MDTF

encode_search_get_params() receives the serialized form over ajax, parses and sanitizes it, removes '~' (any) values, and stores the rest as base64 JSON with set_page_mdf_session(). Depending on the setting keep_search_data_in the data goes to a transient for one day or to $_SESSION. The response is mdf_cat=...&page_mdf=<key>, which the front end turns into the results link.

get_search_data_key() hashes the output of normalize_search_data(), which walks the array recursively, sorts associative keys and keeps list order. Field order from the browser no longer matters, so one search maps to one transient and one link. Links with older keys keep working while their transient lives.

mdf_encode_search_get_params is registered for logged-out visitors, and each distinct search writes a transient that lives for a day. The handler checks that vars is a string within mdf_search_data_max_length and answers mdf_cat=-1 without storing otherwise. A supplied key is accepted only if it matches /^[0-9a-f]{32}$/, otherwise the key is derived from the data.

get_page_mdf_data() treats anything that does not decode to an array as no search. It merges default widget options, and for every medafi_ field casts 'from' and 'to' to numbers, so range and calendar values reach meta_query as numbers whatever the visitor sent. The decoded result is kept in a static variable for the rest of the request.

Constant links are a separate hidden post type. Its save_post() stores the encoded search in page_mdf_string. get_page_mdf_session() checks the key: numeric means a post ID and reads the stored meta, anything else goes to the transient or session store. Results, counters and templates do not need to know which kind of link was used.

In get_meta_query_array() the slider case compares the selected 'to' with the slider's own max; if they are equal, the upper bound becomes MetaDataFilterCore::$max_int, so posts with values above the configured scale still match. Range drop-downs use the same idea with an 'i' (infinity) suffix such as '1001-i'. Single sliders and range drop-downs use BETWEEN with type DECIMAL.

For sliders with slider_range_value = 1 a post stores two values, the field key and key_to (for example a price or size span). The visitor picks one value, and the query requires it to fall inside the post's own span, both sides typed DECIMAL.

The calendar item stores <key>_from and <key>_to. Only 'to' set gives _to <= to; only 'from' gives _from >= from; equal values match items whose span covers that day; a proper span becomes BETWEEN on _from. A code comment dates the last branch to 08-10-2014.

A text item can target its own meta value or post_title, post_content, or both with OR or AND. For the post columns the condition is passed to MDTF_HELPER filters on posts_where, which split the phrase into words (switchable with mdf_txtsearch_some_words_behavior) and join them with mdf_txtsearch_some_words_condition, AND by default. Repeated spaces are collapsed first.

A field marked is_reflected carries reflected_key. The query builder, the OR splitter and the public get_field() API all use the reflected key, so a filter can work on meta written by the theme or another plugin without copying values into medafi_ keys.

wrap_meta_query() builds relation AND and nests the ORable conditions as one relation OR group, only when there are two or more. mdf_hide_post NOT EXISTS, meta_data_filter_cat, _visibility and _stock_status go on the top level and always apply. The same wrapper is used by the results query and by the counters.

The splitter maps each search key (own or reflected) to its item type from the filter sections in the search. Clauses of checkbox and label items become ORable; sliders, drop-downs, text inputs, calendars and range drop-downs stay required. In AND mode the array is returned unchanged, so existing AND searches produce the same SQL as before.

After third-party filters (mdf_filter_taxonomies, additional taxonomies, product_visibility) have modified the tax_query, the splitter compares each clause with the list built from the form using strict array_search. Matches are visitor conditions, the rest is required. Repeated visitor clauses that the filter collected per request are dropped. wrap_tax_query() then nests only the visitor part under OR.

encode_search_get_params() writes meta_data_filter_bool and mdf_tax_bool into mdf_widget_options of the stored search, taking the visitor's choice when the widget allows both. get_meta_data_filter_bool() and get_mdf_tax_bool() read the stored value first and normalize anything that is not 'OR' to 'AND'. Results, counters, ajax recount, pagination and sorting read the same state.

Widgets saved by older versions have always searched taxonomies with AND, whatever their OR option said. Applying the option to them would change results on live sites without any action by the owner. get_widget_tax_bool() honors the option only when taxonomies_options_behaviour_ver is set, which happens when the widget is saved by the new version.

tax_query includes children by default, so a checked parent would match every post under it and make the child selection meaningless. get_tax_query_array() removes a checked term if get_term_children() of it intersects the checked set, then reindexes the list.

get_item_posts_count() starts from the current search. A checkbox adds key = 1 if it is not already there. A drop-down option first removes the clause of the same key, because sibling options exclude each other, then adds itself (as BETWEEN for range options). For terms, get_tax_count() injects the term into a copy of the taxonomy state with the per-request tax cache switched off and restores it after.

Counter queries ask only for IDs with update_post_meta_cache, update_post_term_cache and cache_results off. WP_QueryMDFCounterIn extends WP_Query and overrides set_found_posts() to do nothing, so WordPress does not run the extra found-rows step; post_count is the answer.

WP_QueryMDFCounter hashes the full argument array and looks it up in a two-column table with an index on mkey; on a miss it runs the query and inserts the count. The settings page creates the table and switches the option off with the CREATE statement shown if the database user lacks the privilege. An admin clears the cache from the settings page, which runs a TRUNCATE behind manage_options and a nonce.

get_terms() loads all terms of the taxonomy once and assemble_terms_childs() builds the child lists from that array. With cache_terms_data on, the result is stored under mdf_terms_cache_<md5 of arguments> as a transient whose lifetime comes from the terms cache period setting (hourly to 7 days; no expiry when no period is set).

is_should_init() runs before the plugin registers its post types and hooks. If init_on_pages_only is set, it normalizes the current URL (query string and /page/N removed) and returns early when the URL is not in the list. Admin requests always initialize.

save_post() writes page_meta_data_filter as a single array, which the edit screen reads back, and then writes each medafi_ field with update_post_meta(), which meta_query can use. Filter sections and their items are stored as html_items meta of the hidden meta_data_filter post type.

Fields of the old filter category would otherwise stay in wp_postmeta and match searches of that category. save_post() compares the posted category with the stored one and removes all medafi_% rows for the post when it changed.

change_meta_key() requires the medafi_ prefix, rejects a key already used in this or any other filter section and names the conflicting section. Then it renames the key inside html_items, rewrites the page_meta_data_filter arrays of affected posts, and runs UPDATE postmeta SET meta_key. It needs a nonce, edit_post and edit_others_posts because it touches all posts.

parse_query() marks the main query as a search of the requested post type. pre_get_posts() renders [meta_data_filter_results] without a template; that view declares global $wp_query and assigns a new WP_Query built from the search. A request flag prevents re-entry, because the new query fires pre_get_posts again. The mdtf_prohibited_post_types filter keeps ACF and Contact Form 7 internal queries out.

Results, item counters and term counters all branch on WOOCOMMERCE_VERSION: from 3.0 they add a tax_query excluding exclude-from-catalog, earlier versions get a _visibility IN (catalog, visible) meta clause. An optional _stock_status clause hides out-of-stock products. With WPML active, every query also gets the current language.

Drop-down options saved by older versions of the constructor have an empty key, while the post meta box stores the option title as the value. Instead of a migration, fill_select_keys() runs inside get_html_items() and on save, filling empty keys with the trimmed title and leaving explicit keys, including '0', untouched. Existing post values match without re-saving posts.

A Legacy Widget inside a block has no sidebar where the recount could find it by ID, so its form carries the widget class and options. get_widget_redraw_data() signs them with wp_hash(); get_widget_from_redraw_data() verifies with hash_equals() and accepts only MetaDataFilter_Search and MetaDataFilter_TaxSearch before calling the_widget().

sanitize_template_path() normalizes slashes, filters every segment to a safe character set and drops empty ones, so a value cannot leave the templates folder while sub folders such as any/my_posts keep working.

save_post() removes every key without the medafi_ prefix from the posted array before storing it and checks the prefix again before each update_post_meta() call, so the form cannot set _edit_lock, _price or similar keys. Saving values requires current_user_can('edit_post').

Cache clearing requires manage_options and mdtf_ajax_nonce. Key rename requires its own nonce, edit_post and edit_others_posts. Widget field actions require edit_theme_options. Logged-out visitors reach only front-end search actions (term children, search encoding, recount, search panel, search button content). The other handlers registered for them check access themselves: the messenger subscribe actions require login and a nonce, the statistics helper requires manage_options.