Description of the Change

This PR changes the way authenticated requests for autosuggest are fired. These requests are used so the Elasticsearch hosting provider (EP.io, for example) knows which parameters are allowed in a query sent via JS, preventing anonymous users to send a query asking for shop orders, for example.

In #1890 (EP 3.5.2, in 2020) we introduced an authenticated request sent before the sync is started and when the weighting dashboard is saved. This request has a header EP-Set-Autosuggest=true. Before that, any request sending ep-search-term=search test or ep-search-term=ep_autosuggest_placeholder would set those values. To avoid sending a request per page load, EP cached the request sent.

The way we were caching it depended on the presence or absence of an external object cache: if present, we would cache a request per different query, if absent, we would just cache one query. Although that was made to allow for different autosuggest queries, it really doesn't fix the problem, as we can only have one set of allowed parameters.

This PR removes those cached requests, only sending a request to set allowed parameters before a sync or when the weighting dashboard is saved. If people want to run different autosuggest queries with different sets of allowed parameters, they can pass the superset of parameters (including everything) using the ep_autosuggest_query_args filter and checking if $_GET['ep_epio_set_autosuggest'] is set and is not empty.

Closes #2887

How to test the Change

Changelog Entry

Changed - Autosuggest authenticated requests are not cached anymore and are only sent during the sync process or when the weighting dashboard is saved.

Credits

Props @felipeelia @kovshenin

Checklist:

• I agree to follow this project's Code of Conduct.
• I have updated the documentation accordingly.
• I have added tests to cover my change.
• All new and existing tests pass.