fix: lit/library-list search by title, own entries for authors, cursor without hidden rows (L3)
search uses search_columns post_title; users without edit_others_posts on et_pb_layout query their own entries only (PostGuard::ownPostsOnly); the cursor counts the entries shown, never the rows left out. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -70,8 +70,9 @@ class DiviLibraryStore
|
||||
/**
|
||||
* Published entries, $limit + 1 of them (Cursor::page() tells whether there are more).
|
||||
*
|
||||
* @param array{layout_type?: string, scope?: string, search?: string, category?: string} $filters
|
||||
* scope: "global" or "normal"; category: name of a layout_category term.
|
||||
* @param array{layout_type?: string, scope?: string, search?: string, category?: string, author?: int} $filters
|
||||
* scope: "global" or "normal"; search: in the title; category: name of a layout_category
|
||||
* term; author: only this user's entries.
|
||||
* @return list<WP_Post>
|
||||
*/
|
||||
public function find(array $filters, int $limit, int $offset): array
|
||||
@@ -101,6 +102,12 @@ class DiviLibraryStore
|
||||
];
|
||||
if (($filters['search'] ?? '') !== '') {
|
||||
$args['s'] = $filters['search'];
|
||||
// Audit L3: the title only – content is block JSON, and entries the user may not read
|
||||
// must not be findable by their content.
|
||||
$args['search_columns'] = ['post_title'];
|
||||
}
|
||||
if (is_int($filters['author'] ?? null)) {
|
||||
$args['author'] = $filters['author'];
|
||||
}
|
||||
if ($taxQuery !== []) {
|
||||
// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_tax_query -- the library is small.
|
||||
|
||||
Reference in New Issue
Block a user