Improved filtring GET parameters #100

CastosHQ · Jun 16, 2023 · d571f20 · d571f20
1 parent 2bd5509
commit d571f20
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 10 deletions.
diff --git a/php/classes/class-all-episode-stats.php b/php/classes/class-all-episode-stats.php
@@ -105,8 +105,8 @@ private function get_requested_order() {
 	 * @return array
 	 */
 	private function get_all_episode_stats() {
-		$order_by           = isset( $_GET['orderby'] ) ? sanitize_text_field( $_GET['orderby'] ) : 'date';
-		$order              = isset( $_GET['order'] ) ? sanitize_text_field( $_GET['order'] ) : 'desc';
+		$order_by           = isset( $_GET['orderby'] ) ? esc_attr( $_GET['orderby'] ) : 'date';
+		$order              = $this->get_requested_order() ?: 'desc';
 		$all_episodes_stats = $this->get_sorted_stats( $order_by, $order );
 
 		$this->total_posts    = count( $all_episodes_stats );
@@ -241,8 +241,8 @@ private function fetch_all_episodes_stats(){
 	 */
 	private function get_all_episodes_sort_order() {
 
-		$order_by = isset( $_GET['orderby'] ) ? sanitize_text_field( $_GET['orderby'] ) : 'episode_name';
-		$order    = isset( $_GET['order'] ) ? sanitize_text_field( $_GET['order'] ) : 'desc';
+		$order_by = isset( $_GET['orderby'] ) ? esc_attr( $_GET['orderby'] ) : 'episode_name';
+		$order    = $this->get_requested_order() ?: 'desc';
 
 		$publish_order_url  = admin_url( 'edit.php?post_type=' . SSP_CPT_PODCAST . '&page=podcast_stats&orderby=date&order=desc#last-three-months-container' );
 		$name_order_url     = admin_url( 'edit.php?post_type=' . SSP_CPT_PODCAST . '&page=podcast_stats&orderby=episode_name&order=desc#last-three-months-container' );
@@ -253,7 +253,7 @@ private function get_all_episodes_sort_order() {
 			'episode_name' => array( 'sortable desc', $name_order_url ),
 			'listens'      => array( 'sortable desc', $lifetime_order_url ),
 		);
-		foreach ( $this->dates as $date_key => $date ) {
+		foreach ( $this->dates as $date ) {
 			$date_order_url   = admin_url( 'edit.php?post_type=' . SSP_CPT_PODCAST . '&page=podcast_stats&orderby=' . $date . '&order=desc#last-three-months-container' );
 			$sorting[ $date ] = array( 'sortable desc', $date_order_url );
 		}

diff --git a/php/classes/class-ssp-stats.php b/php/classes/class-ssp-stats.php
@@ -264,9 +264,10 @@ public function set_filters() {
 			$this->episode = is_numeric( $episode ) ? intval( $episode ) : 'all';
 		}
 
-		// Set filter selection for charts
+		// Set filter selection for charts. Can be either series or episode.
 		if ( isset( $_GET['filter'] ) ) {
-			$this->filter = sanitize_text_field( $_GET['filter'] );
+			$allowed_filters = array( 'series', 'episode' );
+			$this->filter    = in_array( $_GET['filter'], $allowed_filters ) ? $_GET['filter'] : 'series';
 		}
 	}
 
@@ -323,9 +324,9 @@ public function get_episode_stats ( $episode_id = 0, $fields = '*' ) {
 			$fields = implode( ', ', $fields );
 		}
 
-		$results = $wpdb->get_results( $wpdb->prepare( 'SELECT ' . $fields . ' FROM ' . $this->_table.' WHERE post_id = %d', $episode_id ) );
-
-		return $results;
+		return $wpdb->get_results(
+			$wpdb->prepare( 'SELECT ' . $fields . ' FROM ' . $this->_table . ' WHERE post_id = %d', $episode_id )
+		);
 	}
 
 	/**