← All changes | includes/API/V1/Product_Variations_Controller.php +10 -4 1.10.7 → 1.10.17 View file →

		@@ -288,8 +288,9 @@
288	288
289	289	// Meta fields to search.
290	290	$meta_fields = Barcode_Field::search_keys();
291	291
	292	+ $meta_placeholders = implode( ', ', array_fill( 0, \count( $meta_fields ), '%s' ) );
292	293	$search_conditions = array();
293	294
294	295	foreach ( $search_terms as $term ) {
295	296	$term = $n . $wpdb->esc_like( $term ) . $n;
		@@ -294,15 +295,20 @@
294	295	foreach ( $search_terms as $term ) {
295	296	$term = $n . $wpdb->esc_like( $term ) . $n;
296	297
297	298	// Search in meta fields.
298		- foreach ( $meta_fields as $field ) {
299		- $search_conditions[] = $wpdb->prepare( '(pm1.meta_value LIKE %s AND pm1.meta_key = %s)', $term, $field );
300		- }
	299	+ // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Table names come from $wpdb; $meta_placeholders is a generated list of %s placeholders, and the keys themselves are passed to prepare() as arguments.
	300	+ $search_conditions[] = $wpdb->prepare(
	301	+ "EXISTS (
	302	+ SELECT 1 FROM {$wpdb->postmeta} AS wcpos_search_meta WHERE wcpos_search_meta.post_id = {$wpdb->posts}.ID AND wcpos_search_meta.meta_key IN ($meta_placeholders) AND wcpos_search_meta.meta_value LIKE %s
	303	+ )",
	304	+ array_merge( $meta_fields, array( $term ) )
	305	+ );
	306	+ // phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
301	307	}
302	308
303	309	if ( ! empty( $search_conditions ) ) {
304		- $search = ' AND (' . implode( ' OR ', $search_conditions ) . ') ';
	310	+ $search = ' AND (' . implode( ' AND ', $search_conditions ) . ') ';
305	311	if ( ! is_user_logged_in() ) {
306	312	$search .= " AND ($wpdb->posts.post_password = '') ";
307	313	}
308	314	}