| @@ -152,9 +152,9 @@ | ||
| 152 | 152 | $params = $request->get_params(); |
| 153 | 153 | $status = !empty($params['status']) ? $params['status'] : "all"; |
| 154 | 154 | $page = !empty($params['page']) ? intval( $params['page'] ) : 1; |
| 155 | 155 | $per_page = !empty($params['per_page']) ? intval( $params['per_page'] ) : 20; |
| 156 | - $search_keyword = !empty($params['s']) ? $params['s'] : ''; | |
| 156 | + $search_keyword = !empty($params['s']) ? sanitize_text_field($params['s']) : ''; | |
| 157 | 157 | $start_from = ($page - 1) * $per_page; |
| 158 | 158 | $query = Database::get_instance()->query() |
| 159 | 159 | ->from('nx_posts a') |
| 160 | 160 | ->join('nx_stats b', 'b.nx_id', '=', 'a.nx_id') |
| @@ -164,11 +164,16 @@ | ||
| 164 | 164 | if ($status !== 'all') { |
| 165 | 165 | $query->where('enabled', $status == 'enabled' ? true : false); |
| 166 | 166 | } |
| 167 | 167 | if( $search_keyword ) { |
| 168 | - $query->where(function($query) use ($search_keyword) { | |
| 169 | - $query->where('title', 'LIKE', '%' . $search_keyword . '%') | |
| 170 | - ->orWhere( 'a.nx_id', 'LIKE', '%'. $search_keyword . '%' ); | |
| 168 | + global $wpdb; | |
| 169 | + // esc_like() so `%` and `_` typed into the search box match themselves | |
| 170 | + // instead of acting as wildcards; the pattern is bound as a value by the | |
| 171 | + // query builder. | |
| 172 | + $like = '%' . $wpdb->esc_like( $search_keyword ) . '%'; | |
| 173 | + $query->where(function($query) use ($like) { | |
| 174 | + $query->where('title', 'LIKE', $like) | |
| 175 | + ->orWhere( 'a.nx_id', 'LIKE', $like ); | |
| 171 | 176 | }); |
| 172 | 177 | } |
| 173 | 178 | |
| 174 | 179 | $query->offset($start_from) |
| @@ -226,9 +231,17 @@ | ||
| 226 | 231 | * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure. |
| 227 | 232 | */ |
| 228 | 233 | public function get_item($request) { |
| 229 | 234 | PostType::get_instance()->set_context( 'edit' ); |
| 230 | - return PostType::get_instance()->get_post( absint( $request['id'] ) ); | |
| 235 | + $post = PostType::get_instance()->get_post( absint( $request['id'] ) ); | |
| 236 | + if ( empty( $post ) ) { | |
| 237 | + return new WP_Error( | |
| 238 | + 'rest_post_invalid_id', | |
| 239 | + __( 'Invalid notification ID.', 'notificationx' ), | |
| 240 | + array( 'status' => 404 ) | |
| 241 | + ); | |
| 242 | + } | |
| 243 | + return $post; | |
| 231 | 244 | } |
| 232 | 245 | |
| 233 | 246 | /** |
| 234 | 247 | * Checks if a given request has access to create a post. |
