fix: lit/library-list search by title, own entries for authors, cursor without hidden rows (L3)

search uses search_columns post_title; users without edit_others_posts on
et_pb_layout query their own entries only (PostGuard::ownPostsOnly); the
cursor counts the entries shown, never the rows left out.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
2026-09-27 04:18:04 +02:00
co-authored by Claude Opus 5.5
parent ce4dc776e5
commit d8d7bb67be
4 changed files with 83 additions and 15 deletions
@@ -70,8 +70,9 @@ class DiviLibraryStore
/**
* Published entries, $limit + 1 of them (Cursor::page() tells whether there are more).
*
* @param array{layout_type?: string, scope?: string, search?: string, category?: string} $filters
* scope: "global" or "normal"; category: name of a layout_category term.
* @param array{layout_type?: string, scope?: string, search?: string, category?: string, author?: int} $filters
* scope: "global" or "normal"; search: in the title; category: name of a layout_category
* term; author: only this user's entries.
* @return list<WP_Post>
*/
public function find(array $filters, int $limit, int $offset): array
@@ -101,6 +102,12 @@ class DiviLibraryStore
];
if (($filters['search'] ?? '') !== '') {
$args['s'] = $filters['search'];
// Audit L3: the title only – content is block JSON, and entries the user may not read
// must not be findable by their content.
$args['search_columns'] = ['post_title'];
}
if (is_int($filters['author'] ?? null)) {
$args['author'] = $filters['author'];
}
if ($taxQuery !== []) {
// phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_tax_query -- the library is small.