← All changes | includes/Core/ArticleQualityScore.php +23 -11 4.5.4 → 4.9.2 View file →

		@@ -1,10 +1,15 @@
1	1	<?php
	2	+namespace WPDeveloper\BetterDocs\Core;
2	3
3		-namespace WPDeveloper\BetterDocs\Core;
	4	+if ( ! defined( 'ABSPATH' ) ) {
	5	+ exit;
	6	+}
4	7
	8	+
5	9	use WPDeveloper\BetterDocs\Utils\Base;
6	10	use WPDeveloper\BetterDocs\Utils\AIHelper;
	11	+use WPDeveloper\BetterDocs\Utils\AIUsage;
7	12	use WPDeveloper\BetterDocs\Core\Settings;
8	13
9	14	class ArticleQualityScore extends Base {
10	15
		@@ -347,13 +352,14 @@
347	352	* AJAX handler for docs quality analysis
348	353	*/
349	354	public function ajax_analyze_article_quality() {
350	355	// Verify nonce
351		- if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'betterdocs_quality_score_nonce' ) ) {
	356	+ $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
	357	+ if ( ! wp_verify_nonce( $nonce, 'betterdocs_quality_score_nonce' ) ) {
352	358	wp_send_json_error( [ 'message' => __( 'Invalid nonce', 'betterdocs' ) ] );
353	359	}
354	360
355		- $post_id = isset( $_POST['post_id'] ) ? intval( $_POST['post_id'] ) : 0;
	361	+ $post_id = isset( $_POST['post_id'] ) ? intval( wp_unslash( $_POST['post_id'] ) ) : 0;
356	362
357	363	if ( empty( $post_id ) ) {
358	364	wp_send_json_error( [ 'message' => __( 'Invalid post ID', 'betterdocs' ) ] );
359	365	}
		@@ -369,10 +375,10 @@
369	375	wp_send_json_error( [ 'message' => __( 'Invalid post or post type', 'betterdocs' ) ] );
370	376	}
371	377
372	378	// Check if current content is provided (from editor, may be unsaved)
373		- $current_content = isset( $_POST['current_content'] ) ? wp_kses_post( $_POST['current_content'] ) : '';
374		- $current_title = isset( $_POST['current_title'] ) ? sanitize_text_field( $_POST['current_title'] ) : '';
	379	+ $current_content = isset( $_POST['current_content'] ) ? wp_kses_post( wp_unslash( $_POST['current_content'] ) ) : '';
	380	+ $current_title = isset( $_POST['current_title'] ) ? sanitize_text_field( wp_unslash( $_POST['current_title'] ) ) : '';
375	381
376	382	// Use current content if provided, otherwise use saved post content
377	383	if ( ! empty( $current_content ) ) {
378	384	$content = $current_content;
		@@ -407,8 +413,11 @@
407	413	if ( ! $saved ) {
408	414	wp_send_json_error( [ 'message' => __( 'Failed to save analysis result', 'betterdocs' ) ] );
409	415	}
410	416
	417	+ // Count a successful fresh analysis.
	418	+ AIUsage::record( 'quality_score', $post_id );
	419	+
411	420	// Return success with the analysis data
412	421	wp_send_json_success( [
413	422	'message' => __( 'Docs analyzed successfully', 'betterdocs' ),
414	423	'data' => $analysis_result
		@@ -419,14 +428,16 @@
419	428	* AJAX handler for saving quality analysis results
420	429	*/
421	430	public function ajax_save_quality_analysis() {
422	431	// Verify nonce
423		- if ( ! wp_verify_nonce( $_POST['nonce'], 'betterdocs_quality_score_nonce' ) ) {
	432	+ $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
	433	+ if ( ! wp_verify_nonce( $nonce, 'betterdocs_quality_score_nonce' ) ) {
424	434	wp_send_json_error( __( 'Security check failed', 'betterdocs' ) );
425	435	}
426	436
427		- $post_id = isset( $_POST['post_id'] ) ? intval( $_POST['post_id'] ) : 0;
428		- $analysis_data = isset( $_POST['analysis_data'] ) ? $_POST['analysis_data'] : '';
	437	+ $post_id = isset( $_POST['post_id'] ) ? intval( wp_unslash( $_POST['post_id'] ) ) : 0;
	438	+ // JSON payload validated/decoded below.
	439	+ $analysis_data = isset( $_POST['analysis_data'] ) ? wp_unslash( $_POST['analysis_data'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- raw JSON parsed via json_decode below.
429	440
430	441	if ( ! $post_id || ! $analysis_data ) {
431	442	wp_send_json_error( __( 'Invalid data provided', 'betterdocs' ) );
432	443	}
		@@ -436,9 +447,9 @@
436	447	wp_send_json_error( __( 'Insufficient permissions', 'betterdocs' ) );
437	448	}
438	449
439	450	// Decode the analysis data
440		- $decoded_data = json_decode( stripslashes( $analysis_data ), true );
	451	+ $decoded_data = json_decode( $analysis_data, true );
441	452	if ( ! $decoded_data ) {
442	453	wp_send_json_error( __( 'Invalid analysis data format', 'betterdocs' ) );
443	454	}
444	455
		@@ -465,13 +476,14 @@
465	476	* AJAX handler for checking cached analysis results
466	477	*/
467	478	public function ajax_check_cached_analysis() {
468	479	// Verify nonce
469		- if ( ! wp_verify_nonce( $_POST['nonce'], 'betterdocs_quality_score_nonce' ) ) {
	480	+ $nonce = isset( $_POST['nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['nonce'] ) ) : '';
	481	+ if ( ! wp_verify_nonce( $nonce, 'betterdocs_quality_score_nonce' ) ) {
470	482	wp_send_json_error( __( 'Security check failed', 'betterdocs' ) );
471	483	}
472	484
473		- $post_id = isset( $_POST['post_id'] ) ? intval( $_POST['post_id'] ) : 0;
	485	+ $post_id = isset( $_POST['post_id'] ) ? intval( wp_unslash( $_POST['post_id'] ) ) : 0;
474	486
475	487	if ( ! $post_id ) {
476	488	wp_send_json_error( __( 'Invalid post ID', 'betterdocs' ) );
477	489	}