Skip to content

Commit 8adf14c

Browse files
pattonwebzpattonwebz
committed
Remove orphaned edac_insert_ignore_data AJAX handler (PRO-963)
add_ignore() and its wp_ajax_edac_insert_ignore_data registration were the ignore/dismiss mechanism before the REST dismiss-issue endpoint replaced it. The last caller was the Pro plugin's legacy Open/Dismissed Issues pages, removed in PRO-961. Verified dead before removing: no references in the free plugin's current src/admin/index.js, no callers anywhere in accessibility-checker-pro or the multisite/audit-history/cli/export/seed-issues sibling add-ons (only old dist/ build archives from past releases still mention it), and no test coverage exercised it. It also carried the same object-only batch-scoping leak as PRO-1264 (no rule filter on its largeBatch UPDATE), which is now moot since the handler is gone rather than patched. Full PHPUnit suite (874 tests) and phpcs pass.
1 parent 0990d34 commit 8adf14c

1 file changed

Lines changed: 0 additions & 112 deletions

File tree

‎admin/class-ajax.php‎

Lines changed: 0 additions & 112 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,6 @@ public function init_hooks() {
3737
add_action( 'wp_ajax_edac_summary_ajax', [ $this, 'summary' ] );
3838
add_action( 'wp_ajax_edac_details_ajax', [ $this, 'details' ] );
3939
add_action( 'wp_ajax_edac_readability_ajax', [ $this, 'readability' ] );
40-
add_action( 'wp_ajax_edac_insert_ignore_data', [ $this, 'add_ignore' ] );
4140
add_action( 'wp_ajax_edac_dismiss_welcome_cta_ajax', [ $this, 'dismiss_welcome_cta' ] );
4241
add_action( 'wp_ajax_edac_dismiss_dashboard_cta_ajax', [ $this, 'dismiss_dashboard_cta' ] );
4342
( new Email_Opt_In() )->register_ajax_handlers();
@@ -804,117 +803,6 @@ public function readability() {
804803
wp_send_json_success( wp_json_encode( $html ) );
805804
}
806805

807-
/**
808-
* Insert ignore data into database
809-
*
810-
* Note: There is a new dismiss-issue rest endpoint that covers this functionality
811-
* now and should be used going forward. This ajax was updated to support dismiss
812-
* reasons to align with the new endpoint and allow other things to continue to
813-
* work here gracefully.
814-
*
815-
* This should be removed in a future release.
816-
*
817-
* @return void
818-
*
819-
* - '-1' means that nonce could not be varified
820-
* - '-2' means that there isn't any ignore data to return
821-
*/
822-
public function add_ignore() {
823-
824-
// nonce security.
825-
if ( ! isset( $_REQUEST['nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_REQUEST['nonce'] ) ), 'ajax-nonce' ) ) {
826-
wp_send_json_error( new \WP_Error( '-1', __( 'Permission Denied', 'accessibility-checker' ) ) );
827-
}
828-
829-
global $wpdb;
830-
$table_name = $wpdb->prefix . 'accessibility_checker';
831-
$raw_ids = isset( $_REQUEST['ids'] ) ? (array) wp_unslash( $_REQUEST['ids'] ) : []; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitization handled below.
832-
$ids = array_map(
833-
function ( $value ) {
834-
return (int) $value;
835-
},
836-
$raw_ids
837-
); // Sanitizing array elements to integers.
838-
$action = isset( $_REQUEST['ignore_action'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['ignore_action'] ) ) : '';
839-
$type = isset( $_REQUEST['ignore_type'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['ignore_type'] ) ) : '';
840-
$siteid = get_current_blog_id();
841-
842-
// Capability check: verify edit_post on every post affected by this request.
843-
$batch_object = null;
844-
$first_id = reset( $ids );
845-
$valid_table = edac_get_valid_table_name( $table_name );
846-
847-
if ( ! $first_id || ! $valid_table ) {
848-
wp_send_json_error( new \WP_Error( '-2', __( 'No dismissal data to return', 'accessibility-checker' ) ) );
849-
}
850-
851-
if ( isset( $_REQUEST['largeBatch'] ) && 'true' === $_REQUEST['largeBatch'] ) {
852-
// largeBatch updates every row sharing the same object string across the site;
853-
// collect all distinct postids that would be affected and check each one.
854-
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Permission check requires direct lookup.
855-
$batch_object = $wpdb->get_var( $wpdb->prepare( 'SELECT object FROM %i WHERE id = %d', $valid_table, $first_id ) );
856-
if ( ! $batch_object ) {
857-
wp_send_json_error( new \WP_Error( '-2', __( 'No dismissal data to return', 'accessibility-checker' ) ) );
858-
}
859-
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Permission check requires direct lookup.
860-
$affected_post_ids = $wpdb->get_col( $wpdb->prepare( 'SELECT DISTINCT postid FROM %i WHERE siteid = %d AND object = %s', $valid_table, $siteid, $batch_object ) );
861-
} else {
862-
// Small batch: look up the post for every supplied ID in one query.
863-
$id_placeholders = implode( ', ', array_fill( 0, count( $ids ), '%d' ) );
864-
$query_args = array_merge( [ $valid_table ], $ids );
865-
$affected_post_ids = $wpdb->get_col( $wpdb->prepare( "SELECT DISTINCT postid FROM %i WHERE id IN ({$id_placeholders})", $query_args ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder -- Permission check requires direct lookup.
866-
}
867-
868-
if ( empty( $affected_post_ids ) ) {
869-
wp_send_json_error( new \WP_Error( '-2', __( 'No dismissal data to return', 'accessibility-checker' ) ) );
870-
}
871-
872-
foreach ( $affected_post_ids as $affected_post_id ) {
873-
if ( ! current_user_can( 'edit_post', (int) $affected_post_id ) ) {
874-
wp_send_json_error( new \WP_Error( '-5', __( 'Permission Denied', 'accessibility-checker' ) ) );
875-
}
876-
}
877-
878-
$ignre = ( 'enable' === $action ) ? 1 : 0;
879-
$ignre_user = ( 'enable' === $action ) ? get_current_user_id() : null;
880-
$ignre_user_info = ( 'enable' === $action ) ? get_userdata( $ignre_user ) : '';
881-
$ignre_username = ( 'enable' === $action ) ? $ignre_user_info->user_login : '';
882-
$ignre_date = ( 'enable' === $action ) ? edac_get_current_utc_datetime() : null;
883-
$ignre_date_formatted = ( 'enable' === $action ) ? edac_format_datetime_from_utc( $ignre_date ) : '';
884-
$ignre_comment = ( 'enable' === $action && isset( $_REQUEST['comment'] ) ) ? sanitize_textarea_field( wp_unslash( $_REQUEST['comment'] ) ) : null;
885-
$ignre_reason = ( 'enable' === $action && isset( $_REQUEST['reason'] ) ) ? sanitize_text_field( wp_unslash( $_REQUEST['reason'] ) ) : null;
886-
$ignore_global = ( 'enable' === $action && isset( $_REQUEST['ignore_global'] ) ) ? sanitize_textarea_field( wp_unslash( $_REQUEST['ignore_global'] ) ) : 0;
887-
888-
// If largeBatch is set and 'true', we need to perform an update using the 'object'
889-
// instead of IDs. It is a much less efficient query than by IDs - but many IDs run
890-
// into request size limits which caused this to not function at all.
891-
if ( isset( $_REQUEST['largeBatch'] ) && 'true' === $_REQUEST['largeBatch'] ) {
892-
// $batch_object was already resolved during the capability check above.
893-
$object = $batch_object;
894-
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Safe variable used for table name, caching not required for one time operation.
895-
$wpdb->query( $wpdb->prepare( 'UPDATE %i SET ignre = %d, ignre_user = %d, ignre_date = %s, ignre_comment = %s, ignre_reason = %s, ignre_global = %d WHERE siteid = %d and object = %s', $table_name, $ignre, $ignre_user, $ignre_date, $ignre_comment, $ignre_reason, $ignore_global, $siteid, $object ) );
896-
} else {
897-
// For small batches of IDs, we can just loop through.
898-
foreach ( $ids as $id ) {
899-
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Safe variable used for table name, caching not required for one time operation.
900-
$wpdb->query( $wpdb->prepare( 'UPDATE %i SET ignre = %d, ignre_user = %d, ignre_date = %s, ignre_comment = %s, ignre_reason = %s, ignre_global = %d WHERE siteid = %d and id = %d', $table_name, $ignre, $ignre_user, $ignre_date, $ignre_comment, $ignre_reason, $ignore_global, $siteid, $id ) );
901-
}
902-
}
903-
904-
$data = [
905-
'ids' => $ids,
906-
'action' => $action,
907-
'type' => $type,
908-
'user' => $ignre_username,
909-
'date' => $ignre_date_formatted,
910-
];
911-
912-
if ( ! $data ) {
913-
wp_send_json_error( new \WP_Error( '-2', __( 'No dismissal data to return', 'accessibility-checker' ) ) );
914-
}
915-
wp_send_json_success( wp_json_encode( $data ) );
916-
}
917-
918806
/**
919807
* Handle AJAX request to dismiss Welcome CTA
920808
*

0 commit comments

Comments
 (0)