| @@ -196,24 +196,20 @@ | ||
| 196 | 196 | wp_set_object_terms($new_post_id, $post_terms, $taxonomy, false); |
| 197 | 197 | } |
| 198 | 198 | |
| 199 | 199 | /* |
| 200 | - * duplicate all post meta just in two SQL queries | |
| 200 | + * duplicate all post meta | |
| 201 | + * get_post_meta() without a key returns raw (still serialized) values, | |
| 202 | + * so rows are copied byte-for-byte via parameterized $wpdb->insert(). | |
| 201 | 203 | */ |
| 202 | - // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- direct query required for copying all post meta rows; not cached intentionally. | |
| 203 | - $post_meta_infos = $wpdb->get_results($wpdb->prepare("SELECT meta_key, meta_value FROM $wpdb->postmeta WHERE post_id=%d", $post_id)); | |
| 204 | - if (count($post_meta_infos) != 0) { | |
| 205 | - $sql_query = "INSERT INTO $wpdb->postmeta (post_id, meta_key, meta_value) "; | |
| 206 | - foreach ($post_meta_infos as $meta_info) { | |
| 207 | - $meta_key = $meta_info->meta_key; | |
| 208 | - | |
| 204 | + $new_post_id = absint($new_post_id); | |
| 205 | + $post_metas = $new_post_id ? get_post_meta($post_id) : []; | |
| 206 | + if (!empty($post_metas) && is_array($post_metas)) { | |
| 207 | + foreach ($post_metas as $meta_key => $meta_values) { | |
| 209 | 208 | // Do not copy these values |
| 210 | - if ($meta_key == '_wp_old_slug') { | |
| 209 | + if (in_array($meta_key, ['_wp_old_slug', '_elementor_css'], true)) { | |
| 211 | 210 | continue; |
| 212 | 211 | } |
| 213 | - if ($meta_key == '_elementor_css') { | |
| 214 | - continue; | |
| 215 | - } | |
| 216 | 212 | |
| 217 | 213 | // Delete already added meta data triggered by wp_insert_post hook |
| 218 | 214 | if ($meta_key == '_elementor_template_type') { |
| 219 | 215 | delete_post_meta($new_post_id, '_elementor_template_type'); |
| @@ -218,14 +214,22 @@ | ||
| 218 | 214 | if ($meta_key == '_elementor_template_type') { |
| 219 | 215 | delete_post_meta($new_post_id, '_elementor_template_type'); |
| 220 | 216 | } |
| 221 | 217 | |
| 222 | - $meta_value = $meta_info->meta_value; | |
| 223 | - $sql_query_sel[] = $wpdb->prepare('SELECT %d, %s, %s', $new_post_id, $meta_key, $meta_value); | |
| 218 | + foreach ((array) $meta_values as $meta_value) { | |
| 219 | + // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- raw copy keeps serialized values intact; $wpdb->insert() is parameterized. | |
| 220 | + $wpdb->insert( | |
| 221 | + $wpdb->postmeta, | |
| 222 | + [ | |
| 223 | + 'post_id' => $new_post_id, | |
| 224 | + 'meta_key' => $meta_key, // phpcs:ignore WordPress.DB.SlowDBQuery.slow_query_meta_key | |
| 225 | + 'meta_value' => $meta_value, // phpcs:ignore WordPress.DB.SlowDBQuery.slow_query_meta_value | |
| 226 | + ], | |
| 227 | + ['%d', '%s', '%s'] | |
| 228 | + ); | |
| 229 | + } | |
| 224 | 230 | } |
| 225 | - $sql_query .= implode(' UNION ALL ', $sql_query_sel); | |
| 226 | - // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter -- $sql_query is built from $wpdb->prepare() fragments above; direct query required for bulk meta insert, not cached intentionally. | |
| 227 | - $wpdb->query($sql_query); | |
| 231 | + wp_cache_delete($new_post_id, 'post_meta'); | |
| 228 | 232 | } |
| 229 | 233 | |
| 230 | 234 | /* |
| 231 | 235 | * finally, redirect to the edit post screen for the new draft |
