yeswework/fabrica-reusable-block-instances

WordPress 5 plugin which shows you how many times, and where, a Reusable Block has been used.

fabrica-reusable-block-instances's Issues

We should sanitize the block id before using it in sql.

I know it's not a sqli issue, as we're previously verifying that is_numeric( $_GET['block_instances'] ) but just for code sniffing and explicitness, probably would be worth either casting as an (int) or passing through intval() inline here where we're using it:

fabrica-reusable-block-instances/fabrica-reusable-block-instances.php

Line 58 in 3a32abe

$where .= ' AND post_content LIKE \'%<!-- wp:block {"ref":' . $_GET['block_instances'] . '}%\' ';

Probably should add some `esc_url` and `esc_html` calls here for best practices.

In practice it should be safe without, but it's a nice safety blanket in case inputs ever change.

fabrica-reusable-block-instances/fabrica-reusable-block-instances.php

Line 84 in 3a32abe

echo '<a href="' . admin_url('edit.php?post_type=wp_block&block_instances=' . $ID) . '">' . $instances . '</a>';

suggestion: add `post_name` (aka slug) as a column option

I'm likely to be an edge case, but I've been rendering blocks on the fly in my templates, via simple function:

function renderBlockById($id) {
  // get reusable gutenberg block:
  $gblock = get_post($id);
  return apply_filters('the_content', $gblock->post_content);
}

In the interests of more readable code, I'd prefer to be passing the 'slug' of a block into this function, but the only place I can get them is from the database itself. Any chance it could be added as an optional column?

Probably tidier to use `$wpdb->posts` not `{$wpdb->prefix}posts`

fabrica-reusable-block-instances/fabrica-reusable-block-instances.php

Line 80 in 3a32abe

$sql = "SELECT SUM((LENGTH(post_content) - LENGTH(REPLACE(post_content, %s, ''))) DIV LENGTH(%s)) AS instances FROM {$wpdb->prefix}posts WHERE post_content LIKE %s and post_status IN ('publish', 'draft', 'future', 'pending')";