← All changes | back/Controllers/Users/Import.php +34 -13 10.0.1 → 11.1.0 View file →

		@@ -10,14 +10,15 @@
10	10	use AcyMailing\Helpers\TabHelper;
11	11
12	12	trait Import
13	13	{
14		- public function import()
	14	+ public function import(): void
15	15	{
16	16	acym_setVar('layout', 'import');
17	17
18	18	$userClass = new UserClass();
19	19
	20	+ // Get tables from database
20	21	$tables = acym_getTables();
21	22	$arrayTables = [];
22	23	foreach ($tables as $tableName) {
23	24	$arrayTables[$tableName] = $tableName;
		@@ -23,12 +24,21 @@
23	24	$arrayTables[$tableName] = $tableName;
24	25	}
25	26
26	27	global $acymCmsUserVars;
	28	+
	29	+ $nbUsersCMS = acym_loadResult('SELECT count('.$acymCmsUserVars->id.') FROM '.$acymCmsUserVars->table);
	30	+ if ('wordpress' === ACYM_CMS && is_multisite()) {
	31	+ $nbUsersCMS = acym_loadResult(
	32	+ 'SELECT count('.$acymCmsUserVars->id.')
	33	+ FROM '.$acymCmsUserVars->table.' AS user JOIN #__usermeta AS `meta` ON `user`.'.$acymCmsUserVars->id.'=`meta`.`user_id`
	34	+ WHERE `meta`.`meta_key`=\'#__capabilities\''
	35	+ );
	36	+ }
27	37	$data = [
28	38	'tab' => new TabHelper(),
29	39	'nbUsersAcymailing' => $userClass->getCountTotalUsers(),
30		- 'nbUsersCMS' => acym_loadResult('SELECT count('.$acymCmsUserVars->id.') FROM '.$acymCmsUserVars->table),
	40	+ 'nbUsersCMS' => $nbUsersCMS,
31	41	'tables' => $arrayTables,
32	42	'entitySelect' => new EntitySelectHelper(),
33	43	'importHelper' => new ImportHelper(),
34	44	];
		@@ -43,9 +53,9 @@
43	53
44	54	parent::display($data);
45	55	}
46	56
47		- private function prepareMailPoetList(&$data)
	57	+ private function prepareMailPoetList(array &$data): void
48	58	{
49	59	$mailpoetClass = new MailpoetClass();
50	60	$data['mailpoet_list'] = $mailpoetClass->getAllLists();
51	61	}
		@@ -50,14 +60,20 @@
50	60	$data['mailpoet_list'] = $mailpoetClass->getAllLists();
51	61	}
52	62
53	63
54		- public function doImport()
	64	+ public function doImport(): void
55	65	{
56		- acym_checkToken();
	66	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
57	67
58	68	$function = acym_getVar('cmd', 'import_from');
59		- $allowedImportModes = acym_isAdmin() ? ['file', 'textarea', 'cms', 'database', 'mailpoet', 'contact'] : ['file', 'textarea'];
	69	+ $allowedImportModes = acym_isAdmin() ? ['file', 'textarea', 'cms', 'mailpoet', 'contact'] : ['file', 'textarea'];
	70	+
	71	+ // The table name comes from the request, this mode can read any data of the site
	72	+ if (acym_hasAdminPermissions()) {
	73	+ $allowedImportModes[] = 'database';
	74	+ }
	75	+
60	76	if (!in_array($function, $allowedImportModes)) {
61	77	die('Access denied for this import method');
62	78	}
63	79
		@@ -87,9 +103,9 @@
87	103	$this->listing();
88	104	}
89	105	}
90	106
91		- public function ajaxEncoding()
	107	+ public function ajaxEncoding(): void
92	108	{
93	109	acym_setVar('layout', 'ajaxencoding');
94	110
95	111	$data = [];
		@@ -103,10 +119,12 @@
103	119
104	120	acym_sendAjaxResponse('', $data);
105	121	}
106	122
107		- public function finalizeImport()
	123	+ public function finalizeImport(): void
108	124	{
	125	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
	126	+
109	127	$importHelper = new ImportHelper();
110	128	$importHelper->finalizeImport();
111	129
112	130	$this->listing();
		@@ -111,9 +129,9 @@
111	129
112	130	$this->listing();
113	131	}
114	132
115		- public function downloadImport()
	133	+ public function downloadImport(): void
116	134	{
117	135	$filename = acym_getVar('cmd', 'filename');
118	136	if (!file_exists(ACYM_MEDIA.'import'.DS.$filename.'.csv')) {
119	137	return;
		@@ -119,24 +137,27 @@
119	137	return;
120	138	}
121	139	$exportHelper = new ExportHelper();
122	140	$exportHelper->setDownloadHeaders($filename);
	141	+
	142	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Downloading a file.
123	143	echo file_get_contents(ACYM_MEDIA.'import'.DS.$filename.'.csv');
124	144	exit;
125	145	}
126	146
127		- public function getColumnsFromTable()
	147	+ public function getColumnsFromTable(): void
128	148	{
129	149	$tableName = acym_secureDBColumn(acym_getVar('string', 'tablename', ''));
130	150	if (empty($tableName)) {
131	151	exit;
132	152	}
	153	+
	154	+ echo '<option value=""></option>';
	155	+
133	156	$columns = acym_getColumns($tableName, false, false);
134		- $allColumnsSelect = '<option value=""></option>';
135	157	foreach ($columns as $oneColumn) {
136		- $allColumnsSelect .= '<option value="'.acym_escape($oneColumn).'">'.$oneColumn.'</option>';
	158	+ echo '<option value="'.esc_attr($oneColumn).'">'.esc_html($oneColumn).'</option>';
137	159	}
138	160
139		- echo $allColumnsSelect;
140	161	exit;
141	162	}
142	163	}