83	91	)",
84	92	$like,
85	93	$like
86	94	);
87		-
	95	+ // phpcs:enable WordPress.DB.PreparedSQLPlaceholders.LikeWildcardsInQuery,WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	96	+
88	97	$search .= $trp_search;
89	98	}
90	99	}
91	100	}
		@@ -136,8 +145,9 @@
136	145	* Check if a database table exists
137	146	*/
138	147	private function table_exists( $table_name ) {
139	148	global $wpdb;
	149	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- schema check, caching would mask plugin-activation state.
140	150	$result = $wpdb->get_var( $wpdb->prepare( "SHOW TABLES LIKE %s", $table_name ) );
141	151	return $result === $table_name;
142	152	}
143	153
		@@ -156,12 +166,14 @@
156	166	}
157	167
158	168	public function get_search_results() {
159	169	global $wpdb;
160		- $search_input = isset( $_POST['search_input'] ) ? sanitize_text_field( $_POST['search_input'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing
161		- $search_cat = isset( $_POST['search_cat'] ) ? wp_strip_all_tags( $_POST['search_cat'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing
162		- $lang = isset( $_POST['lang'] ) ? wp_strip_all_tags( $_POST['lang'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing
163		- $kb_slug = isset( $_POST['kb_slug'] ) ? sanitize_text_field( $_POST['kb_slug'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing
	170	+ // phpcs:disable WordPress.Security.NonceVerification.Missing -- public live-search endpoint, no state change.
	171	+ $search_input = isset( $_POST['search_input'] ) ? sanitize_text_field( wp_unslash( $_POST['search_input'] ) ) : '';
	172	+ $search_cat = isset( $_POST['search_cat'] ) ? wp_strip_all_tags( wp_unslash( $_POST['search_cat'] ) ) : '';
	173	+ $lang = isset( $_POST['lang'] ) ? wp_strip_all_tags( wp_unslash( $_POST['lang'] ) ) : '';
	174	+ $kb_slug = isset( $_POST['kb_slug'] ) ? sanitize_text_field( wp_unslash( $_POST['kb_slug'] ) ) : '';
	175	+ // phpcs:enable WordPress.Security.NonceVerification.Missing
164	176
165	177	$tax_query = [];
166	178	if ( $search_cat ) {
167	179	$tax_query = [
		@@ -185,18 +197,20 @@
185	197	if( current_user_can( 'read_private_docs' ) ) {
186	198	array_push($post_status, 'private');
187	199	}
188	200
	201	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_tax_query -- search query supports user-selected category filter.
189	202	$args = [
190		- 'term_id' => isset( $term->term_id ) ? $term->term_id : 0,
191		- 'post_type' => 'docs',
192		- 'post_status' => $post_status,
193		- 'posts_per_page' => -1,
194		- 'suppress_filters' => false,
195		- 's' => $search_input,
196		- 'orderby' => 'relevance',
197		- 'tax_query' => $tax_query,
198		- 'kb_slug' => $kb_slug
	203	+ 'term_id' => isset( $term->term_id ) ? $term->term_id : 0,
	204	+ 'post_type' => 'docs',
	205	+ 'post_status' => $post_status,
	206	+ 'posts_per_page' => -1,
	207	+ 'suppress_filters' => false, // Changed to false to allow posts_search filter
	208	+ 's' => $search_input,
	209	+ 'orderby' => 'relevance',
	210	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_tax_query -- category-scoped search is a core BetterDocs feature; the taxonomy filter is intrinsic to the query.
	211	+ 'tax_query' => $tax_query,
	212	+ 'kb_slug' => $kb_slug // Pass kb_slug for filter hooks
199	213	];
200	214
201	215	// Handle WPML multilingual search
202	216	if ( is_plugin_active( 'sitepress-multilingual-cms/sitepress.php' ) ) {
		@@ -204,9 +218,9 @@
204	218	// search across all languages to find translated posts
205	219	if ( preg_match('/[^\x00-\x7F]/', $search_input) ) {
206	220	// Non-ASCII search: bypass WPML language filtering but allow posts_search filter
207	221	// This allows searching across all languages
208		- $args['suppress_filters'] = true;
	222	+ $args['suppress_filters'] = true; // phpcs:ignore WordPressVIPMinimum.Hooks.PreGetPosts.PreGetPosts,WordPressVIPMinimum.Performance.WPQueryParams.SuppressFilters_suppress_filters -- non-ASCII search must reach all WPML translations.
209	223	} else {
210	224	// ASCII-only search (English), use WPML filters to restrict to current language
211	225	$args['suppress_filters'] = false;
212	226	$args['lang'] = ICL_LANGUAGE_CODE;
		@@ -266,27 +280,28 @@
266	280	public function default_attributes() {
267	281	return apply_filters(
268	282	'betterdocs_search_form_attr',
269	283	[
270		- 'placeholder' => __( 'Search', 'betterdocs' ),
271		- 'heading' => '',
272		- 'subheading' => '',
273		- 'heading_tag' => 'h1',
274		- 'subheading_tag' => 'p',
275		- 'kb_based_search' => ''
	284	+ 'placeholder' => __( 'Search', 'betterdocs' ),
	285	+ 'heading' => '',
	286	+ 'subheading' => '',
	287	+ 'heading_tag' => 'h1',
	288	+ 'subheading_tag' => 'p',
	289	+ 'kb_based_search' => '' // KB slug to filter search results
276	290	]
277	291	);
278	292	}
279	293
280	294	public function render( $atts, $content = null ) {
	295	+ // Get kb_based_search from shortcode attribute (KB slug)
281	296	$kb_based_search = isset( $atts['kb_based_search'] ) ? sanitize_text_field( $atts['kb_based_search'] ) : '';
282		-
	297	+
283	298	betterdocs()->assets->localize(
284	299	'betterdocs-search',
285	300	'betterdocsSearchConfigTwo',
286	301	[
287	302	'is_post_type_archive' => is_post_type_archive( 'docs' ),
288		- 'kb_based_search' => $kb_based_search
	303	+ 'kb_based_search' => $kb_based_search,
289	304	]
290	305	);
291	306
292	307	$this->views( 'shortcodes/search' );