| @@ -323,11 +323,9 @@ | ||
| 323 | 323 | * @since 0.0.1 |
| 324 | 324 | */ |
| 325 | 325 | public function get_donations( $request ) { |
| 326 | 326 | $page = $request->get_param( 'page' ) ?? 1; |
| 327 | - // Clamp to a minimum of 1 so the total_pages calculation below can never | |
| 328 | - // divide by zero (per_page=0 would otherwise trigger a DivisionByZeroError). | |
| 329 | - $per_page = max( 1, absint( $request->get_param( 'per_page' ) ?? 20 ) ); | |
| 327 | + $per_page = $request->get_param( 'per_page' ) ?? 20; | |
| 330 | 328 | $search = $request->get_param( 'search' ) ?? ''; |
| 331 | 329 | $status = $request->get_param( 'status' ) ?? 'all'; |
| 332 | 330 | $campaign = $request->get_param( 'campaign' ) ?? ''; |
| 333 | 331 | $donor = $request->get_param( 'donor' ) ?? ''; |
| @@ -644,26 +642,8 @@ | ||
| 644 | 642 | public function bulk_action( $request ) { |
| 645 | 643 | $action = $request->get_param( 'action' ); |
| 646 | 644 | $ids = $request->get_param( 'ids' ); |
| 647 | 645 | |
| 648 | - if ( ! is_array( $ids ) ) { | |
| 649 | - $ids = []; | |
| 650 | - } | |
| 651 | - | |
| 652 | - // Cap bulk operations at 200 IDs per request. Each ID triggers a | |
| 653 | - // per-row SELECT + DELETE / UPDATE — an arbitrarily large array in one | |
| 654 | - // request would chew through the database serially and time out the | |
| 655 | - // response. 200 is enough headroom for any realistic admin UI | |
| 656 | - // selection; larger jobs should be split client-side (parity with the | |
| 657 | - // donors bulk-action endpoint). | |
| 658 | - if ( count( $ids ) > 200 ) { | |
| 659 | - return new WP_Error( | |
| 660 | - 'too_many_items', | |
| 661 | - __( 'Bulk actions are limited to 200 donations per request.', 'suredonation' ), | |
| 662 | - [ 'status' => 400 ] | |
| 663 | - ); | |
| 664 | - } | |
| 665 | - | |
| 666 | 646 | $success_count = 0; |
| 667 | 647 | $error_count = 0; |
| 668 | 648 | |
| 669 | 649 | foreach ( $ids as $id ) { |
| @@ -1218,38 +1198,14 @@ | ||
| 1218 | 1198 | if ( ! is_array( $donation_data ) ) { |
| 1219 | 1199 | $donation_data = []; |
| 1220 | 1200 | } |
| 1221 | 1201 | |
| 1222 | - // Build the persisted submitted fields list (label/value/group). The | |
| 1223 | - // group is the parent block label (e.g. "Address") used to nest | |
| 1224 | - // sub-fields on the entry screen; '' for standalone fields. | |
| 1225 | - $submitted_fields = []; | |
| 1226 | - if ( isset( $donation_data['fields'] ) && is_array( $donation_data['fields'] ) ) { | |
| 1227 | - foreach ( $donation_data['fields'] as $field ) { | |
| 1228 | - if ( ! is_array( $field ) ) { | |
| 1229 | - continue; | |
| 1230 | - } | |
| 1231 | - // sanitize_text_field (not esc_html) for REST data: the values are | |
| 1232 | - // already sanitized at write time and React escapes on render, so | |
| 1233 | - // esc_html here would double-encode (e.g. "Cats & Dogs" -> "Cats & Dogs"). | |
| 1234 | - $submitted_fields[] = [ | |
| 1235 | - 'label' => sanitize_text_field( Helper::get_string_value( $field['label'] ?? '' ) ), | |
| 1236 | - 'value' => sanitize_text_field( Helper::get_string_value( $field['value'] ?? '' ) ), | |
| 1237 | - 'group' => sanitize_text_field( Helper::get_string_value( $field['group'] ?? '' ) ), | |
| 1238 | - ]; | |
| 1239 | - } | |
| 1240 | - } | |
| 1241 | - | |
| 1242 | 1202 | return [ |
| 1243 | 1203 | 'id' => $donation_id, |
| 1244 | 1204 | 'campaign_id' => $campaign_id, |
| 1245 | - // Plain-text titles rendered by React (which escapes text nodes and does | |
| 1246 | - // not decode HTML entities). get_the_title() runs wptexturize, whose | |
| 1247 | - // default replacements are entities (e.g. " - " -> "–"), so decode | |
| 1248 | - // them here; wp_kses_post would leave the entity and it would show raw. | |
| 1249 | - 'campaign_title' => $campaign_id ? html_entity_decode( wp_strip_all_tags( (string) get_the_title( $campaign_id ) ), ENT_QUOTES, 'UTF-8' ) : '', | |
| 1205 | + 'campaign_title' => $campaign_id ? wp_kses_post( (string) get_the_title( $campaign_id ) ) : '', | |
| 1250 | 1206 | 'form_id' => $form_id, |
| 1251 | - 'form_title' => $form_id ? html_entity_decode( wp_strip_all_tags( (string) get_the_title( $form_id ) ), ENT_QUOTES, 'UTF-8' ) : '', | |
| 1207 | + 'form_title' => $form_id ? wp_kses_post( (string) get_the_title( $form_id ) ) : '', | |
| 1252 | 1208 | 'form_edit_url' => $form_edit_url, |
| 1253 | 1209 | 'donor_id' => isset( $donation['donor_id'] ) ? Helper::get_integer_value( $donation['donor_id'] ) : 0, |
| 1254 | 1210 | 'donor_name' => esc_html( Helper::get_string_value( $donation['donor_name'] ?? '' ) ), |
| 1255 | 1211 | 'donor_email' => sanitize_email( Helper::get_string_value( $donation['donor_email'] ?? '' ) ), |
| @@ -1270,9 +1226,8 @@ | ||
| 1270 | 1226 | 'subscription_status' => esc_html( Helper::get_string_value( $donation['subscription_status'] ?? '' ) ), |
| 1271 | 1227 | 'parent_subscription_id' => isset( $donation['parent_subscription_id'] ) ? Helper::get_integer_value( $donation['parent_subscription_id'] ) : 0, |
| 1272 | 1228 | 'subscription_interval' => esc_html( Helper::get_string_value( $donation_data['subscription_interval'] ?? '' ) ), |
| 1273 | 1229 | 'billing_cycles' => esc_html( Helper::get_string_value( $donation_data['billing_cycles'] ?? '' ) ), |
| 1274 | - 'fields' => $submitted_fields, | |
| 1275 | 1230 | 'created_at' => esc_html( Helper::get_string_value( $donation['created_at'] ?? '' ) ), |
| 1276 | 1231 | 'updated_at' => esc_html( Helper::get_string_value( $donation['updated_at'] ?? '' ) ), |
| 1277 | 1232 | 'logs' => $logs, |
| 1278 | 1233 | ]; |
