WordPress.org
Get WordPress

Plugin Directory

Changeset 3652921


Ignore:
Timestamp:
08/18/2026 01:08:29 PM (2 months ago)
Author:
damian-gora
Message:

v1.34.1

Location:
ajax-search-for-woocommerce/trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • ajax-search-for-woocommerce/trunk/ajax-search-for-woocommerce.php

    r3632527 r3652921  
    55 * Plugin URI: https://fibosearch.com?utm_source=wp-admin&utm_medium=referral&utm_campaign=author_uri&utm_gen=utmdc
    66 * Description: The most popular WooCommerce product search. Gives your users a well-designed advanced AJAX search bar with live search suggestions.
    7  * Version: 1.34.0
     7 * Version: 1.34.1
    88 * Author: FiboSearch Team
    99 * Author URI: https://fibosearch.com?utm_source=wp-admin&utm_medium=referral&utm_campaign=author_uri&utm_gen=utmdc
    … …  
    1212 * Requires Plugins: woocommerce
    1313 * WC requires at least: 5.5
    14  * WC tested up to: 10.9
     14 * WC tested up to: 11.0
    1515 *
    1616 */

  • ajax-search-for-woocommerce/trunk/includes/Engines/WordPressNative/DetailsBox.php

    r3516415 r3652921  
    199199        ob_start();
    200200        $queryArgs = $this->getProductsQueryArgs( $termID, $taxonomy );
     201        add_filter(
     202            'posts_where',
     203            ['DgoraWcas\\Helpers', 'excludePasswordProtectedProducts'],
     204            90,
     205            2
     206        );
    201207        $products = new \WP_Query($queryArgs);
     208        remove_filter( 'posts_where', ['DgoraWcas\\Helpers', 'excludePasswordProtectedProducts'], 90 );
    202209        if ( $products->have_posts() ) {
    203210            $limit = $queryArgs['posts_per_page'];

  • ajax-search-for-woocommerce/trunk/includes/Engines/WordPressNative/Search.php

    r3632527 r3652921  
    191191                return $this->getEmptyOutput();
    192192            } else {
    193                 echo json_encode( Helpers::noResultsSuggestion( $this->getEmptyOutput() ) );
    194                 die;
     193                wp_send_json( Helpers::noResultsSuggestion( $this->getEmptyOutput() ) );
     194            }
     195        }
     196        // Break early if keyword is empty - an empty phrase must not return the whole catalog.
     197        if ( $keyword === '' ) {
     198            if ( $return ) {
     199                return $this->getEmptyOutput();
     200            } else {
     201                wp_send_json( Helpers::noResultsSuggestion( $this->getEmptyOutput() ) );
    195202            }
    196203        }
    … …  
    228235            }
    229236            $args = apply_filters( 'dgwt/wcas/search_query/args', $args );
     237            add_filter(
     238                'posts_where',
     239                ['DgoraWcas\\Helpers', 'excludePasswordProtectedProducts'],
     240                90,
     241                2
     242            );
    230243            $products = get_posts( $args );
     244            remove_filter( 'posts_where', ['DgoraWcas\\Helpers', 'excludePasswordProtectedProducts'], 90 );
    231245            $products = apply_filters( 'dgwt/wcas/search_results/products_raw', $products );
    232246            $totalProducts = count( $products );
    … …  
    273287                        return $result;
    274288                    } else {
    275                         echo json_encode( $result );
    276                         die;
     289                        wp_send_json( $result );
    277290                    }
    278291                }
    … …  
    291304                        return $result;
    292305                    } else {
    293                         echo json_encode( $result );
    294                         die;
     306                        wp_send_json( $result );
    295307                    }
    296308                }
    … …  
    344356                    return $result;
    345357                } else {
    346                     echo json_encode( $result );
    347                     die;
     358                    wp_send_json( $result );
    348359                }
    349360            }
    … …  
    373384            return $result;
    374385        } else {
    375             echo json_encode( $result );
    376             die;
     386            wp_send_json( $result );
    377387        }
    378388    }
    … …  
    527537            'taxonomy' => 'product_cat',
    528538        ];
     539        $keywordUnslashed = wp_unslash( $keyword );
     540        if ( $keywordUnslashed === '' ) {
     541            return $results;
     542        }
    529543        $productCategories = get_terms( 'product_cat', apply_filters( 'dgwt/wcas/search/product_cat/args', $args ) );
    530         $keywordUnslashed = wp_unslash( $keyword );
    531544        // Compare keyword and term name
    532545        $i = 0;
    … …  
    566579     * Extend research in the Woo tags
    567580     *
    568      * @param strong $keyword
     581     * @param string $keyword
    569582     * @param int $limit
    570583     *
    … …  
    579592            'taxonomy' => 'product_tag',
    580593        ];
     594        $keywordUnslashed = wp_unslash( $keyword );
     595        if ( $keywordUnslashed === '' ) {
     596            return $results;
     597        }
    581598        $productTags = get_terms( 'product_tag', apply_filters( 'dgwt/wcas/search/product_tag/args', $args ) );
    582         $keywordUnslashed = wp_unslash( $keyword );
    583599        // Compare keyword and term name
    584600        $i = 0;
    … …  
    661677            if ( !empty( $search ) ) {
    662678                $search = " AND ({$search}) ";
    663                 // Password-protected products are never searchable, regardless of the login state.
    664                 $search .= " AND ({$wpdb->posts}.post_password = '') ";
    665679            }
    666680        }

  • ajax-search-for-woocommerce/trunk/includes/Helpers.php

    r3419868 r3652921  
    14061406        }
    14071407        return '';
     1408    }
     1409
     1410    /**
     1411     * Exclude password-protected products from a query.
     1412     *
     1413     * Meant to be hooked tightly around a single get_posts()/WP_Query call and
     1414     * unhooked immediately after, so it never leaks into unrelated queries. The
     1415     * post_type === 'product' guard is defense-in-depth in case the caller's
     1416     * remove_filter() somehow doesn't run.
     1417     *
     1418     * @param string    $where SQL WHERE clause.
     1419     * @param \WP_Query $query The WP_Query instance (passed by reference).
     1420     *
     1421     * @return string
     1422     */
     1423    public static function excludePasswordProtectedProducts( $where, $query ) {
     1424        global $wpdb;
     1425        if ( empty( $query->query_vars['post_type'] ) || $query->query_vars['post_type'] !== 'product' ) {
     1426            return $where;
     1427        }
     1428        $where .= " AND ({$wpdb->posts}.post_password = '') ";
     1429        return $where;
    14081430    }
    14091431

  • ajax-search-for-woocommerce/trunk/readme.txt

    r3632527 r3652921  
    33Tags: woocommerce search, ajax search, search by sku, product search, woocommerce
    44Requires at least: 6.5
    5 Tested up to: 7.0
     5Tested up to: 7.1
    66Requires PHP: 7.4
    7 Stable tag: 1.34.0
     7Stable tag: 1.34.1
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    148148
    149149== Changelog ==
     150
     151= 1.34.1, August 18, 2026 =
     152* SECURITY: A search request with an empty query could reveal password-protected products to unauthenticated users. Thanks to Duy Tran for the responsible disclosure.
     153* UPDATED: The `.pot` file
    150154
    151155= 1.34.0, August 3, 2026 =
    … …  
    325329* UPDATED: Freemius SDK
    326330
    327 = 1.26.1, October 19, 2023 =
    328 * FIXED: Details Panel: wrong HTML format of the stock status element
    329 
    330331[See changelog for all versions](https://fibosearch.com/changelog/).

  • ajax-search-for-woocommerce/trunk/vendor/autoload.php

    r3632527 r3652921  
    2323require_once __DIR__ . '/composer/autoload_real.php';
    2424
    25 return ComposerAutoloaderInitc3736af2ab144591bbc7587e60ab1765::getLoader();
     25return ComposerAutoloaderInita9a788dab01b4dc03d7408a803691670::getLoader();

  • ajax-search-for-woocommerce/trunk/vendor/composer/autoload_real.php

    r3632527 r3652921  
    33// autoload_real.php @generated by Composer
    44
    5 class ComposerAutoloaderInitc3736af2ab144591bbc7587e60ab1765
     5class ComposerAutoloaderInita9a788dab01b4dc03d7408a803691670
    66{
    77    private static $loader;
    … …  
    2323        }
    2424
    25         spl_autoload_register(array('ComposerAutoloaderInitc3736af2ab144591bbc7587e60ab1765', 'loadClassLoader'), true, true);
     25        spl_autoload_register(array('ComposerAutoloaderInita9a788dab01b4dc03d7408a803691670', 'loadClassLoader'), true, true);
    2626        self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(__DIR__));
    27         spl_autoload_unregister(array('ComposerAutoloaderInitc3736af2ab144591bbc7587e60ab1765', 'loadClassLoader'));
     27        spl_autoload_unregister(array('ComposerAutoloaderInita9a788dab01b4dc03d7408a803691670', 'loadClassLoader'));
    2828
    2929        require __DIR__ . '/autoload_static.php';
    30         call_user_func(\Composer\Autoload\ComposerStaticInitc3736af2ab144591bbc7587e60ab1765::getInitializer($loader));
     30        call_user_func(\Composer\Autoload\ComposerStaticInita9a788dab01b4dc03d7408a803691670::getInitializer($loader));
    3131
    3232        $loader->register(true);
    3333
    34         $filesToLoad = \Composer\Autoload\ComposerStaticInitc3736af2ab144591bbc7587e60ab1765::$files;
     34        $filesToLoad = \Composer\Autoload\ComposerStaticInita9a788dab01b4dc03d7408a803691670::$files;
    3535        $requireFile = \Closure::bind(static function ($fileIdentifier, $file) {
    3636            if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {

  • ajax-search-for-woocommerce/trunk/vendor/composer/autoload_static.php

    r3632527 r3652921  
    55namespace Composer\Autoload;
    66
    7 class ComposerStaticInitc3736af2ab144591bbc7587e60ab1765
     7class ComposerStaticInita9a788dab01b4dc03d7408a803691670
    88{
    99    public static $files = array (
    … …  
    3131    {
    3232        return \Closure::bind(function () use ($loader) {
    33             $loader->prefixLengthsPsr4 = ComposerStaticInitc3736af2ab144591bbc7587e60ab1765::$prefixLengthsPsr4;
    34             $loader->prefixDirsPsr4 = ComposerStaticInitc3736af2ab144591bbc7587e60ab1765::$prefixDirsPsr4;
    35             $loader->classMap = ComposerStaticInitc3736af2ab144591bbc7587e60ab1765::$classMap;
     33            $loader->prefixLengthsPsr4 = ComposerStaticInita9a788dab01b4dc03d7408a803691670::$prefixLengthsPsr4;
     34            $loader->prefixDirsPsr4 = ComposerStaticInita9a788dab01b4dc03d7408a803691670::$prefixDirsPsr4;
     35            $loader->classMap = ComposerStaticInita9a788dab01b4dc03d7408a803691670::$classMap;
    3636
    3737        }, null, ClassLoader::class);
Note: See TracChangeset for help on using the changeset viewer.