← All changes | back/Controllers/Users/Import.php +17 -5 10.11.1 → 11.1.0 View file →

		@@ -16,8 +16,9 @@
16	16	acym_setVar('layout', 'import');
17	17
18	18	$userClass = new UserClass();
19	19
	20	+ // Get tables from database
20	21	$tables = acym_getTables();
21	22	$arrayTables = [];
22	23	foreach ($tables as $tableName) {
23	24	$arrayTables[$tableName] = $tableName;
		@@ -61,12 +62,18 @@
61	62
62	63
63	64	public function doImport(): void
64	65	{
65		- acym_checkToken();
	66	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
66	67
67	68	$function = acym_getVar('cmd', 'import_from');
68		- $allowedImportModes = acym_isAdmin() ? ['file', 'textarea', 'cms', 'database', 'mailpoet', 'contact'] : ['file', 'textarea'];
	69	+ $allowedImportModes = acym_isAdmin() ? ['file', 'textarea', 'cms', 'mailpoet', 'contact'] : ['file', 'textarea'];
	70	+
	71	+ // The table name comes from the request, this mode can read any data of the site
	72	+ if (acym_hasAdminPermissions()) {
	73	+ $allowedImportModes[] = 'database';
	74	+ }
	75	+
69	76	if (!in_array($function, $allowedImportModes)) {
70	77	die('Access denied for this import method');
71	78	}
72	79
		@@ -114,8 +121,10 @@
114	121	}
115	122
116	123	public function finalizeImport(): void
117	124	{
	125	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
	126	+
118	127	$importHelper = new ImportHelper();
119	128	$importHelper->finalizeImport();
120	129
121	130	$this->listing();
		@@ -128,8 +137,10 @@
128	137	return;
129	138	}
130	139	$exportHelper = new ExportHelper();
131	140	$exportHelper->setDownloadHeaders($filename);
	141	+
	142	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Downloading a file.
132	143	echo file_get_contents(ACYM_MEDIA.'import'.DS.$filename.'.csv');
133	144	exit;
134	145	}
135	146
		@@ -138,14 +149,15 @@
138	149	$tableName = acym_secureDBColumn(acym_getVar('string', 'tablename', ''));
139	150	if (empty($tableName)) {
140	151	exit;
141	152	}
	153	+
	154	+ echo '<option value=""></option>';
	155	+
142	156	$columns = acym_getColumns($tableName, false, false);
143		- $allColumnsSelect = '<option value=""></option>';
144	157	foreach ($columns as $oneColumn) {
145		- $allColumnsSelect .= '<option value="'.acym_escape($oneColumn).'">'.$oneColumn.'</option>';
	158	+ echo '<option value="'.esc_attr($oneColumn).'">'.esc_html($oneColumn).'</option>';
146	159	}
147	160
148		- echo $allColumnsSelect;
149	161	exit;
150	162	}
151	163	}