← All changes | back/Controllers/Users/Import.php +27 -6 10.2.2 → 11.1.0 View file →

		@@ -16,8 +16,9 @@
16	16	acym_setVar('layout', 'import');
17	17
18	18	$userClass = new UserClass();
19	19
	20	+ // Get tables from database
20	21	$tables = acym_getTables();
21	22	$arrayTables = [];
22	23	foreach ($tables as $tableName) {
23	24	$arrayTables[$tableName] = $tableName;
		@@ -23,12 +24,21 @@
23	24	$arrayTables[$tableName] = $tableName;
24	25	}
25	26
26	27	global $acymCmsUserVars;
	28	+
	29	+ $nbUsersCMS = acym_loadResult('SELECT count('.$acymCmsUserVars->id.') FROM '.$acymCmsUserVars->table);
	30	+ if ('wordpress' === ACYM_CMS && is_multisite()) {
	31	+ $nbUsersCMS = acym_loadResult(
	32	+ 'SELECT count('.$acymCmsUserVars->id.')
	33	+ FROM '.$acymCmsUserVars->table.' AS user JOIN #__usermeta AS `meta` ON `user`.'.$acymCmsUserVars->id.'=`meta`.`user_id`
	34	+ WHERE `meta`.`meta_key`=\'#__capabilities\''
	35	+ );
	36	+ }
27	37	$data = [
28	38	'tab' => new TabHelper(),
29	39	'nbUsersAcymailing' => $userClass->getCountTotalUsers(),
30		- 'nbUsersCMS' => acym_loadResult('SELECT count('.$acymCmsUserVars->id.') FROM '.$acymCmsUserVars->table),
	40	+ 'nbUsersCMS' => $nbUsersCMS,
31	41	'tables' => $arrayTables,
32	42	'entitySelect' => new EntitySelectHelper(),
33	43	'importHelper' => new ImportHelper(),
34	44	];
		@@ -52,12 +62,18 @@
52	62
53	63
54	64	public function doImport(): void
55	65	{
56		- acym_checkToken();
	66	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
57	67
58	68	$function = acym_getVar('cmd', 'import_from');
59		- $allowedImportModes = acym_isAdmin() ? ['file', 'textarea', 'cms', 'database', 'mailpoet', 'contact'] : ['file', 'textarea'];
	69	+ $allowedImportModes = acym_isAdmin() ? ['file', 'textarea', 'cms', 'mailpoet', 'contact'] : ['file', 'textarea'];
	70	+
	71	+ // The table name comes from the request, this mode can read any data of the site
	72	+ if (acym_hasAdminPermissions()) {
	73	+ $allowedImportModes[] = 'database';
	74	+ }
	75	+
60	76	if (!in_array($function, $allowedImportModes)) {
61	77	die('Access denied for this import method');
62	78	}
63	79
		@@ -105,8 +121,10 @@
105	121	}
106	122
107	123	public function finalizeImport(): void
108	124	{
	125	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
	126	+
109	127	$importHelper = new ImportHelper();
110	128	$importHelper->finalizeImport();
111	129
112	130	$this->listing();
		@@ -119,8 +137,10 @@
119	137	return;
120	138	}
121	139	$exportHelper = new ExportHelper();
122	140	$exportHelper->setDownloadHeaders($filename);
	141	+
	142	+ // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Downloading a file.
123	143	echo file_get_contents(ACYM_MEDIA.'import'.DS.$filename.'.csv');
124	144	exit;
125	145	}
126	146
		@@ -129,14 +149,15 @@
129	149	$tableName = acym_secureDBColumn(acym_getVar('string', 'tablename', ''));
130	150	if (empty($tableName)) {
131	151	exit;
132	152	}
	153	+
	154	+ echo '<option value=""></option>';
	155	+
133	156	$columns = acym_getColumns($tableName, false, false);
134		- $allColumnsSelect = '<option value=""></option>';
135	157	foreach ($columns as $oneColumn) {
136		- $allColumnsSelect .= '<option value="'.acym_escape($oneColumn).'">'.$oneColumn.'</option>';
	158	+ echo '<option value="'.esc_attr($oneColumn).'">'.esc_html($oneColumn).'</option>';
137	159	}
138	160
139		- echo $allColumnsSelect;
140	161	exit;
141	162	}
142	163	}