← All changes | includes/API/Conditions.php +10 -30 3.7.3 → 3.1.6 View file →

		@@ -95,46 +95,28 @@
95	95	public function autocomplete( WP_REST_Request $request ): WP_REST_Response {
96	96	$query = $request->get_param( 'query' );
97	97	$type = $query['query_type'] ?? '';
98	98
99		- $allowed_fields = [
100		- 'authors' => [ 'ID', 'user_nicename', 'display_name' ],
101		- 'posts' => [ 'ID', 'post_title', 'post_name' ],
102		- 'taxonomy' => [ 'term_id', 'slug', 'name' ],
103		- ];
104		-
105		- if ( empty( $type ) || ! isset( $allowed_fields[ $type ] ) ) {
	99	+ if ( empty( $type ) ) {
	100	+ // FIXME: need throw error maybe
106	101	return $this->success( [] );
107	102	}
108	103
109	104	$by_field = $query['field'] ?? '';
110	105
111		- if ( empty( $by_field ) || ! in_array( $by_field, $allowed_fields[ $type ], true ) ) {
	106	+ if ( empty( $by_field ) ) {
	107	+ // FIXME: need throw error maybe
112	108	return $this->success( [] );
113	109	}
114	110
115		- if ( 'authors' === $type && ! current_user_can( 'list_users' ) ) {
116		- return $this->success( [] );
117		- }
118		-
119	111	$payload = sanitize_text_field( $request->get_param( 'payload' ) );
120	112	$args = [ 'search' => $payload ];
121		- if ( is_numeric( $payload ) ) {
122		- $args = [ 'post__in' => [ (int) $payload ] ];
123		- }
124	113
125		- if ( isset( $query['query'] ) && is_array( $query['query'] ) ) {
126		- $safe_query_keys = [
127		- 'post_type', 'posts_per_page', 'number', 'orderby', 'order',
128		- 'taxonomy', 'parent', 'hide_empty',
129		- ];
130		- $safe_query = array_intersect_key( $query['query'], array_flip( $safe_query_keys ) );
131		- $args = wp_parse_args( $safe_query, $args );
	114	+ if ( isset( $query['query'] ) ) {
	115	+ $args = wp_parse_args( $query['query'], $args );
132	116	}
133	117
134		- $results = [];
135		- $data = [];
136		- $data_key = '';
	118	+ $results = [];
137	119
138	120	switch ( $type ) {
139	121	case 'taxonomy':
140	122	$_default = [ 'hide_empty' => false ];
		@@ -141,13 +123,11 @@
141	123	$data = get_terms( wp_parse_args( $args, $_default ) );
142	124	$data_key = 'name';
143	125	break;
144	126	case 'posts':
145		- $args['s'] = $args['search'];
146		- $args['post_status'] = 'publish';
147		- $args['perm'] = 'readable';
148		- $data = get_posts( $args );
149		- $data_key = 'post_title';
	127	+ $args['s'] = $args['search'];
	128	+ $data = get_posts( $args );
	129	+ $data_key = 'post_title';
150	130	break;
151	131	case 'authors':
152	132	$args['search_columns'] = [ 'user_nicename', 'user_login' ];
153	133	$args['search'] = "*{$args['search']}*";