← All changes | includes/Core/Request.php +271 -5 4.8.2 → 4.9.3 View file →

		@@ -152,8 +152,15 @@
152	152	* Hook into template_redirect to validate category-post relationships
153	153	* Priority 0 to run before WordPress canonical redirect (priority 10)
154	154	*/
155	155	add_action( 'template_redirect', [ $this, 'validate_single_docs_category_redirect' ], 0 );
	156	+
	157	+ /**
	158	+ * Hook into template_redirect to 301 non-canonical single doc URLs.
	159	+ * Priority 5: after the validation above (0) so requests already headed for
	160	+ * a 404 are left alone, and before WordPress canonical redirect (10).
	161	+ */
	162	+ add_action( 'template_redirect', [ $this, 'redirect_to_canonical_docs_url' ], 5 );
156	163	}
157	164
158	165	public function provide_compatibility( $element_id, $uri_parts, $request_url ) {
159	166	if ( $request_url == $this->settings->get( 'docs_slug' ) ) {
		@@ -395,8 +402,225 @@
395	402	}
396	403	}
397	404
398	405	/**
	406	+ * 301 redirect a single doc to its canonical permalink.
	407	+ *
	408	+ * With `enable_category_hierarchy_slugs` enabled the single doc rewrite rule
	409	+ * captures every segment between the base and the doc slug into `doc_category`
	410	+ * (see Rewrite::rules), and the category validation above only requires ONE of
	411	+ * those segments to match. That looseness is deliberate — a strict match would
	412	+ * 404 legitimate Multiple KB and WPML URLs, where the KB slug and translated
	413	+ * segments share the same capture group — but it also means a doc resolves on an
	414	+ * unlimited number of URLs, e.g. /docs/anything/real-category/doc-slug/.
	415	+ *
	416	+ * Rather than tightening the match, this compares the requested category path
	417	+ * against every path the doc legitimately has and redirects the rest. Every URL
	418	+ * that resolves today keeps resolving; only the extra ones collapse.
	419	+ */
	420	+ public function redirect_to_canonical_docs_url() {
	421	+ global $wp_query;
	422	+
	423	+ /**
	424	+ * Allow the canonical redirect to be disabled.
	425	+ *
	426	+ * @param bool $enabled Whether non-canonical single doc URLs should 301.
	427	+ */
	428	+ if ( ! apply_filters( 'betterdocs_enable_canonical_redirect', true ) ) {
	429	+ return;
	430	+ }
	431	+
	432	+ if ( is_admin() || wp_doing_ajax() || is_feed() || is_embed() || is_preview() || is_customize_preview() ) {
	433	+ return;
	434	+ }
	435	+
	436	+ $request_method = isset( $_SERVER['REQUEST_METHOD'] ) ? strtoupper( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) ) : 'GET';
	437	+ if ( $request_method !== 'GET' ) {
	438	+ return;
	439	+ }
	440	+
	441	+ if ( ! is_singular( 'docs' ) || is_404() ) {
	442	+ return;
	443	+ }
	444	+
	445	+ /**
	446	+ * The request is already headed for a 404 — leave it alone. Note that
	447	+ * prevent_any_redirect_for_invalid_docs() cancels every wp_redirect() while
	448	+ * this flag is set, so the redirect below would be swallowed anyway.
	449	+ */
	450	+ if ( $this->invalid_request_query_vars !== null ) {
	451	+ return;
	452	+ }
	453	+
	454	+ $requested_category = isset( $wp_query->query_vars['doc_category'] ) ? $wp_query->query_vars['doc_category'] : '';
	455	+ if ( ! is_string( $requested_category ) || $requested_category === '' ) {
	456	+ return;
	457	+ }
	458	+
	459	+ $post_id = get_queried_object_id();
	460	+ if ( ! $post_id ) {
	461	+ return;
	462	+ }
	463	+
	464	+ $valid_paths = $this->get_valid_category_paths( $post_id );
	465	+ if ( empty( $valid_paths ) ) {
	466	+ return;
	467	+ }
	468	+
	469	+ $requested_category = urldecode( trim( $requested_category, '/' ) );
	470	+
	471	+ /**
	472	+ * Under Multiple KB the knowledge base segment is parsed into its own query
	473	+ * var, so put it back in front of the category chain before comparing —
	474	+ * otherwise a crossed `/kb-a/category-of-kb-b/doc/` would look canonical.
	475	+ */
	476	+ $requested_kb = isset( $wp_query->query_vars['knowledge_base'] ) ? $wp_query->query_vars['knowledge_base'] : '';
	477	+ if ( is_string( $requested_kb ) && $requested_kb !== '' ) {
	478	+ $requested_category = urldecode( trim( $requested_kb, '/' ) ) . '/' . $requested_category;
	479	+ }
	480	+
	481	+ if ( in_array( $requested_category, $valid_paths, true ) ) {
	482	+ return; // Already canonical (or another legitimate category of this doc).
	483	+ }
	484	+
	485	+ $canonical = get_permalink( $post_id );
	486	+ if ( ! $canonical ) {
	487	+ return;
	488	+ }
	489	+
	490	+ // Keep the multipage segment the rewrite rule captured.
	491	+ $page = isset( $wp_query->query_vars['page'] ) ? absint( $wp_query->query_vars['page'] ) : 0;
	492	+ if ( $page > 1 ) {
	493	+ $canonical = trailingslashit( $canonical ) . user_trailingslashit( $page, 'single_paged' );
	494	+ }
	495	+
	496	+ /**
	497	+ * Belt and braces: never redirect a URL onto itself. The allowed set is built
	498	+ * from the same term chains get_permalink() uses, so this should be
	499	+ * unreachable, but a third party filtering the permalink could otherwise turn
	500	+ * a redirect into a loop.
	501	+ */
	502	+ $requested_path = isset( $_SERVER['REQUEST_URI'] ) ? wp_parse_url( wp_unslash( $_SERVER['REQUEST_URI'] ), PHP_URL_PATH ) : '';
	503	+ $canonical_path = wp_parse_url( $canonical, PHP_URL_PATH );
	504	+ if ( untrailingslashit( urldecode( (string) $requested_path ) ) === untrailingslashit( urldecode( (string) $canonical_path ) ) ) {
	505	+ return;
	506	+ }
	507	+
	508	+ $query_string = isset( $_SERVER['QUERY_STRING'] ) ? sanitize_text_field( wp_unslash( $_SERVER['QUERY_STRING'] ) ) : '';
	509	+ if ( $query_string !== '' ) {
	510	+ $canonical .= ( strpos( $canonical, '?' ) === false ? '?' : '&' ) . $query_string;
	511	+ }
	512	+
	513	+ if ( wp_safe_redirect( $canonical, 301 ) ) {
	514	+ exit;
	515	+ }
	516	+ }
	517	+
	518	+ /**
	519	+ * Every category path a doc can legitimately be reached at.
	520	+ *
	521	+ * Includes the full parent/child chain of each assigned category, and — because
	522	+ * the hierarchy rewrite rule folds the knowledge base slug into `doc_category`
	523	+ * for the `docs/%knowledge_base%/%doc_category%` structure — the KB-prefixed
	524	+ * variants too.
	525	+ *
	526	+ * @param int $post_id The doc id.
	527	+ * @return string[] Normalised (urldecoded, unslashed) category paths.
	528	+ */
	529	+ protected function get_valid_category_paths( $post_id ) {
	530	+ $cat_terms = wp_get_object_terms( $post_id, 'doc_category' );
	531	+
	532	+ if ( is_wp_error( $cat_terms ) ) {
	533	+ return [];
	534	+ }
	535	+
	536	+ $paths = [];
	537	+ $cat_paths = [];
	538	+
	539	+ if ( empty( $cat_terms ) ) {
	540	+ $paths[] = 'uncategorized';
	541	+ } else {
	542	+ foreach ( $cat_terms as $cat_term ) {
	543	+ $path = PostType::build_category_path( $cat_term );
	544	+
	545	+ if ( $path !== '' ) {
	546	+ $paths[] = $path;
	547	+ $cat_paths[ $cat_term->term_id ] = $path;
	548	+ }
	549	+ }
	550	+ }
	551	+
	552	+ if ( taxonomy_exists( 'knowledge_base' ) ) {
	553	+ $kb_terms = wp_get_object_terms( $post_id, 'knowledge_base', [ 'fields' => 'slugs' ] );
	554	+
	555	+ if ( ! is_wp_error( $kb_terms ) && ! empty( $kb_terms ) ) {
	556	+ $kb_paths = [];
	557	+
	558	+ /**
	559	+ * Read the KB association once per category rather than once per
	560	+ * KB/category pair. The wp_get_object_terms() call above primes the
	561	+ * term meta cache for these terms (`update_term_meta_cache` defaults
	562	+ * to true), so these reads are cache hits and add no queries.
	563	+ *
	564	+ * The association mirrors how PostType::post_link() picks the
	565	+ * category via `doc_category_knowledge_base`. Without it a doc in
	566	+ * KB A / category A and KB B / category B would treat the crossed
	567	+ * `/kb-a/category-b/doc/` as canonical. A term with no association
	568	+ * meta is unassigned rather than KB specific, so it stays valid
	569	+ * under every KB — post_link() falls back the same way.
	570	+ */
	571	+ $term_kbs = [];
	572	+
	573	+ if ( ! empty( $cat_paths ) ) {
	574	+ foreach ( array_keys( $cat_paths ) as $term_id ) {
	575	+ $meta = get_term_meta( $term_id, 'doc_category_knowledge_base', true );
	576	+ $term_kbs[ $term_id ] = ( ! empty( $meta ) && is_array( $meta ) ) ? $meta : null;
	577	+ }
	578	+ }
	579	+
	580	+ foreach ( $kb_terms as $kb_slug ) {
	581	+ if ( empty( $cat_paths ) ) {
	582	+ // Uncategorised doc: the KB slug is the only prefix there is.
	583	+ foreach ( $paths as $path ) {
	584	+ $kb_paths[] = $kb_slug . '/' . $path;
	585	+ }
	586	+ continue;
	587	+ }
	588	+
	589	+ foreach ( $cat_paths as $term_id => $path ) {
	590	+ if ( $term_kbs[ $term_id ] !== null && ! in_array( $kb_slug, $term_kbs[ $term_id ], true ) ) {
	591	+ continue;
	592	+ }
	593	+
	594	+ $kb_paths[] = $kb_slug . '/' . $path;
	595	+ }
	596	+ }
	597	+
	598	+ $paths = array_merge( $paths, $kb_paths );
	599	+ }
	600	+ }
	601	+
	602	+ /**
	603	+ * Non-Latin slugs are stored URL encoded while the requested path arrives
	604	+ * decoded, so normalise both sides before comparing.
	605	+ */
	606	+ $paths = array_map(
	607	+ function ( $path ) {
	608	+ return urldecode( trim( $path, '/' ) );
	609	+ },
	610	+ $paths
	611	+ );
	612	+
	613	+ /**
	614	+ * Filter the category paths a doc is allowed to be reached at.
	615	+ *
	616	+ * @param string[] $paths Valid category paths.
	617	+ * @param int $post_id The doc id.
	618	+ */
	619	+ return array_values( array_unique( apply_filters( 'betterdocs_valid_docs_category_paths', $paths, $post_id ) ) );
	620	+ }
	621	+
	622	+ /**
399	623	* Check if a URL matches a BetterDocs single docs permalink structure
400	624	* but has invalid KB/category slugs that don't match the post.
401	625	*
402	626	* @param string $url The URL to check.
		@@ -724,14 +948,40 @@
724	948
725	949	// Check if we have 'docs' query var (alternative to 'name')
726	950	if ( isset( $wp_query->query_vars['docs'] ) && ! empty( $wp_query->query_vars['docs'] ) ) {
727	951
	952	+ // Verify the requested doc actually exists (and is visible to the
	953	+ // current user) before forcing a single-doc render. Category-in-path
	954	+ // permalinks put the doc slug in the `docs` var alongside a valid
	955	+ // doc_category; without this guard a missing slug under a real
	956	+ // category rendered the single template against a null post — an
	957	+ // HTTP 200 soft-404 plus "read property on null" warnings on every
	958	+ // (often bot) hit. See betterdocs/betterdocs#169.
	959	+ $doc_post = get_page_by_path( $wp_query->query_vars['docs'], OBJECT, 'docs' );
	960	+ $doc_visible = $doc_post
	961	+ && ( 'private' !== $doc_post->post_status || current_user_can( 'read_private_docs' ) );
	962	+
	963	+ if ( ! $doc_visible ) {
	964	+ // No such doc (or private and not permitted) — serve a genuine
	965	+ // 404 instead of a single render against a null post.
	966	+ $wp_query->set_404();
	967	+ status_header( 404 );
	968	+ nocache_headers();
	969	+ add_filter( 'template_include', function( $template ) {
	970	+ $not_found = get_404_template();
	971	+ return $not_found ? $not_found : $template;
	972	+ }, 999 );
	973	+ return;
	974	+ }
	975	+
728	976	// Explicitly set this as a single post
729		- $wp_query->is_single = true;
730		- $wp_query->is_singular = true;
731		- $wp_query->is_404 = false;
732		- $wp_query->is_archive = false;
733		- $wp_query->is_tax = false;
	977	+ $wp_query->is_single = true;
	978	+ $wp_query->is_singular = true;
	979	+ $wp_query->is_404 = false;
	980	+ $wp_query->is_archive = false;
	981	+ $wp_query->is_tax = false;
	982	+ $wp_query->queried_object = $doc_post;
	983	+ $wp_query->queried_object_id = $doc_post->ID;
734	984	return;
735	985	}
736	986
737	987	// If 'name' is set, check if a post with that name exists
		@@ -851,8 +1101,24 @@
851	1101	if ( $code == 404 && (
852	1102	(isset($wp_query->query_vars['doc_category']) && ! empty($wp_query->query_vars['doc_category'])) ||
853	1103	(isset($wp_query->query_vars['doc_tag']) && ! empty($wp_query->query_vars['doc_tag']))
854	1104	) ) {
	1105	+ // A single-doc request (category-in-path permalinks carry the doc slug
	1106	+ // in the `docs`/`name` var alongside doc_category) must resolve to a real
	1107	+ // doc. A valid doc is already served 200 by the queried-object branch
	1108	+ // above; if we reach here with a single-doc indicator but no resolvable
	1109	+ // post, the doc does not exist — keep the genuine 404 rather than forcing
	1110	+ // a soft-404 200 off the category term alone. See betterdocs/betterdocs#169.
	1111	+ $single_doc_slug = '';
	1112	+ if ( isset( $wp_query->query_vars['docs'] ) && ! empty( $wp_query->query_vars['docs'] ) ) {
	1113	+ $single_doc_slug = $wp_query->query_vars['docs'];
	1114	+ } elseif ( isset( $wp_query->query_vars['name'] ) && ! empty( $wp_query->query_vars['name'] ) ) {
	1115	+ $single_doc_slug = $wp_query->query_vars['name'];
	1116	+ }
	1117	+ if ( '' !== $single_doc_slug && ! get_page_by_path( $single_doc_slug, OBJECT, 'docs' ) ) {
	1118	+ return $status_header;
	1119	+ }
	1120	+
855	1121	// Validate existence before forcing 200
856	1122	// Use encoded fallback so Bengali/Arabic/CJK slugs are found correctly.
857	1123	if ( isset($wp_query->query_vars['doc_category']) && ! empty($wp_query->query_vars['doc_category']) ) {
858	1124	$term = $this->get_term_by_slug_or_encoded( $wp_query->query_vars['doc_category'], 'doc_category' );