| @@ -10,9 +10,8 @@ | ||
| 10 | 10 | use FluentCart\App\Services\DateTime\DateTime; |
| 11 | 11 | |
| 12 | 12 | class ReportHelper |
| 13 | 13 | { |
| 14 | - | |
| 15 | 14 | /** |
| 16 | 15 | * Define the group key based on the data density between the start and end dates. |
| 17 | 16 | * |
| 18 | 17 | * @param \DateTime $startDate The start date as a DateTime object. |
| @@ -161,9 +160,9 @@ | ||
| 161 | 160 | * @return string |
| 162 | 161 | */ |
| 163 | 162 | public static function sanitizeGroupKey($value) |
| 164 | 163 | { |
| 165 | - $acceptedValues = ['billing_country', 'shipping_country', 'payment_method', 'payment_status', 'default', 'monthly', 'yearly']; | |
| 164 | + $acceptedValues = ['billing_country', 'shipping_country', 'payment_method', 'payment_status', 'default', 'daily', 'monthly', 'yearly']; | |
| 166 | 165 | return in_array($value, $acceptedValues) ? $value : 'payment_method'; |
| 167 | 166 | } |
| 168 | 167 | |
| 169 | 168 | protected static function sanitizeParams($params) |
| @@ -179,14 +178,31 @@ | ||
| 179 | 178 | 'currency' => 'sanitize_text_field', |
| 180 | 179 | 'filterMode' => 'sanitize_text_field', |
| 181 | 180 | 'storeMode' => 'sanitize_text_field', |
| 182 | 181 | 'variation_ids.*' => 'intval', |
| 182 | + 'customDays' => 'intval', | |
| 183 | 183 | 'subscriptionType' => 'sanitize_text_field', |
| 184 | 184 | 'orderStatus.*' => 'sanitize_text_field', |
| 185 | 185 | 'orderTypes.*' => 'sanitize_text_field', |
| 186 | + 'filter_type' => 'sanitize_text_field', | |
| 186 | 187 | ]; |
| 187 | - | |
| 188 | - return Sanitizer::sanitize($params, $rules); | |
| 188 | + | |
| 189 | + /** | |
| 190 | + * Report params whose shape this plugin does not own. | |
| 191 | + * | |
| 192 | + * `advanced_filters` deliberately has no rule above. Its payload describes | |
| 193 | + * filter conditions, and only whoever consumes it knows what shape is | |
| 194 | + * valid — so only they can sanitize it without mangling it (running | |
| 195 | + * sanitize_text_field() over a JSON blob eats everything after the first | |
| 196 | + * '<'). A consumer pushes its own rule in here, and Sanitizer::sanitize() | |
| 197 | + * leaves any key with no rule untouched. | |
| 198 | + * | |
| 199 | + * @param array $rules Sanitization rules, keyed like $params. | |
| 200 | + * @param array $params The raw, unsanitized params. | |
| 201 | + */ | |
| 202 | + $rules = apply_filters('fluent_cart/report/sanitize_params_rules', $rules, $params); | |
| 203 | + | |
| 204 | + return Sanitizer::sanitize($params, is_array($rules) ? $rules : []); | |
| 189 | 205 | } |
| 190 | 206 | |
| 191 | 207 | /** |
| 192 | 208 | * @param string $type |
