← All changes | classes/REST_API.php +109 -31 5.0.29 → 5.0.41 View file →

		@@ -20,8 +20,34 @@
20	20	*/
21	21	class REST_API {
22	22
23	23	/**
	24	+ * Upper bound for the search endpoint's postPerPage. Matches the max of the
	25	+ * Search block's "Show Initial Post" slider, so no UI value is ever capped.
	26	+ * This is the same max range of the slider in gutenburg editor.
	27	+ * 100 is enough for search bar result.
	28	+ *
	29	+ * @since v.5.0.35
	30	+ */
	31	+ const SEARCH_POSTS_PER_PAGE_MAX = 100;
	32	+
	33	+ /**
	34	+ * Longest accepted search term. Longer strings only widen the LIKE pattern
	35	+ * scanned against every row; no real query needs more.
	36	+ *
	37	+ * @since v.5.0.35
	38	+ */
	39	+ const SEARCH_TEXT_MAX_LENGTH = 200;
	40	+
	41	+ /**
	42	+ * Upper bound for excerptLimit. Also keeps $num_words + 1 inside integer range
	43	+ * in wp_trim_words(), which otherwise overflows to float on a huge value.
	44	+ *
	45	+ * @since v.5.0.35
	46	+ */
	47	+ const SEARCH_EXCERPT_WORDS_MAX = 400;
	48	+
	49	+ /**
24	50	* Setup class.
25	51	*
26	52	* @since v.1.0.0
27	53	*/
		@@ -633,28 +659,61 @@
633	659	$post = $server->get_params();
634	660	$searchText = isset( $post['searchText'] ) ? ultimate_post()->ultp_rest_sanitize_params( $post['searchText'] ) : '';
635	661	$paged = isset( $post['paged'] ) ? ultimate_post()->ultp_rest_sanitize_params( $post['paged'] ) : '';
636	662	$postPerPage = isset( $post['postPerPage'] ) ? ultimate_post()->ultp_rest_sanitize_params( $post['postPerPage'] ) : '';
637		- $query_args = array(
	663	+
	664	+ // Public route: cap posts_per_page so -1 can never mean "unlimited".
	665	+ // 0 survives the cap, and WP_Query resolves it to the posts_per_page option.
	666	+ $postPerPage = min( absint( $postPerPage ), self::SEARCH_POSTS_PER_PAGE_MAX );
	667	+ // is_scalar first: searchText arrives as an array if the caller sends one, and
	668	+ // casting that to string is an "Array to string conversion" warning.
	669	+ $searchText = is_scalar( $searchText ) ? mb_substr( (string) $searchText, 0, self::SEARCH_TEXT_MAX_LENGTH ) : '';
	670	+
	671	+ $query_args = array(
638	672	's' => $searchText,
639	673	'paged' => $paged,
640		- 'compare' => 'LIKE',
641	674	'orderby' => 'relevance',
642	675	'posts_per_page' => $postPerPage,
643	676	);
644	677	if ( isset( $post['exclude'] ) && is_array( $post['exclude'] ) && count( $post['exclude'] ) > 0 ) {
645		- $post['exclude'] = ultimate_post()->ultp_rest_sanitize_params( $post['exclude'] );
646		- $post_exclude = array();
647		- foreach ( $post['exclude'] as $data ) {
648		- $post_exclude[ $data['title'] ] = $data['title'];
	678	+ $all_types = get_post_types( array( 'public' => true ), 'names' );
	679	+ $post_exclude = array();
	680	+
	681	+ // Bound before sanitising: this route is public, and sanitising an array
	682	+ // whose length the caller picks is itself the attack. Excluding more post
	683	+ // types than exist is meaningless, so nothing valid is dropped.
	684	+ // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Length is bounded here only; every element is sanitized below before use.
	685	+ $exclude_input = array_slice( $post['exclude'], 0, count( $all_types ) );
	686	+
	687	+ foreach ( $exclude_input as $data ) {
	688	+ // A flat array of strings would index a string here and warn.
	689	+ if ( ! is_array( $data ) || ! isset( $data['title'] ) || ! is_scalar( $data['title'] ) ) {
	690	+ continue;
	691	+ }
	692	+ $exclude_type = sanitize_text_field( $data['title'] );
	693	+ $post_exclude[ $exclude_type ] = $exclude_type;
649	694	}
650		- $all_types = get_post_types( array( 'public' => true ), 'names' );
651		- $post_type = array_diff_key( $all_types, $post_exclude );
652		- $query_args['post_type'] = $post_type;
	695	+
	696	+ $query_args['post_type'] = array_diff_key( $all_types, $post_exclude );
653	697	}
654	698	$output = '';
655	699	$query_result = new \WP_Query( $query_args );
656	700
	701	+ /**
	702	+ * Resolved once here rather than guarded at each use, since the request may
	703	+ * omit any of them. The loose == is deliberate: the two callers disagree on
	704	+ * type -- the editor sends real booleans, the frontend sends 1/0 parsed out
	705	+ * of data attributes -- and both must keep working.
	706	+ */
	707	+ $show_image = isset( $post['image'] ) && $post['image'] == 1;
	708	+ $show_category = isset( $post['category'] ) && $post['category'] == 1;
	709	+ $show_author = isset( $post['author'] ) && $post['author'] == 1;
	710	+ $show_date = isset( $post['date'] ) && $post['date'] == 1;
	711	+ $show_excerpt = isset( $post['excerpt'] ) && $post['excerpt'] == 1;
	712	+ $excerpt_limit = isset( $post['excerptLimit'] )
	713	+ ? min( absint( $post['excerptLimit'] ), self::SEARCH_EXCERPT_WORDS_MAX )
	714	+ : 55;
	715	+
657	716	if ( $query_result->have_posts() ) {
658	717	while ( $query_result->have_posts() ) {
659	718	$query_result->the_post();
660	719	$post_id = get_the_ID();
		@@ -660,40 +719,59 @@
660	719	$post_id = get_the_ID();
661	720	$title = get_the_title();
662	721
663	722	$output .= '<div class="ultp-search-result__item">';
664		- if ( $post['image'] == 1 && has_post_thumbnail() ) {
665		- $thumb_id = get_post_thumbnail_id( $post_id );
666		- $output .= '<img class="ultp-searchresult-image" src=' . wp_get_attachment_image_src( $thumb_id, 'thumbnail', false )[0] . ' alt="' . $title . '"/>';
	723	+
	724	+ if ( $show_image && has_post_thumbnail() ) {
	725	+ // has_post_thumbnail() only proves the _thumbnail_id meta exists.
	726	+ // If the attachment behind it was deleted, src() returns false.
	727	+ $thumb = wp_get_attachment_image_src( get_post_thumbnail_id( $post_id ), 'thumbnail', false );
	728	+ if ( ! empty( $thumb[0] ) ) {
	729	+ $output .= '<img class="ultp-searchresult-image" src="' . esc_url( $thumb[0] ) . '" alt="' . esc_attr( $title ) . '"/>';
	730	+ }
667	731	}
668		- $output .= '<div class="ultp-searchresult-content">';
669		- $output .= '<div class="ultp-rescontent-meta">';
670		- // Category.
671		- $post_cat = get_the_terms( $post_id, 'category' );
672		- if ( $post['category'] == 1 && $post_cat && count( $post_cat ) ) {
	732	+
	733	+ $output .= '<div class="ultp-searchresult-content">';
	734	+ $output .= '<div class="ultp-rescontent-meta">';
	735	+
	736	+ // Category.
	737	+ $post_cat = get_the_terms( $post_id, 'category' );
	738	+ if ( $show_category && $post_cat && ! is_wp_error( $post_cat ) ) {
673	739	$output .= '<div class="ultp-searchresult-category">';
674	740	foreach ( $post_cat as $cat ) {
675		- $output .= '<a href="' . get_term_link( $cat->term_id ) . '">' . $cat->name . '</a>';
	741	+ $term_link = get_term_link( $cat->term_id );
	742	+ if ( is_wp_error( $term_link ) ) {
	743	+ continue;
	744	+ }
	745	+ $output .= '<a href="' . esc_url( $term_link ) . '">' . esc_html( $cat->name ) . '</a>';
676	746	}
677		- $output .= '</div>';
	747	+ $output .= '</div>';
678	748	}
679		- // Author.
680		- if ( $post['author'] == 1 ) {
	749	+
	750	+ // Author.
	751	+ if ( $show_author ) {
681	752	$user_id = get_the_author_meta( 'ID' );
682		- $output .= '<a href="' . get_author_posts_url( $user_id ) . '" class="ultp-searchresult-author">' . get_the_author_meta( 'display_name' ) . '</a>';
	753	+ $output .= '<a href="' . esc_url( get_author_posts_url( $user_id ) ) . '" class="ultp-searchresult-author">' . esc_html( get_the_author_meta( 'display_name' ) ) . '</a>';
683	754	}
684		- // Date.
685		- if ( $post['date'] == 1 ) {
686		- $output .= '<div class="ultp-searchresult-publishdate">' . get_the_date( 'F j, Y' ) . '</div>';
	755	+
	756	+ // Date.
	757	+ if ( $show_date ) {
	758	+ $output .= '<div class="ultp-searchresult-publishdate">' . esc_html( get_the_date( 'F j, Y' ) ) . '</div>';
687	759	}
688		- $output .= '</div>';
689		- $output .= '<a href="' . get_permalink() . '" class="ultp-searchresult-title">' . $title . '</a>';
690		- if ( $post['excerpt'] == 1 ) {
691		- $output .= '<div class="ultp-searchresult-excerpt">' . wp_trim_words( get_the_excerpt(), isset( $post['excerptLimit'] ) ? ultimate_post()->ultp_rest_sanitize_params( $post['excerptLimit'] ) : 55 ) . '</div>';
	760	+
	761	+ $output .= '</div>';
	762	+ $output .= '<a href="' . esc_url( get_permalink() ) . '" class="ultp-searchresult-title">' . esc_html( $title ) . '</a>';
	763	+
	764	+ if ( $show_excerpt ) {
	765	+ // wp_trim_words() strips tags, so what comes back is plain text.
	766	+ $output .= '<div class="ultp-searchresult-excerpt">' . esc_html( wp_trim_words( get_the_excerpt(), $excerpt_limit ) ) . '</div>';
692	767	}
693		- $output .= '</div>';
694		- $output .= '</div>';
	768	+
	769	+ $output .= '</div>';
	770	+ $output .= '</div>';
695	771	}
	772	+ // the_post() overwrote the global $post; hand it back.
	773	+ wp_reset_postdata();
696	774	}
697	775
698	776	return array(
699	777	'post_data' => $output,