@@ -356,7 +356,7 @@ protected function get_keyword_filter( $keyword_filter ) {
356356 *
357357 * @param mixed $filter The filter to check against.
358358 *
359- * @return bool Whether or not the filter is considered valid.
359+ * @return bool Whether the filter is considered valid.
360360 */
361361 protected function is_valid_filter ( $ filter ) {
362362 return ! empty ( $ filter ) && is_string ( $ filter );
@@ -453,37 +453,57 @@ protected function determine_score_filters( $score_filters ) {
453453 /**
454454 * Retrieves the post type from the $_GET variable.
455455 *
456- * @return string The current post type.
456+ * @return string|null The sanitized current post type or null when the variable is not set in $_GET .
457457 */
458458 public function get_current_post_type () {
459- return filter_input ( INPUT_GET , 'post_type ' );
459+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
460+ if ( isset ( $ _GET ['post_type ' ] ) && is_string ( $ _GET ['post_type ' ] ) ) {
461+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
462+ return sanitize_text_field ( wp_unslash ( $ _GET ['post_type ' ] ) );
463+ }
464+ return null ;
460465 }
461466
462467 /**
463468 * Retrieves the SEO filter from the $_GET variable.
464469 *
465- * @return string The current post type .
470+ * @return string|null The sanitized seo filter or null when the variable is not set in $_GET .
466471 */
467472 public function get_current_seo_filter () {
468- return filter_input ( INPUT_GET , 'seo_filter ' );
473+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
474+ if ( isset ( $ _GET ['seo_filter ' ] ) && is_string ( $ _GET ['seo_filter ' ] ) ) {
475+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
476+ return sanitize_text_field ( wp_unslash ( $ _GET ['seo_filter ' ] ) );
477+ }
478+ return null ;
469479 }
470480
471481 /**
472482 * Retrieves the Readability filter from the $_GET variable.
473483 *
474- * @return string The current post type .
484+ * @return string|null The sanitized readability filter or null when the variable is not set in $_GET .
475485 */
476486 public function get_current_readability_filter () {
477- return filter_input ( INPUT_GET , 'readability_filter ' );
487+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
488+ if ( isset ( $ _GET ['readability_filter ' ] ) && is_string ( $ _GET ['readability_filter ' ] ) ) {
489+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
490+ return sanitize_text_field ( wp_unslash ( $ _GET ['readability_filter ' ] ) );
491+ }
492+ return null ;
478493 }
479494
480495 /**
481496 * Retrieves the keyword filter from the $_GET variable.
482497 *
483- * @return string The current post type .
498+ * @return string|null The sanitized seo keyword filter or null when the variable is not set in $_GET .
484499 */
485500 public function get_current_keyword_filter () {
486- return filter_input ( INPUT_GET , 'seo_kw_filter ' );
501+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
502+ if ( isset ( $ _GET ['seo_kw_filter ' ] ) && is_string ( $ _GET ['seo_kw_filter ' ] ) ) {
503+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
504+ return sanitize_text_field ( wp_unslash ( $ _GET ['seo_kw_filter ' ] ) );
505+ }
506+ return null ;
487507 }
488508
489509 /**
@@ -720,7 +740,7 @@ private function set_post_type_hooks() {
720740 * @return bool Whether or not the meta box (and associated columns etc) should be hidden.
721741 */
722742 private function display_metabox ( $ post_type = null ) {
723- $ current_post_type = sanitize_text_field ( $ this ->get_current_post_type () );
743+ $ current_post_type = $ this ->get_current_post_type ();
724744
725745 if ( ! isset ( $ post_type ) && ! empty ( $ current_post_type ) ) {
726746 $ post_type = $ current_post_type ;
0 commit comments