← All changes | src/rest-api/stats/class-endpoint-posts.php +32 -14 3.19.2 → 3.24.2 View file →

		@@ -21,8 +21,11 @@
21	21	* The Stats API Posts endpoint.
22	22	*
23	23	* Provides an endpoint for retrieving posts.
24	24	*
	25	+ * It returns site-wide analytics, so it's available to any user with the
	26	+ * default `publish_posts` capability, whoever authored the posts.
	27	+ *
25	28	* @since 3.17.0
26	29	*/
27	30	class Endpoint_Posts extends Base_Endpoint {
28	31	use Post_Data_Trait;
		@@ -28,8 +31,9 @@
28	31	use Post_Data_Trait;
29	32
30	33	public const TOP_POSTS_DEFAULT_LIMIT = 5;
31	34	public const SORT_DEFAULT = 'views';
	35	+ public const MAX_URLS = 500;
32	36
33	37	/**
34	38	* The metrics that can be sorted by.
35	39	*
		@@ -82,9 +86,9 @@
82	86	$this->content_api = $this->parsely->get_content_api();
83	87	}
84	88
85	89	/**
86		- * Returns the endpoint name.
	90	+ * Returns the endpoint's name.
87	91	*
88	92	* @since 3.17.0
89	93	*
90	94	* @return string
		@@ -154,23 +158,19 @@
154	158	'required' => false,
155	159	'default' => 1,
156	160	),
157	161	'author' => array(
158		- 'description' => 'Comma-separated list of authors to filter by.',
159		- 'type' => 'string',
160		- 'required' => false,
161		- 'validate_callback' => array( $this, 'validate_max_length_is_5' ),
162		- 'sanitize_callback' => array( $this, 'sanitize_string_to_array' ),
	162	+ 'description' => 'The author to filter by.',
	163	+ 'type' => 'string',
	164	+ 'required' => false,
163	165	),
164	166	'section' => array(
165		- 'description' => 'Comma-separated list of sections to filter by.',
166		- 'type' => 'string',
167		- 'required' => false,
168		- 'validate_callback' => array( $this, 'validate_max_length_is_5' ),
169		- 'sanitize_callback' => array( $this, 'sanitize_string_to_array' ),
	167	+ 'description' => 'The section to filter by.',
	168	+ 'type' => 'string',
	169	+ 'required' => false,
170	170	),
171	171	'tag' => array(
172		- 'description' => 'Comma-separated list of tags to filter by.',
	172	+ 'description' => 'The tags to filter by (in comma-separated format).',
173	173	'type' => 'string',
174	174	'required' => false,
175	175	'validate_callback' => array( $this, 'validate_max_length_is_5' ),
176	176	'sanitize_callback' => array( $this, 'sanitize_string_to_array' ),
		@@ -182,8 +182,10 @@
182	182	),
183	183	'urls' => array(
184	184	'description' => 'The URLs to fetch data for.',
185	185	'type' => 'array',
	186	+ 'items' => array( 'type' => 'string' ),
	187	+ 'maxItems' => self::MAX_URLS,
186	188	'sanitize_callback' => array( $this, 'sanitize_urls' ),
187	189	'validate_callback' => array( $this, 'validate_urls' ),
188	190	'required' => false,
189	191	),
		@@ -250,13 +252,29 @@
250	252	/**
251	253	* Validates if the provided array is a list of URLs.
252	254	*
253	255	* @since 3.19.0
	256	+ * @since 3.24.2 Rejects non-arrays and more than `MAX_URLS` items.
254	257	*
255		- * @param array<string> $urls The array to validate.
	258	+ * @param mixed $urls The raw parameter value, as validation runs before type checks.
256	259	* @return true|WP_Error
257	260	*/
258		- public function validate_urls( array $urls ) {
	261	+ public function validate_urls( $urls ) {
	262	+ if ( ! is_array( $urls ) ) {
	263	+ return new WP_Error( 'invalid_param', __( 'The parameter must be a list of URLs.', 'wp-parsely' ) );
	264	+ }
	265	+
	266	+ if ( count( $urls ) > self::MAX_URLS ) {
	267	+ return new WP_Error(
	268	+ 'invalid_param',
	269	+ sprintf(
	270	+ /* translators: %d: The maximum number of items. */
	271	+ __( 'The parameter must have at most %d items.', 'wp-parsely' ),
	272	+ self::MAX_URLS
	273	+ )
	274	+ );
	275	+ }
	276	+
259	277	foreach ( $urls as $url ) {
260	278	if ( false === filter_var( $url, FILTER_VALIDATE_URL ) ) {
261	279	return new WP_Error( 'invalid_param', __( 'The parameter must be a list of URLs.', 'wp-parsely' ) );
262	280	}