← All changes | includes/class-ph-comments.php +25 -15 2.2.3 → 2.3.0 View file →

		@@ -52,9 +52,9 @@
52	52	)
53	53	{
54	54	if ( apply_filters( 'propertyhive_add_property_availability_change_note', true ) === true )
55	55	{
56		- $all_availability_terms = get_terms( 'availability', array( 'hide_empty' => 0 ) );
	56	+ $all_availability_terms = get_terms( array_merge( wp_parse_args( array( 'hide_empty' => 0 ) ), array( 'taxonomy' => 'availability' ) ) );
57	57
58	58	$old_availability_id = '';
59	59	$old_availability_name = '';
60	60	if ( is_array($old_tt_ids) && !empty($old_tt_ids) )
		@@ -101,9 +101,9 @@
101	101	'comment_post_ID' => (int)$object_id,
102	102	'comment_author' => $current_user->display_name,
103	103	'comment_author_email' => 'propertyhive@noreply.com',
104	104	'comment_author_url' => '',
105		- 'comment_date' => date("Y-m-d H:i:s"),
	105	+ 'comment_date' => gmdate("Y-m-d H:i:s"),
106	106	'comment_content' => serialize($comment),
107	107	'comment_approved' => 1,
108	108	'comment_type' => 'propertyhive_note',
109	109	);
		@@ -109,9 +109,9 @@
109	109	);
110	110	$comment_id = wp_insert_comment( $data );
111	111	}
112	112
113		- update_post_meta( $object_id, '_availability_change_date', date("Y-m-d H:i:s") );
	113	+ update_post_meta( $object_id, '_availability_change_date', gmdate("Y-m-d H:i:s") );
114	114	}
115	115	}
116	116	}
117	117
		@@ -174,8 +174,9 @@
174	174	}
175	175	case "contact": {
176	176	// check contact type, then add to property if owner
177	177	$contact_types = get_post_meta( $post_id, '_contact_types', TRUE );
	178	+ $contact_types = is_array( $contact_types ) ? $contact_types : ( is_string( $contact_types ) && '' !== $contact_types ? array( $contact_types ) : array() );
178	179	if ( in_array('owner', $contact_types) )
179	180	{
180	181	// this contact is an owner
181	182	// get properties
		@@ -182,8 +183,9 @@
182	183	$args = array(
183	184	'post_type' => 'property',
184	185	'nopaging' => true,
185	186	'fields' => 'ids',
	187	+ // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Notes must link every owned property; supports both scalar and serialized legacy owner IDs and fetches IDs only.
186	188	'meta_query' => array(
187	189	'relation' => 'OR',
188	190	array(
189	191	'key' => '_owner_contact_id',
		@@ -277,8 +279,9 @@
277	279	}
278	280	}
279	281	}
280	282
	283	+ // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Existing public Property Hive extension hook property_insert_note_related_to; changing the established name would detach installed callbacks.
281	284	$related_to = apply_filters( 'property_insert_note_related_to', $related_to, $post_id );
282	285
283	286	$related_to = array_filter( $related_to );
284	287
		@@ -293,9 +296,9 @@
293	296	'comment_post_ID' => $post_id,
294	297	'comment_author' => $current_user->display_name,
295	298	'comment_author_email' => 'propertyhive@noreply.com',
296	299	'comment_author_url' => '',
297		- 'comment_date' => date("Y-m-d H:i:s"),
	300	+ 'comment_date' => gmdate("Y-m-d H:i:s"),
298	301	'comment_content' => serialize($comment),
299	302	'comment_approved' => 1,
300	303	'comment_type' => 'propertyhive_note',
301	304	'comment_meta' => array(
		@@ -301,9 +304,9 @@
301	304	'comment_meta' => array(
302	305	'related_to' => $new_related_to,
303	306	),
304	307	);
305		- $comment_id = wp_insert_comment( $data );
	308	+ $comment_id = wp_insert_comment( wp_slash( $data ) );
306	309
307	310	return $comment_id;
308	311	}
309	312
		@@ -331,9 +334,9 @@
331	334	'comment_post_ID' => (int)$object_id,
332	335	'comment_author' => $current_user->display_name,
333	336	'comment_author_email' => 'propertyhive@noreply.com',
334	337	'comment_author_url' => '',
335		- 'comment_date' => date("Y-m-d H:i:s"),
	338	+ 'comment_date' => gmdate("Y-m-d H:i:s"),
336	339	'comment_content' => serialize($comment),
337	340	'comment_approved' => 1,
338	341	'comment_type' => 'propertyhive_note',
339	342	);
		@@ -339,9 +342,9 @@
339	342	);
340	343	$comment_id = wp_insert_comment( $data );
341	344	}
342	345
343		- update_post_meta( $object_id, '_price_change_date', date("Y-m-d H:i:s") );
	346	+ update_post_meta( $object_id, '_price_change_date', gmdate("Y-m-d H:i:s") );
344	347	}
345	348	}
346	349	}
347	350
		@@ -367,9 +370,9 @@
367	370	'comment_post_ID' => (int)$object_id,
368	371	'comment_author' => $current_user->display_name,
369	372	'comment_author_email' => 'propertyhive@noreply.com',
370	373	'comment_author_url' => '',
371		- 'comment_date' => date("Y-m-d H:i:s"),
	374	+ 'comment_date' => gmdate("Y-m-d H:i:s"),
372	375	'comment_content' => serialize($comment),
373	376	'comment_approved' => 1,
374	377	'comment_type' => 'propertyhive_note',
375	378	);
		@@ -375,9 +378,9 @@
375	378	);
376	379	$comment_id = wp_insert_comment( $data );
377	380	}
378	381
379		- update_post_meta( $object_id, '_on_market_change_date', date("Y-m-d H:i:s") );
	382	+ update_post_meta( $object_id, '_on_market_change_date', gmdate("Y-m-d H:i:s") );
380	383	}
381	384	}
382	385	}
383	386
		@@ -409,9 +412,9 @@
409	412	'comment_post_ID' => (int)$object_id,
410	413	'comment_author' => $current_user->display_name,
411	414	'comment_author_email' => 'propertyhive@noreply.com',
412	415	'comment_author_url' => '',
413		- 'comment_date' => date("Y-m-d H:i:s"),
	416	+ 'comment_date' => gmdate("Y-m-d H:i:s"),
414	417	'comment_content' => serialize($comment),
415	418	'comment_approved' => 1,
416	419	'comment_type' => 'propertyhive_note',
417	420	);
		@@ -417,9 +420,9 @@
417	420	);
418	421	$comment_id = wp_insert_comment( $data );
419	422	}
420	423
421		- update_post_meta( $object_id, '_on_market_change_date', date("Y-m-d H:i:s") );
	424	+ update_post_meta( $object_id, '_on_market_change_date', gmdate("Y-m-d H:i:s") );
422	425	}
423	426	}
424	427	}
425	428
		@@ -432,20 +435,26 @@
432	435	*/
433	436	public static function exclude_note_comments( $clauses ) {
434	437	//global $wpdb, $typenow;
435	438
436		- if ( is_admin() && function_exists( 'get_current_screen' ) )
	439	+ if ( is_admin() && current_user_can( 'manage_propertyhive' ) && function_exists( 'get_current_screen' ) )
437	440	{
438	441	$screen = get_current_screen();
	442	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only query visibility filter; the authorized CRM action verifies its own nonce before requesting notes.
	443	+ $post_action = isset( $_POST['action'] ) && is_string( $_POST['action'] ) ? sanitize_text_field( wp_unslash( $_POST['action'] ) ) : '';
	444	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only CRM screen context; manage_propertyhive is checked above.
	445	+ $get_action = isset( $_GET['action'] ) && is_string( $_GET['action'] ) ? sanitize_text_field( wp_unslash( $_GET['action'] ) ) : '';
	446	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only CRM screen context; manage_propertyhive is checked above.
	447	+ $page = isset( $_GET['page'] ) && is_string( $_GET['page'] ) ? sanitize_text_field( wp_unslash( $_GET['page'] ) ) : '';
439	448
440	449	if (
441	450	( isset($screen->id) && in_array( $screen->id, apply_filters( 'propertyhive_post_types_with_notes', array( 'property', 'contact', 'enquiry', 'appraisal', 'viewing', 'offer', 'sale', 'tenancy' ) ) ) )
442	451	||
443		- ( wp_doing_ajax() && isset($_POST['action']) && ($_POST['action'] == 'propertyhive_get_notes_grid' || $_POST['action'] == 'propertyhive_get_pinned_notes_grid' || $_POST['action'] == 'propertyhive_merge_contact_records') )
	452	+ ( wp_doing_ajax() && in_array( $post_action, array( 'propertyhive_get_notes_grid', 'propertyhive_get_pinned_notes_grid', 'propertyhive_merge_contact_records' ), true ) )
444	453	||
445		- ( wp_doing_ajax() && isset($_GET['action']) && strpos($_GET['action'], 'propertyhive_') !== FALSE && strpos($_GET['action'], '_lightbox') !== FALSE )
	454	+ ( wp_doing_ajax() && strpos( $get_action, 'propertyhive_' ) !== FALSE && strpos( $get_action, '_lightbox' ) !== FALSE )
446	455	||
447		- ( isset($_GET['page']) && substr($_GET['page'], 0, 3) == 'ph-' )
	456	+ ( substr( $page, 0, 3 ) == 'ph-' )
448	457	)
449	458	{
450	459	return $clauses; // Don't hide when viewing Property Hive record
451	460	}
		@@ -479,8 +488,9 @@
479	488	if ( 0 === $post_id ) {
480	489	$stats = get_transient( 'ph_count_comments' );
481	490	if ( ! $stats ) {
482	491	$stats = array();
	492	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Aggregate excludes private CRM notes; ph_count_comments transient above caches this result and comment mutations invalidate it.
483	493	$count = $wpdb->get_results( "SELECT comment_approved, COUNT( * ) AS num_comments FROM {$wpdb->comments} WHERE comment_type != 'propertyhive_note' GROUP BY comment_approved", ARRAY_A );
484	494	$total = 0;
485	495	$approved = array( '0' => 'moderated', '1' => 'approved', 'spam' => 'spam', 'trash' => 'trash', 'post-trashed' => 'post-trashed' );
486	496	foreach ( (array) $count as $row ) {