Skip to content

Refactor gallery search query building #2347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
the-hercules merged 5 commits into from
Jul 15, 2026
+27 −18
Merged

Refactor gallery search query building #2347

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a94b17f
Refactor gallery search query building
iamimmanuelraj Jul 13, 2026
26c20bb
fix: improve album ID handling in search query for better SQL prepara…
the-hercules Jul 15, 2026
5195506
fix: enhance search query handling by improving type checks and SQL j…
the-hercules Jul 15, 2026
09c5a8a
fix: improve search query handling by ensuring user IDs and member ty…
the-hercules Jul 15, 2026
b7d7a9f
fix: improve search query handling by clarifying SQL preparation comm…
the-hercules Jul 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 25 additions & 16 deletions app/main/controllers/template/rtmedia-filters.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -747,13 +747,15 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) {

if ( function_exists( 'rtmedia_media_search_enabled' ) && rtmedia_media_search_enabled() ) {

global $wpdb;

$raw_search = wp_unslash( filter_input( INPUT_GET, 'search', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) );

if ( 'string' !== gettype( $raw_search ) ) {
if ( ! is_string( $raw_search ) ) {
$raw_search = '';
}

$search = sanitize_text_field( urldecode( $raw_search ) );
$search = sanitize_text_field( $raw_search );
$search_by = sanitize_text_field( wp_unslash( filter_input( INPUT_GET, 'search_by', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) );
$media_type = sanitize_text_field( wp_unslash( filter_input( INPUT_GET, 'media_type', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) );
$rtmedia_current_album = sanitize_text_field( wp_unslash( filter_input( INPUT_GET, 'rtmedia-current-album', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ) );
Expand All @@ -762,6 +764,9 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) {
$author_id = rtm_select_user( $search );
$member_type = rtm_fetch_user_by_member_type( $search );

$author_id = implode( ',', array_map( 'absint', array_filter( explode( ',', $author_id ) ) ) );
$member_type = implode( ',', array_map( 'absint', array_filter( explode( ',', $member_type ) ) ) );
Comment on lines +767 to +768

if ( ! empty( $rtmedia_current_album ) ) {
$where = '';
}
Expand All @@ -770,17 +775,17 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) {
if ( ! empty( $search_by ) ) {

if ( ! empty( $rtmedia_current_album ) ) {
$where .= " $table_name.album_id = '" . $rtmedia_current_album . "' AND ";
$where .= $wpdb->prepare( " $table_name.album_id = %d AND ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input.
}

if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) {
$where .= " $table_name.media_type = '" . $media_type . "' AND ";
$where .= $wpdb->prepare( " $table_name.media_type = %s AND ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input.
}

if ( 'title' === $search_by ) {
$where .= " $table_name.media_title LIKE '%" . $search . "%' ";
$where .= $wpdb->prepare( " $table_name.media_title LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input.
} elseif ( 'description' === $search_by ) {
$where .= " post_table.post_content LIKE '%" . $search . "%'";
$where .= $wpdb->prepare( " post_table.post_content LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' );
Comment thread
the-hercules marked this conversation as resolved.

} elseif ( 'author' === $search_by ) {
if ( ! empty( $author_id ) ) {
Expand All @@ -796,24 +801,24 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) {
} else {

if ( ! empty( $rtmedia_current_album ) ) {
$where .= " $table_name.album_id = '" . $rtmedia_current_album . "' AND ";
$where .= $wpdb->prepare( " $table_name.album_id = %d AND ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input.
}

if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) {
$where .= " $table_name.media_type = '" . $media_type . "' AND ";
$where .= $wpdb->prepare( " $table_name.media_type = %s AND ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input.
}
$where .= ' ( ';
$where .= " $table_name.media_title LIKE '%" . $search . "%' ";
$where .= $wpdb->prepare( " $table_name.media_title LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input.
if ( ! empty( $author_id ) ) {
$where .= " OR $table_name.media_author IN (" . $author_id . ') ';
}
if ( ! empty( $member_type ) ) {
$where .= " OR $table_name.media_author IN (" . $member_type . ') ';
}
Comment on lines 813 to 817
$where .= " OR post_table.post_content LIKE '%" . $search . "%'";
$where .= $wpdb->prepare( " OR post_table.post_content LIKE %s ", '%' . $wpdb->esc_like( $search ) . '%' );
Comment thread
the-hercules marked this conversation as resolved.
Comment thread
the-hercules marked this conversation as resolved.

if ( empty( $media_type ) ) {
$where .= " OR $table_name.media_type = '" . $search . "' ";
$where .= $wpdb->prepare( " OR $table_name.media_type = %s ", $search ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input.
}

$where .= ' ) ';
Expand All @@ -822,12 +827,12 @@ function rtmedia_search_fillter_where_query( $where, $table_name ) {

// Reset data for album's media.
if ( '' !== $search && ! empty( $rtmedia_current_album ) ) {
$where .= " AND $table_name.album_id = '" . $rtmedia_current_album . "' ";
$where .= $wpdb->prepare( " AND $table_name.album_id = %d ", absint( $rtmedia_current_album ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input.
}

// Reset data for particular media type.
if ( ! empty( $media_type ) && empty( $rtmedia_current_album ) ) {
$where .= " AND $table_name.media_type = '" . $media_type . "' ";
$where .= $wpdb->prepare( " AND $table_name.media_type = %s ", $media_type ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input.
}
} // End if.
} // End if.
Expand Down Expand Up @@ -871,10 +876,14 @@ function rtmedia_search_fillter_join_query( $join, $table_name ) {
$request_uri = rtm_get_server_var( 'REQUEST_URI', 'FILTER_SANITIZE_URL' );
$request_url = explode( '/', $request_uri );
if ( ! empty( $search_by ) && 'attribute' === $search_by && ! in_array( 'attribute', $request_url, true ) ) {
$join .= " INNER JOIN $posts_table ON ( $posts_table.ID = $table_name.media_id AND $posts_table.post_type = '$media_type' )
INNER JOIN $terms_table ON ( $terms_table.slug IN ('" . $search . "') )
$join .= $wpdb->prepare(
" INNER JOIN $posts_table ON ( $posts_table.ID = $table_name.media_id AND $posts_table.post_type = %s )
INNER JOIN $terms_table ON ( $terms_table.slug = %s )
INNER JOIN $term_taxonomy_table ON ( $term_taxonomy_table.term_id = $terms_table.term_id )
INNER JOIN $term_relationships_table ON ( $term_relationships_table.term_taxonomy_id = $term_taxonomy_table.term_taxonomy_id AND $term_relationships_table.object_id = $posts_table.ID ) ";
INNER JOIN $term_relationships_table ON ( $term_relationships_table.term_taxonomy_id = $term_taxonomy_table.term_taxonomy_id AND $term_relationships_table.object_id = $posts_table.ID ) ",
$media_type,
$search
); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- Interpolated values are trusted internal table/column identifiers, not user input.
}
}
}
Expand Down
4 changes: 2 additions & 2 deletions app/main/controllers/template/rtmedia-functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4324,7 +4324,7 @@ function rtm_select_user( $user ) {
}
}

$user_id = implode( ',', $user_ids );
$user_id = implode( ',', array_map( 'absint', $user_ids ) );
return $user_id;
}

Expand Down Expand Up @@ -4357,7 +4357,7 @@ function rtm_fetch_user_by_member_type( $type ) {
array_push( $member_id, bp_get_member_user_id() );
}
}
$member_id = implode( ',', $member_id );
$member_id = implode( ',', array_map( 'absint', $member_id ) );
}

return $member_id;
Expand Down
Loading