← All changes | includes/controls/select-input/dynamic-select-input-module.php +103 -16 1.6.2 → 3.1.4 View file →

		@@ -42,9 +42,9 @@
42	42	/**
43	43	* get Ajax Data
44	44	*/
45	45	public function getSelectInputData() {
46		- $nonce = isset($_POST['security']) ? sanitize_text_field($_POST['security']) : '';
	46	+ $nonce = isset($_POST['security']) ? sanitize_text_field(wp_unslash($_POST['security'])) : '';
47	47
48	48	try {
49	49	if (!wp_verify_nonce($nonce, 'usk_dynamic_select')) {
50	50	throw new Exception('Invalid request');
		@@ -53,20 +53,41 @@
53	53	if (!current_user_can('edit_posts')) {
54	54	throw new Exception('Unauthorized request');
55	55	}
56	56
57		- $query = isset($_POST['query']) ? sanitize_text_field($_POST['query']) : '';
	57	+ $query = isset($_POST['query']) ? sanitize_text_field(wp_unslash($_POST['query'])) : '';
58	58
59		- if ($query == 'terms') {
60		- $data = $this->getTerms();
61		- } else if ($query == 'authors') {
62		- $data = $this->getAuthors();
63		- } else if ($query == 'authors_role') {
64		- $data = $this->getAuthorRoles();
65		- } else if ($query == 'only_post') {
66		- $data = $this->getOnlyPosts();
67		- } else {
68		- $data = $this->getPosts();
	59	+ switch ($query) {
	60	+ case 'posts':
	61	+ $data = $this->getPosts();
	62	+ break;
	63	+ case 'terms':
	64	+ $data = $this->getTerms();
	65	+ break;
	66	+ case 'authors':
	67	+ $data = $this->getAuthors();
	68	+ break;
	69	+ case 'authors_role':
	70	+ $data = $this->getAuthorRoles();
	71	+ break;
	72	+ case 'only_post':
	73	+ $data = $this->getOnlyPosts();
	74	+ break;
	75	+ case 'product_cat':
	76	+ $data = $this->getProductTerms($query);
	77	+ break;
	78	+ case 'product_tag':
	79	+ $data = $this->getProductTerms($query);
	80	+ break;
	81	+ case 'product_attributes':
	82	+ $data = $this->getProductAttributes();
	83	+ break;
	84	+ case 'product_brand':
	85	+ $data = $this->getProductTerms($query);
	86	+ break;
	87	+ default:
	88	+ $data = $this->getPosts();
	89	+ break;
69	90	}
70	91
71	92	wp_send_json_success($data);
72	93	} catch (Exception $e) {
		@@ -80,9 +101,10 @@
80	101	* Get Post Type
81	102	* @return string
82	103	*/
83	104	protected function getPostType() {
84		- return isset($_POST['post_type']) ? sanitize_text_field($_POST['post_type']) : '';
	105	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Only reached from getSelectInputData(), which verifies the usk_dynamic_select nonce first.
	106	+ return isset($_POST['post_type']) ? sanitize_text_field(wp_unslash($_POST['post_type'])) : '';
85	107	}
86	108
87	109	/**
88	110	* @return string[]|\WP_Post_Type[]
		@@ -94,9 +116,10 @@
94	116	/**
95	117	* @return string
96	118	*/
97	119	protected function getSearchQuery() {
98		- return isset($_POST['search_text']) ? sanitize_text_field($_POST['search_text']) : '';
	120	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Only reached from getSelectInputData(), which verifies the usk_dynamic_select nonce first.
	121	+ return isset($_POST['search_text']) ? sanitize_text_field(wp_unslash($_POST['search_text'])) : '';
99	122	}
100	123
101	124	/**
102	125	* @return array|mixed
		@@ -102,9 +125,10 @@
102	125	* @return array|mixed
103	126	*/
104	127	protected function getselecedIds() {
105	128
106		- return isset($_POST['ids']) ? sanitize_text_field($_POST['ids']) : [];
	129	+ // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Only reached from getSelectInputData(), which verifies the usk_dynamic_select nonce first.
	130	+ return isset($_POST['ids']) ? sanitize_text_field(wp_unslash($_POST['ids'])) : [];
107	131	}
108	132
109	133
110	134	/**
		@@ -265,9 +289,9 @@
265	289	}
266	290
267	291	$args = [
268	292	'taxonomy' => $taxonomies,
269		- 'hide_empty' => false,
	293	+ 'hide_empty' => true,
270	294	];
271	295
272	296	if (!empty($include)) {
273	297	$args['include'] = $include;
		@@ -359,8 +383,71 @@
359	383	}
360	384
361	385	return $roles;
362	386	}
	387	+
	388	+ /**
	389	+ * Get Product Categories query Data
	390	+ *
	391	+ * @return array
	392	+ */
	393	+ public function getProductTerms($taxonomy = 'product_cat') {
	394	+ $include = $this->getselecedIds();
	395	+ $search_text = $this->getSearchQuery();
	396	+ $args = [
	397	+ 'taxonomy' => $taxonomy,
	398	+ 'hide_empty' => true,
	399	+ ];
	400	+
	401	+ if (!empty($include)) {
	402	+ $args['include'] = $include;
	403	+ }
	404	+
	405	+ if ($search_text) {
	406	+ $args['number'] = 20;
	407	+ $args['search'] = $search_text;
	408	+ }
	409	+ $terms = get_terms($args);
	410	+
	411	+ if (is_wp_error($terms) || empty($terms)) {
	412	+ return [];
	413	+ }
	414	+
	415	+ foreach ($terms as $term) {
	416	+ $data[] = [
	417	+ 'id' => $term->term_taxonomy_id,
	418	+ 'text' => $term->name,
	419	+ ];
	420	+ }
	421	+ return $data;
	422	+ }
	423	+
	424	+ /**
	425	+ * Get Product Attributes query Data
	426	+ *
	427	+ * @return array
	428	+ */
	429	+ public function getProductAttributes(): array {
	430	+ $search_text = $this->getSearchQuery();
	431	+ // Get all global product attributes
	432	+ $attribute_taxonomies = wc_get_attribute_taxonomies();
	433	+
	434	+ // Map the attributes to the desired structure
	435	+ $data = [];
	436	+
	437	+ foreach ($attribute_taxonomies as $attribute) {
	438	+ $data[] = [
	439	+ 'id' => $attribute->attribute_id,
	440	+ 'text' => $attribute->attribute_label,
	441	+ ];
	442	+ }
	443	+
	444	+ $data = array_filter($data, function ($item) use ($search_text) {
	445	+ return stripos($item['text'], $search_text) !== false;
	446	+ });
	447	+ $data = array_slice($data, 0, 20); // Limit to 20 results
	448	+ return $data;
	449	+ }
363	450	}
364	451
365	452	function Dynamic_Select_Input_Module() {
366	453	return Dynamic_Select_Input_Module::get_instance();