diff --git a/includes/class-wc-comments.php b/includes/class-wc-comments.php index bc5b721589b..54f0d7f0f51 100644 --- a/includes/class-wc-comments.php +++ b/includes/class-wc-comments.php @@ -1,19 +1,17 @@ 5 || $_POST['rating'] < 0 ) { + if ( isset( $_POST['rating'], $_POST['comment_post_ID'] ) && 'product' === get_post_type( absint( $_POST['comment_post_ID'] ) ) ) { // WPCS: input var ok, CSRF ok. + if ( ! $_POST['rating'] || $_POST['rating'] > 5 || $_POST['rating'] < 0 ) { // WPCS: input var ok, CSRF ok, sanitization ok. return; } - add_comment_meta( $comment_id, 'rating', (int) esc_attr( $_POST['rating'] ), true ); + add_comment_meta( $comment_id, 'rating', intval( $_POST['rating'] ), true ); // WPCS: input var ok, CSRF ok. - $post_id = isset( $_POST['comment_post_ID'] ) ? (int) $_POST['comment_post_ID'] : 0; + $post_id = isset( $_POST['comment_post_ID'] ) ? absint( $_POST['comment_post_ID'] ) : 0; // WPCS: input var ok, CSRF ok. if ( $post_id ) { self::clear_transients( $post_id ); } @@ -163,8 +171,9 @@ class WC_Comments { /** * Modify recipient of review email. - * @param array $emails - * @param int $comment_id + * + * @param array $emails Emails. + * @param int $comment_id Comment ID. * @return array */ public static function comment_moderation_recipients( $emails, $comment_id ) { @@ -179,7 +188,8 @@ class WC_Comments { /** * Ensure product average rating and review count is kept up to date. - * @param int $post_id + * + * @param int $post_id Post ID. */ public static function clear_transients( $post_id ) { @@ -196,8 +206,6 @@ class WC_Comments { * new comment or the status of a comment changes. Cache * will be regenerated next time WC_Comments::wp_count_comments() * is called. - * - * @return void */ public static function delete_comments_count_cache() { delete_transient( 'wc_count_comments' ); @@ -223,12 +231,14 @@ class WC_Comments { 'all' => 0, ); - $count = $wpdb->get_results( " + $count = $wpdb->get_results( + " SELECT comment_approved, COUNT(*) AS num_comments FROM {$wpdb->comments} WHERE comment_type NOT IN ('order_note', 'webhook_delivery') GROUP BY comment_approved - ", ARRAY_A ); + ", ARRAY_A + ); $approved = array( '0' => 'moderated', @@ -267,8 +277,9 @@ class WC_Comments { /** * Make sure WP displays avatars for comments with the `review` type. + * * @since 2.3 - * @param array $comment_types + * @param array $comment_types Comment types. * @return array */ public static function add_avatar_for_review_comment_type( $comment_types ) { @@ -277,7 +288,8 @@ class WC_Comments { /** * Determine if a review is from a verified owner at submission. - * @param int $comment_id + * + * @param int $comment_id Comment ID. * @return bool */ public static function add_comment_purchase_verification( $comment_id ) { @@ -294,7 +306,7 @@ class WC_Comments { * Get product rating for a product. Please note this is not cached. * * @since 3.0.0 - * @param WC_Product $product + * @param WC_Product $product Product instance. * @return float */ public static function get_average_rating_for_product( &$product ) { @@ -303,14 +315,18 @@ class WC_Comments { $count = $product->get_rating_count(); if ( $count ) { - $ratings = $wpdb->get_var( $wpdb->prepare(" + $ratings = $wpdb->get_var( + $wpdb->prepare( + " SELECT SUM(meta_value) FROM $wpdb->commentmeta LEFT JOIN $wpdb->comments ON $wpdb->commentmeta.comment_id = $wpdb->comments.comment_ID WHERE meta_key = 'rating' AND comment_post_ID = %d AND comment_approved = '1' AND meta_value > 0 - ", $product->get_id() ) ); + ", $product->get_id() + ) + ); $average = number_format( $ratings / $count, 2, '.', '' ); } else { $average = 0; @@ -328,18 +344,22 @@ class WC_Comments { * Get product review count for a product (not replies). Please note this is not cached. * * @since 3.0.0 - * @param WC_Product $product + * @param WC_Product $product Product instance. * @return int */ public static function get_review_count_for_product( &$product ) { global $wpdb; - $count = $wpdb->get_var( $wpdb->prepare(" + $count = $wpdb->get_var( + $wpdb->prepare( + " SELECT COUNT(*) FROM $wpdb->comments WHERE comment_parent = 0 AND comment_post_ID = %d AND comment_approved = '1' - ", $product->get_id() ) ); + ", $product->get_id() + ) + ); $product->set_review_count( $count ); @@ -353,14 +373,16 @@ class WC_Comments { * Get product rating count for a product. Please note this is not cached. * * @since 3.0.0 - * @param WC_Product $product - * @return array of integers + * @param WC_Product $product Product instance. + * @return int[] */ public static function get_rating_counts_for_product( &$product ) { global $wpdb; $counts = array(); - $raw_counts = $wpdb->get_results( $wpdb->prepare( " + $raw_counts = $wpdb->get_results( + $wpdb->prepare( + " SELECT meta_value, COUNT( * ) as meta_value_count FROM $wpdb->commentmeta LEFT JOIN $wpdb->comments ON $wpdb->commentmeta.comment_id = $wpdb->comments.comment_ID WHERE meta_key = 'rating' @@ -368,10 +390,12 @@ class WC_Comments { AND comment_approved = '1' AND meta_value > 0 GROUP BY meta_value - ", $product->get_id() ) ); + ", $product->get_id() + ) + ); foreach ( $raw_counts as $count ) { - $counts[ $count->meta_value ] = absint( $count->meta_value_count ); + $counts[ $count->meta_value ] = absint( $count->meta_value_count ); // WPCS: slow query ok. } $product->set_rating_counts( $counts );