| @@ -273,15 +273,9 @@ | ||
| 273 | 273 | } |
| 274 | 274 | |
| 275 | 275 | public function searchContact(Request $request) |
| 276 | 276 | { |
| 277 | - $search = trim($request->getSafe('search', 'sanitize_text_field')); | |
| 278 | - | |
| 279 | - // '*' is a WP_User_Query wildcard and survives sanitize_text_field, so a | |
| 280 | - // lone '*' would list every user on the site (FS-SEC-014). Stripping it | |
| 281 | - // leaves WP_User_Query doing an exact match. | |
| 282 | - $search = trim(str_replace('*', '', $search)); | |
| 283 | - | |
| 277 | + $search = $request->getSafe('search', 'sanitize_text_field'); | |
| 284 | 278 | if (!$search) { |
| 285 | 279 | return $this->sendError([ |
| 286 | 280 | 'message' => __('Please provide search string', 'fluent-support') |
| 287 | 281 | ]); |
| @@ -288,27 +282,8 @@ | ||
| 288 | 282 | } |
| 289 | 283 | |
| 290 | 284 | $isEmail = is_email($search); |
| 291 | 285 | |
| 292 | - // Require a meaningful prefix so the endpoint can't be walked one letter | |
| 293 | - // at a time. Emails are matched exactly, so they need no minimum. | |
| 294 | - if (!$isEmail && mb_strlen($search) < 3) { | |
| 295 | - return $this->sendError([ | |
| 296 | - 'message' => __('Please provide at least 3 characters to search', 'fluent-support') | |
| 297 | - ]); | |
| 298 | - } | |
| 299 | - | |
| 300 | - if (Helper::hitRateLimit('fs_contact_search_' . get_current_user_id(), 60, 5 * MINUTE_IN_SECONDS)) { | |
| 301 | - return $this->sendError([ | |
| 302 | - 'message' => __('Too many contact searches. Please try again in a few minutes.', 'fluent-support') | |
| 303 | - ], 429); | |
| 304 | - } | |
| 305 | - | |
| 306 | - // '%' and '_' are LIKE wildcards for the customer and CRM scopes below. | |
| 307 | - // Escape rather than strip: underscores are legitimate in emails. | |
| 308 | - global $wpdb; | |
| 309 | - $likeSearch = $wpdb->esc_like($search); | |
| 310 | - | |
| 311 | 286 | // search the existing customers first |
| 312 | 287 | if ($isEmail) { |
| 313 | 288 | $customers = Customer::select(['first_name', 'last_name', 'email', 'id', 'user_id']) |
| 314 | 289 | ->where('email', $search) |
| @@ -314,9 +289,9 @@ | ||
| 314 | 289 | ->where('email', $search) |
| 315 | 290 | ->get(); |
| 316 | 291 | } else { |
| 317 | 292 | $customers = Customer::select(['first_name', 'last_name', 'email', 'id', 'user_id']) |
| 318 | - ->searchBy($likeSearch) | |
| 293 | + ->searchBy($search) | |
| 319 | 294 | ->limit(10) |
| 320 | 295 | ->get(); |
| 321 | 296 | } |
| 322 | 297 | |
| @@ -338,9 +313,9 @@ | ||
| 338 | 313 | ->select(['first_name', 'last_name', 'email', 'id', 'user_id']) |
| 339 | 314 | ->get(); |
| 340 | 315 | } else { |
| 341 | 316 | |
| 342 | - $contacts = \FluentCrm\App\Models\Subscriber::searchBy($likeSearch) | |
| 317 | + $contacts = \FluentCrm\App\Models\Subscriber::searchBy($search) | |
| 343 | 318 | ->select(['first_name', 'last_name', 'email', 'id', 'user_id']) |
| 344 | 319 | ->limit(10) |
| 345 | 320 | ->get(); |
| 346 | 321 | } |
