| @@ -1,8 +1,12 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace WPDeveloper\BetterDocs\FrontEnd; |
| 4 | 4 | |
| 5 | +if ( ! defined( 'ABSPATH' ) ) { | |
| 6 | + exit; | |
| 7 | +} | |
| 8 | + | |
| 5 | 9 | /** |
| 6 | 10 | * Extends WordPress search SQL on `docs` queries to also match docs whose |
| 7 | 11 | * assigned `doc_tag` or `doc_category` term names contain the search term. |
| 8 | 12 | * |
| @@ -50,8 +54,11 @@ | ||
| 50 | 54 | $placeholders = implode( ',', array_fill( 0, count( $taxonomies ), '%s' ) ); |
| 51 | 55 | $args = $taxonomies; |
| 52 | 56 | $args[] = $like; |
| 53 | 57 | |
| 58 | + // $placeholders is a generated run of %s tokens bound via $args below; all | |
| 59 | + // interpolated identifiers are $wpdb core table names, not user input. | |
| 60 | + // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| 54 | 61 | $subquery = $wpdb->prepare( |
| 55 | 62 | "{$wpdb->posts}.ID IN ( |
| 56 | 63 | SELECT DISTINCT tr.object_id |
| 57 | 64 | FROM {$wpdb->term_relationships} tr |
| @@ -60,8 +67,9 @@ | ||
| 60 | 67 | WHERE tt.taxonomy IN ({$placeholders}) AND t.name LIKE %s |
| 61 | 68 | )", |
| 62 | 69 | $args |
| 63 | 70 | ); |
| 71 | + // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| 64 | 72 | |
| 65 | 73 | return preg_replace( '/^\s*AND\s*\(/', " AND ({$subquery} OR ", $search, 1 ); |
| 66 | 74 | } |
| 67 | 75 | } |
