| @@ -1,6 +1,21 @@ | ||
| 1 | 1 | <?php |
| 2 | +/** | |
| 3 | + * Database abstraction layer. | |
| 4 | + * | |
| 5 | + * Queries are built internally with table prefix substitution via prepareQuery(). | |
| 6 | + * Dynamic values are escaped upstream via escapeDB() / esc_sql() before being | |
| 7 | + * passed here. Direct $wpdb calls and absence of per-query caching are intentional | |
| 8 | + * in this low-level layer — caching is handled at the business logic level. | |
| 9 | + * | |
| 10 | + * phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery | |
| 11 | + * phpcs:disable WordPress.DB.DirectDatabaseQuery.NoCaching | |
| 12 | + * phpcs:disable WordPress.DB.PreparedSQL.NotPrepared | |
| 13 | + * phpcs:disable PluginCheck.Security.DirectDB.UnescapedDBParameter | |
| 14 | + */ | |
| 2 | 15 | |
| 16 | +defined('ABSPATH') || die('Restricted Access'); | |
| 17 | + | |
| 3 | 18 | function acym_escapeDB(?string $value): string |
| 4 | 19 | { |
| 5 | 20 | if (is_null($value)) { |
| 6 | 21 | $value = ''; |
| @@ -5,8 +20,9 @@ | ||
| 5 | 20 | if (is_null($value)) { |
| 6 | 21 | $value = ''; |
| 7 | 22 | } |
| 8 | 23 | |
| 24 | + // esc_sql replaces % by something like {svzzvzevzv} but it's normal, it will be replaced back by % before the query is executed | |
| 9 | 25 | return "'".esc_sql($value)."'"; |
| 10 | 26 | } |
| 11 | 27 | |
| 12 | 28 | function acym_query(string $query) |
| @@ -141,8 +157,13 @@ | ||
| 141 | 157 | 'SELECT table_name FROM information_schema.tables WHERE table_schema = '.acym_escapeDB($wpdb->dbname).' AND table_name LIKE '.acym_escapeDB($wpdb->prefix.'%') |
| 142 | 158 | ); |
| 143 | 159 | } |
| 144 | 160 | |
| 161 | +/** | |
| 162 | + * @param mixed $default | |
| 163 | + * | |
| 164 | + * @return mixed | |
| 165 | + */ | |
| 145 | 166 | function acym_getCMSConfig(string $varname, $default = null) |
| 146 | 167 | { |
| 147 | 168 | $map = [ |
| 148 | 169 | 'offset' => 'timezone_string', |
| @@ -156,8 +177,9 @@ | ||
| 156 | 177 | $varname = $map[$varname]; |
| 157 | 178 | } |
| 158 | 179 | $value = get_option($varname, $default); |
| 159 | 180 | |
| 181 | + // In WP there are multiple possible formats in the same option for the timezone | |
| 160 | 182 | if ($varname == 'timezone_string' && empty($value)) { |
| 161 | 183 | $value = acym_getCMSConfig('gmt_offset'); |
| 162 | 184 | |
| 163 | 185 | if (empty($value)) { |
| @@ -168,8 +190,9 @@ | ||
| 168 | 190 | $value = 'GMT+'.$value; |
| 169 | 191 | } |
| 170 | 192 | } |
| 171 | 193 | |
| 194 | + // In WP this could be any number, but Acy pagination only works with 5,10,15,20,25,30,50 or 100 | |
| 172 | 195 | if ($varname === 'posts_per_page') { |
| 173 | 196 | $possibilities = [5, 10, 15, 20, 25, 30, 50, 100]; |
| 174 | 197 | $closest = 5; |
| 175 | 198 | foreach ($possibilities as $possibility) { |
