← All changes | includes/API/Conditions.php +29 -12 3.6.1 → 3.7.2 View file →

		@@ -95,31 +95,46 @@
95	95	public function autocomplete( WP_REST_Request $request ): WP_REST_Response {
96	96	$query = $request->get_param( 'query' );
97	97	$type = $query['query_type'] ?? '';
98	98
99		- if ( empty( $type ) ) {
100		- // FIXME: need throw error maybe
	99	+ $allowed_fields = [
	100	+ 'authors' => [ 'ID', 'user_nicename', 'display_name' ],
	101	+ 'posts' => [ 'ID', 'post_title', 'post_name' ],
	102	+ 'taxonomy' => [ 'term_id', 'slug', 'name' ],
	103	+ ];
	104	+
	105	+ if ( empty( $type ) || ! isset( $allowed_fields[ $type ] ) ) {
101	106	return $this->success( [] );
102	107	}
103	108
104	109	$by_field = $query['field'] ?? '';
105	110
106		- if ( empty( $by_field ) ) {
107		- // FIXME: need throw error maybe
	111	+ if ( empty( $by_field ) || ! in_array( $by_field, $allowed_fields[ $type ], true ) ) {
108	112	return $this->success( [] );
109	113	}
110	114
	115	+ if ( 'authors' === $type && ! current_user_can( 'list_users' ) ) {
	116	+ return $this->success( [] );
	117	+ }
	118	+
111	119	$payload = sanitize_text_field( $request->get_param( 'payload' ) );
112	120	$args = [ 'search' => $payload ];
113		- if(is_numeric($payload)){
114		- $args = [ 'post__in' => [(int) $payload] ];
	121	+ if ( is_numeric( $payload ) ) {
	122	+ $args = [ 'post__in' => [ (int) $payload ] ];
115	123	}
116	124
117		- if ( isset( $query['query'] ) ) {
118		- $args = wp_parse_args( $query['query'], $args );
	125	+ if ( isset( $query['query'] ) && is_array( $query['query'] ) ) {
	126	+ $safe_query_keys = [
	127	+ 'post_type', 'posts_per_page', 'number', 'orderby', 'order',
	128	+ 'taxonomy', 'parent', 'hide_empty',
	129	+ ];
	130	+ $safe_query = array_intersect_key( $query['query'], array_flip( $safe_query_keys ) );
	131	+ $args = wp_parse_args( $safe_query, $args );
119	132	}
120	133
121		- $results = [];
	134	+ $results = [];
	135	+ $data = [];
	136	+ $data_key = '';
122	137
123	138	switch ( $type ) {
124	139	case 'taxonomy':
125	140	$_default = [ 'hide_empty' => false ];
		@@ -126,11 +141,13 @@
126	141	$data = get_terms( wp_parse_args( $args, $_default ) );
127	142	$data_key = 'name';
128	143	break;
129	144	case 'posts':
130		- $args['s'] = $args['search'];
131		- $data = get_posts( $args );
132		- $data_key = 'post_title';
	145	+ $args['s'] = $args['search'];
	146	+ $args['post_status'] = 'publish';
	147	+ $args['perm'] = 'readable';
	148	+ $data = get_posts( $args );
	149	+ $data_key = 'post_title';
133	150	break;
134	151	case 'authors':
135	152	$args['search_columns'] = [ 'user_nicename', 'user_login' ];
136	153	$args['search'] = "*{$args['search']}*";