← All changes | app/Http/Requests/AttrGroupRequest.php +34 -24 1.4.1 → 1.6.5 View file →

		@@ -5,51 +5,61 @@
5	5	use FluentCart\Framework\Foundation\RequestGuard;
6	6
7	7	class AttrGroupRequest extends RequestGuard
8	8	{
9		-
10		- /**
11		- * @return string[]
12		- */
13	9	public function rules()
14	10	{
15		- $groupId = $this->get('group_id');
	11	+ // Only trust group_id from the URL on PUT requests (updateGroup). On
	12	+ // POST createGroup there is no URL group_id, and we MUST NOT honour a
	13	+ // body-supplied value — a malicious client could POST {"group_id": N,
	14	+ // "slug": "color"} to force the unique-slug validator to exclude row
	15	+ // N from its check and slip past validation. The DB-level UNIQUE on
	16	+ // slug backstops the insert either way, but ignoring body-supplied
	17	+ // identifiers here keeps the validator's contract honest.
	18	+ $groupId = strtoupper((string) $this->method()) === 'PUT'
	19	+ ? $this->get('group_id')
	20	+ : null;
16	21	$tbl = 'fct_atts_groups';
17	22
	23	+ // Build the slug rule conditionally. On PUT the client sends the
	24	+ // existing slug; it may be absent on POST because the UI omits the
	25	+ // slug field and the backend auto-generates it from the title instead.
	26	+ // When present on PUT, enforce uniqueness while excluding the current row.
	27	+ $slugRule = $groupId
	28	+ ? 'nullable|sanitizeText|maxLength:50|unique:' . $tbl . ',slug,' . (int) $groupId . ',id'
	29	+ : 'nullable|sanitizeText|maxLength:50|unique:' . $tbl . ',slug';
	30	+
18	31	return [
19		- 'title' => 'required|sanitizeText|maxLength:50',
20		- 'slug' => 'required|sanitizeText|maxLength:50|unique:' . $tbl . ',slug,' . $groupId.',id',
	32	+ 'title' => 'required|sanitizeText|maxLength:50',
	33	+ 'slug' => $slugRule,
21	34	'description' => 'nullable|sanitizeTextArea',
22		-
	35	+ 'settings' => 'nullable',
23	36	];
24	37	}
25	38
26		- /**
27		- *
28		- * @return array
29		- */
30	39	public function messages()
31	40	{
32	41	return [
33		- 'title' => esc_html__('Group title can not be empty.', 'fluent-cart'),
34		- 'slug' => esc_html__('Group slug can not be empty and must be unique.', 'fluent-cart'),
	42	+ 'title' => esc_html__('Group title can not be empty.', 'fluent-cart'),
	43	+ 'slug' => esc_html__('Group slug can not be empty and must be unique.', 'fluent-cart'),
35	44	'description' => esc_html__('Group description should be long text.', 'fluent-cart'),
36		- 'settings' => esc_html__('Group settings should be long text.', 'fluent-cart'),
37	45	];
38	46	}
39	47
40		-
41		- /**
42		- *
43		- * @return array
44		- */
45	48	public function sanitize()
46	49	{
47	50	return [
48		- 'title' => 'sanitize_text_field',
49		- 'description' => 'sanitize_text_field',
50		- 'slug' => 'sanitize_text_field',
51		- 'settings' => function ($value) {
	51	+ 'title' => 'sanitize_text_field',
	52	+ // sanitize_textarea_field (not sanitize_text_field) so newlines survive.
	53	+ // rules() declares the field as sanitizeTextArea — using the single-line
	54	+ // sanitizer would silently flatten multi-line descriptions to one line.
	55	+ 'description' => 'sanitize_textarea_field',
	56	+ // sanitize_title (not sanitize_text_field) so user-typed slugs end up
	57	+ // URL-safe ("My Color" → "my-color"). Slugs are POSTed as both title
	58	+ // AND slug from the product editor; without this, slugs end up with
	59	+ // raw spaces and break anything that round-trips them through URLs.
	60	+ 'slug' => 'sanitize_title',
	61	+ 'settings' => function ($value) {
52	62	if (!is_array($value)) {
53	63	return [];
54	64	}
55	65	return array_map('sanitize_text_field', $value);