← All changes | includes/Admin/CSVExporter.php +31 -89 4.9.2 → 4.2.6 View file →

		@@ -17,9 +17,8 @@
17	17	'end_date' => false,
18	18	'status' => false,
19	19	'offset' => 0,
20	20	'limit' => -1,
21		- // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- exporter accepts user-defined meta filters by design.
22	21	'meta_query' => [], // If specified `meta_key` then will include all post(s) that have this meta_key.
23	22	'query_args' => []
24	23	];
25	24
		@@ -74,11 +73,8 @@
74	73	if ( ! in_array( $this->args['content'], $allowed_post_types ) ) {
75	74	return [];
76	75	}
77	76
78		- // $this->wpdb->posts and $this->wpdb->term_relationships are WP-provided table identifiers.
79		- // Dynamic %d placeholder lists are built to match the corresponding integer arrays.
80		- // phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
81	77	$where = $this->wpdb->prepare(
82	78	"{$this->wpdb->posts}.post_type = %s",
83	79	$this->args['content']
84	80	);
		@@ -92,9 +88,9 @@
92	88	$where .= " AND {$this->wpdb->posts}.post_status != 'auto-draft'";
93	89	}
94	90
95	91	if ( ! empty( $this->args['post__in'] ) ) {
96		- $post_in = array_map( 'intval', $this->args['post__in'] );
	92	+ $post_in = $this->args['post__in'];
97	93	$ids_placeholder = implode( ', ', array_fill( 0, count( $post_in ), '%d' ) );
98	94	$where .= $this->wpdb->prepare(
99	95	" AND {$this->wpdb->posts}.ID IN ($ids_placeholder)",
100	96	$post_in
		@@ -110,9 +106,9 @@
110	106	// Handle doc categories
111	107	foreach ( $this->args['category_terms'] as $term_slug ) {
112	108	$term = get_term_by( 'slug', $term_slug, 'doc_category' );
113	109	if ( $term ) {
114		- $tax_terms[] = (int) $term->term_taxonomy_id;
	110	+ $tax_terms[] = $term->term_taxonomy_id;
115	111	}
116	112	}
117	113
118	114	if ( ! empty( $tax_terms ) ) {
		@@ -124,16 +120,16 @@
124	120	}
125	121	} elseif ( isset( $this->args['kb_terms'] ) ) {
126	122	$join = "INNER JOIN {$this->wpdb->term_relationships} ON ({$this->wpdb->posts}.ID = {$this->wpdb->term_relationships}.object_id)";
127	123	$kb_terms = [];
128		-
	124	+
129	125	foreach ( $this->args['kb_terms'] as $term_slug ) {
130	126	$term = get_term_by( 'slug', $term_slug, 'knowledge_base' );
131	127	if ( $term ) {
132		- $kb_terms[] = (int) $term->term_taxonomy_id;
	128	+ $kb_terms[] = $term->term_taxonomy_id;
133	129	}
134	130	}
135		-
	131	+
136	132	if ( ! empty( $kb_terms ) ) {
137	133	$term_placeholder = implode( ', ', array_fill( 0, count( $kb_terms ), '%d' ) );
138	134	$where .= $this->wpdb->prepare(
139	135	" AND {$this->wpdb->term_relationships}.term_taxonomy_id IN ($term_placeholder)",
		@@ -170,10 +166,9 @@
170	166	$join .= ' ' . $query_clauses['join'];
171	167	$where .= ' ' . $query_clauses['where'];
172	168	}
173	169
174		- // $where and $join are composed from prepared fragments above; identifiers are WP-provided.
175		- // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter
	170	+ // Get post IDs
176	171	$post_ids = $this->wpdb->get_col( "SELECT ID FROM {$this->wpdb->posts} $join WHERE $where" );
177	172
178	173	// Add FAQ post IDs if include_faq is true
179	174	if ( ! empty( $this->args['include_faq'] ) ) {
		@@ -181,18 +176,14 @@
181	176	[
182	177	'post_type' => 'betterdocs_faq',
183	178	'posts_per_page' => -1,
184	179	'fields' => 'ids',
185		- 'post_status' => 'publish',
186		- // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.SuppressFilters_suppress_filters -- intentional: export the raw, untranslated FAQ set so multilingual filters don't drop or swap rows during export.
187		- 'suppress_filters' => true,
	180	+ 'post_status' => 'publish'
188	181	]
189	182	);
190	183	$post_ids = array_merge( $post_ids, $faq_ids );
191	184	}
192	185
193		- $post_ids = WPMLSupport::expand_with_translations( $post_ids );
194		-
195	186	if ( empty( $post_ids ) ) {
196	187	return [
197	188	'success' => false,
198	189	'message' => 'No posts found matching the criteria.'
		@@ -216,12 +207,19 @@
216	207
217	208	// Initialize the combined array with headers
218	209	$csv_data_combined = [ $headers_combined ];
219	210
	211	+ // Combine posts data
	212	+ for ( $i = 1; $i < count( $csv_data_posts ); $i++ ) {
	213	+ $combined_row = array_merge(
	214	+ $csv_data_posts[ $i ],
	215	+ array_fill( 0, count( $headers_combined ) - count( $csv_data_posts[ $i ] ), '' )
	216	+ );
	217	+ $csv_data_combined[] = $combined_row;
	218	+ }
	219	+
	220	+ // Combine author data
220	221	$author_start_index = count( $csv_data_posts[0] );
221		- $terms_start_index = $author_start_index + count( $csv_data_author[0] ) - 1;
222		-
223		- // Author rows
224	222	for ( $i = 1; $i < count( $csv_data_author ); $i++ ) {
225	223	$combined_row = array_merge(
226	224	[ $csv_data_author[ $i ][0] ],
227	225	array_fill( 1, $author_start_index - 1, '' ),
		@@ -229,21 +227,10 @@
229	227	);
230	228	$csv_data_combined[] = $combined_row;
231	229	}
232	230
233		- // Docs post rows
234		- for ( $i = 1; $i < count( $csv_data_posts ); $i++ ) {
235		- if ( $csv_data_posts[ $i ][0] === 'FAQ' ) {
236		- continue;
237		- }
238		- $combined_row = array_merge(
239		- $csv_data_posts[ $i ],
240		- array_fill( 0, count( $headers_combined ) - count( $csv_data_posts[ $i ] ), '' )
241		- );
242		- $csv_data_combined[] = $combined_row;
243		- }
244		-
245		- // Term rows just before FAQ rows so category IDs can be resolved on import
	231	+ // Combine terms data
	232	+ $terms_start_index = $author_start_index + count( $csv_data_author[0] ) - 1;
246	233	for ( $i = 1; $i < count( $csv_data_terms ); $i++ ) {
247	234	$combined_row = array_merge(
248	235	[ $csv_data_terms[ $i ][0] ],
249	236	array_fill( 1, $terms_start_index - 1, '' ),
		@@ -251,21 +238,9 @@
251	238	);
252	239	$csv_data_combined[] = $combined_row;
253	240	}
254	241
255		- // FAQ post rows last
256		- for ( $i = 1; $i < count( $csv_data_posts ); $i++ ) {
257		- if ( $csv_data_posts[ $i ][0] !== 'FAQ' ) {
258		- continue;
259		- }
260		- $combined_row = array_merge(
261		- $csv_data_posts[ $i ],
262		- array_fill( 0, count( $headers_combined ) - count( $csv_data_posts[ $i ] ), '' )
263		- );
264		- $csv_data_combined[] = $combined_row;
265		- }
266		-
267		- $filename = 'betterdocs.' . gmdate( 'Y-m-d' ) . '.csv';
	242	+ $filename = 'betterdocs.' . date( 'Y-m-d' ) . '.csv';
268	243	$csv_content = $this->generate_csv( $csv_data_combined );
269	244
270	245	return [
271	246	'success' => true,
		@@ -449,20 +424,12 @@
449	424	array_push( $glossary_term_ids, $term_object->term_id );
450	425	}
451	426	}
452	427	} else {
453		- // $this->wpdb->term_taxonomy is a WP-core table identifier; %s placeholder binds taxonomy name.
454		- // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter
455		- $glossary_term_ids = $this->wpdb->get_col(
456		- $this->wpdb->prepare(
457		- "SELECT term_id FROM {$this->wpdb->term_taxonomy} WHERE taxonomy = %s",
458		- (string) $this->args['content']
459		- )
460		- );
461		- // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared,WordPress.DB.PreparedSQL.InterpolatedNotPrepared,WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,PluginCheck.Security.DirectDB.UnescapedDBParameter
	428	+ $glossary_term_ids = $this->wpdb->get_col( "SELECT term_id from {$this->wpdb->term_taxonomy} where taxonomy='{$this->args['content']}';" );
462	429	}
463	430
464		- $filename = 'betterdocs.' . gmdate( 'Y-m-d' ) . '.csv';
	431	+ $filename = 'betterdocs.' . date( 'Y-m-d' ) . '.csv';
465	432	$csv_data_combined = $this->get_glossaries_csv_data( $glossary_term_ids );
466	433	$csv_content = $this->generate_csv( $csv_data_combined );
467	434
468	435	return [
		@@ -593,17 +560,14 @@
593	560	'Doc Categories',
594	561	'Doc Tags',
595	562	'Knowledge Bases',
596	563	'Docs attachement url',
597		- 'Docs attachement ID',
598		- 'Docs language code',
599		- 'Docs translation source slug',
	564	+ 'Docs attachement ID'
600	565	];
601	566
602	567	foreach ( $posts as $post ) {
603	568	$attachment_id = get_post_thumbnail_id( $post->ID );
604	569	$attachment_url = get_the_post_thumbnail_url( $post->ID );
605		- $wpml = WPMLSupport::get_post_language_meta( (int) $post->ID );
606	570	// Add CSV row for post
607	571	$csv_data_posts[] = [
608	572	$post->post_type == 'betterdocs_faq' ? 'FAQ' : 'Docs',
609	573	$post->ID,
		@@ -621,15 +585,13 @@
621	585	$post->post_parent,
622	586	$post->menu_order,
623	587	$post->post_mime_type,
624	588	$post->comment_count,
625		- $this->get_term_ids( $post->ID, $post->post_type === 'betterdocs_faq' ? [ 'betterdocs_faq_category', 'betterdocs_product_faq_category' ] : 'doc_category' ),
	589	+ $this->get_term_ids( $post->ID, 'doc_category' ),
626	590	$this->get_term_ids( $post->ID, 'doc_tag' ),
627	591	$this->get_term_ids( $post->ID, 'knowledge_base' ),
628	592	$attachment_url ? $attachment_url : '',
629		- $attachment_id ? $attachment_id : '',
630		- $wpml ? $wpml['language_code'] : '',
631		- $wpml ? $wpml['source_slug'] : '',
	593	+ $attachment_id ? $attachment_id : ''
632	594	];
633	595	}
634	596
635	597	return $csv_data_posts;
		@@ -635,15 +597,13 @@
635	597	return $csv_data_posts;
636	598	}
637	599
638	600	public function get_term_ids( $post_id, $taxonomy ) {
639		- // Accept one or more taxonomies. FAQ posts can live in either the general
640		- // (betterdocs_faq_category) or the Product FAQ (betterdocs_product_faq_category)
641		- // taxonomy, so both are queried for the FAQ group column.
642		- $term_ids = wp_get_object_terms( $post_id, (array) $taxonomy, [ 'fields' => 'ids' ] );
	601	+ $terms = get_the_terms( $post_id, $taxonomy );
643	602
644		- if ( $term_ids && ! is_wp_error( $term_ids ) ) {
645		- return implode( ', ', array_map( 'intval', $term_ids ) );
	603	+ if ( $terms && ! is_wp_error( $terms ) ) {
	604	+ $term_ids = wp_list_pluck( $terms, 'term_id' );
	605	+ return implode( ', ', $term_ids );
646	606	}
647	607
648	608	return '';
649	609	}
		@@ -652,32 +612,14 @@
652	612	ob_start();
653	613
654	614	$output = fopen( 'php://output', 'w' );
655	615
656		- // Add CSV rows. Neutralize spreadsheet formula injection: a cell that a
657		- // lower-privileged author controls (e.g. a doc/FAQ title or term name) could
658		- // start with =, +, -, @, or a tab/CR and execute when the admin opens the
659		- // export in Excel/LibreOffice. Prefix such cells with a single quote.
	616	+ // Add CSV rows
660	617	foreach ( $data as $row ) {
661		- fputcsv( $output, array_map( [ $this, 'neutralize_csv_cell' ], (array) $row ) );
	618	+ fputcsv( $output, $row );
662	619	}
663	620
664		- // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- closing php://output stream; WP_Filesystem does not apply.
665	621	fclose( $output );
666	622
667	623	return ob_get_clean();
668		- }
669		-
670		- /**
671		- * Prefix a leading formula trigger (= + - @ tab CR) with a single quote so
672		- * spreadsheet apps treat the cell as text instead of executing it.
673		- */
674		- private function neutralize_csv_cell( $cell ) {
675		- $cell = (string) $cell;
676		-
677		- if ( $cell !== '' && preg_match( '/^[=+\-@\t\r]/', $cell ) ) {
678		- return "'" . $cell;
679		- }
680		-
681		- return $cell;
682	624	}
683	625	}