← All changes | includes/Core/Database/ApiModel.php +155 -117 1.2 → 3.3.1 View file →

		@@ -1,9 +1,8 @@
1	1	<?php
2	2
3	3	namespace BitCode\BitForm\Core\Database;
4	4
5		-use BitCode\BitForm\Core\Database\Model;
6	5	use BitCode\BitForm\Core\Util\IpTool;
7	6
8	7	/**
9	8	* Undocumented class
		@@ -10,139 +9,178 @@
10	9	*/
11	10
12	11	class ApiModel extends Model
13	12	{
14		- public function __construct()
15		- {
16		- global $wpdb;
17		- $this->_wpdb = $wpdb;
18		- }
19		- public function getForm()
20		- {
21		- $result = $this->_wpdb->get_results(
22		- "
	13	+ public $_wpdb;
	14	+
	15	+ public function __construct()
	16	+ {
	17	+ global $wpdb;
	18	+ $this->_wpdb = $wpdb;
	19	+ }
	20	+
	21	+ public function getForm()
	22	+ {
	23	+ $result = $this->_wpdb->get_results(
	24	+ "
23	25	SELECT form_name,id FROM `{$this->_wpdb->prefix}bitforms_form` WHERE `status`=1 order By created_at DESC
24	26	"
25		- );
26		- return $result;
27		- }
	27	+ );
	28	+ return $result;
	29	+ }
28	30
29		- public function getField($id)
30		- {
31		- $result = $this->_wpdb->get_results(
32		- "
33		- SELECT form_content,id FROM `{$this->_wpdb->prefix}bitforms_form` WHERE `status`=1 AND `id`='$id'
34		- "
35		- );
36		- return $result;
37		- }
	31	+ public function getField($id)
	32	+ {
	33	+ $result = $this->_wpdb->get_results(
	34	+ $this->_wpdb->prepare(
	35	+ "SELECT form_content,id FROM `{$this->_wpdb->prefix}bitforms_form` WHERE `status`=1 AND `id`=%d",
	36	+ $id
	37	+ )
	38	+ );
	39	+ return $result;
	40	+ }
38	41
39		- public function editEntry($entryID)
40		- {
41		- $result = $this->_wpdb->get_results(
42		- "
43		- SELECT bitforms_form_entry_id,meta_key,meta_value FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id`='$entryID'
44		- "
45		- );
46		- return $result;
47		- }
	42	+ public function editEntry($entryID)
	43	+ {
	44	+ $result = $this->_wpdb->get_results(
	45	+ $this->_wpdb->prepare(
	46	+ "SELECT bitforms_form_entry_id,meta_key,meta_value FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id`=%d",
	47	+ $entryID
	48	+ )
	49	+ );
	50	+ return $result;
	51	+ }
48	52
49		- public function entryDelete( $entryID )
50		- {
51		- $sql = "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id` = $entryID";
52		- $result = $this->_wpdb->query($sql);
53		- return $result;
54		- }
	53	+ public function entryDelete($entryID)
	54	+ {
	55	+ $sql = $this->_wpdb->prepare(
	56	+ "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE `bitforms_form_entry_id` = %d",
	57	+ $entryID
	58	+ );
	59	+ $result = $this->_wpdb->query($sql);
	60	+ return $result;
	61	+ }
55	62
56		- public function findRecord($table_name, $column, $value)
57		- {
58		- $result = $this->_wpdb->get_results(
59		- "
60		- SELECT $column FROM `{$this->_wpdb->prefix}$table_name` WHERE `$column`='$value'
61		- "
62		- );
63		- return $result;
	63	+ public function findRecord($table_name, $column, $value)
	64	+ {
	65	+ // Identifiers (table/column) cannot be parameterized with wpdb placeholders.
	66	+ // Sanitize identifiers to prevent SQL injection through dynamic identifiers.
	67	+ $safeTable = preg_replace('/[^A-Za-z0-9_]/', '', (string) $table_name);
	68	+ $safeColumn = preg_replace('/[^A-Za-z0-9_]/', '', (string) $column);
	69	+ $table_name = $this->_wpdb->prefix . $safeTable;
	70	+ $value = is_scalar($value) ? $value : ''; // Ensure value is scalar for placeholder.
	71	+ if ('' === $safeTable || '' === $safeColumn) {
	72	+ return [];
64	73	}
65	74
66		- public function noteCreate($formID, $entryID, $note_details)
67		- {
68		- $ipTool = new IpTool();
69		- $user_details = $ipTool->getUserDetail();
70		- $result = $this->_wpdb->insert(
71		- "{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo",
72		- array(
73		- 'info_type' => 'note',
74		- 'info_details' => $note_details,
75		- 'form_id' => $formID,
76		- 'entry_id' => $entryID,
77		- 'user_id' => $user_details['id'],
78		- 'user_ip' => $user_details['ip'],
79		- 'created_at' => $user_details['time'],
80		- )
81		- );
82		- return $result;
83		- }
	75	+ $sql = $this->_wpdb->prepare(
	76	+ 'SELECT `%1$s` FROM `%2$s` WHERE `%1$s`=%3$s',
	77	+ $safeColumn,
	78	+ $table_name,
	79	+ $value
	80	+ );
	81	+ return $this->_wpdb->get_results($sql);
	82	+ }
84	83
85		- public function noteList()
86		- {
87		- $result = $this->_wpdb->get_results(
88		- "
89		- SELECT * FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `status`=1
90		- "
91		- );
92		- return $result;
93		- }
	84	+ public function noteCreate($formID, $entryID, $note_details)
	85	+ {
	86	+ $ipTool = new IpTool();
	87	+ $user_details = $ipTool->getUserDetail();
	88	+ $result = $this->_wpdb->insert(
	89	+ "{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo",
	90	+ [
	91	+ 'info_type' => 'note',
	92	+ 'info_details' => $note_details,
	93	+ 'form_id' => $formID,
	94	+ 'entry_id' => $entryID,
	95	+ 'user_id' => $user_details['id'],
	96	+ 'user_ip' => $user_details['ip'],
	97	+ 'created_at' => $user_details['time'],
	98	+ ]
	99	+ );
	100	+ return $result;
	101	+ }
94	102
95		- public function getWorkFlow( $formID ){
96		- $result = $this->_wpdb->get_results(
97		- "
98		- SELECT workflow_name,id FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id`= $formID
99		- "
100		- );
101		- return $result;
102		- }
	103	+ public function noteList()
	104	+ {
	105	+ $result = $this->_wpdb->get_results("SELECT * FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `status`=1");
	106	+ return $result;
	107	+ }
103	108
104		- public function noteUpdate($noteID, $note_details)
105		- {
106		- $data = array('info_details' => $note_details,);
107		- $result = $this->_wpdb->update(
108		- "{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo",
109		- $data,
110		- array(
111		- 'id' => $noteID,
112		- )
113		- );
114		- return $result;
115		- }
	109	+ public function getWorkFlow($formID)
	110	+ {
	111	+ $result = $this->_wpdb->get_results(
	112	+ $this->_wpdb->prepare(
	113	+ "SELECT workflow_name,id FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id` = %d",
	114	+ $formID
	115	+ )
	116	+ );
	117	+ return $result;
	118	+ }
116	119
117		- public function noteDelete($noteID)
118		- {
119		- $sql = "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `id` = $noteID";
120		- $result = $this->_wpdb->query($sql);
121		- return $result;
122		- }
	120	+ public function noteUpdate($noteID, $note_details)
	121	+ {
	122	+ $data = ['info_details' => $note_details];
	123	+ $result = $this->_wpdb->update(
	124	+ "{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo",
	125	+ $data,
	126	+ [
	127	+ 'id' => $noteID,
	128	+ ]
	129	+ );
	130	+ return $result;
	131	+ }
123	132
124		- public function get_form_value($entryID){
	133	+ public function noteDelete($noteID)
	134	+ {
	135	+ $sql = $this->_wpdb->prepare(
	136	+ "DELETE FROM `{$this->_wpdb->prefix}bitforms_form_entry_relatedinfo` WHERE `id` = %d",
	137	+ $noteID
	138	+ );
	139	+ $result = $this->_wpdb->query($sql);
	140	+ return $result;
	141	+ }
125	142
126		- $sql = "SELECT `meta_key`,`meta_value` FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` where bitforms_form_entry_id=$entryID";
127		- $result = $this->_wpdb->get_results($sql);
128		- return $result;
129		-
130		- }
	143	+ public function get_form_value($entryID)
	144	+ {
	145	+ $sql = $this->_wpdb->prepare(
	146	+ "SELECT `meta_key`,`meta_value` FROM `{$this->_wpdb->prefix}bitforms_form_entrymeta` WHERE bitforms_form_entry_id=%d",
	147	+ $entryID
	148	+ );
	149	+ $result = $this->_wpdb->get_results($sql);
	150	+ return $result;
	151	+ }
131	152
132		- public function logUpdate($updateValue, $logID)
133		- {
134		- if (empty($logID)) {
135		- return false;
136		- }
137		- $sql = "UPDATE `{$this->_wpdb->prefix}bitforms_form_entry_log` SET content='$updateValue' WHERE id=$logID";
138		- $result = $this->_wpdb->get_results($sql);
139		- return $result;
	153	+ public function logUpdate($updateValue, $logID)
	154	+ {
	155	+ if (empty($logID)) {
	156	+ return false;
140	157	}
	158	+ $sql = $this->_wpdb->prepare(
	159	+ "UPDATE `{$this->_wpdb->prefix}bitforms_form_entry_log` SET content=%s WHERE id=%d",
	160	+ $updateValue,
	161	+ $logID
	162	+ );
	163	+ $result = $this->_wpdb->get_results($sql);
	164	+ return $result;
	165	+ }
141	166
142		- public function getFormId($formID){
143		- $sql = "SELECT form_id FROM `bit_bitforms_form_entries` WHERE id=$formID";
144		- $result = $this->_wpdb->get_results($sql);
145		- return $result;
146		- }
	167	+ public function getFormId($formID)
	168	+ {
	169	+ $sql = $this->_wpdb->prepare(
	170	+ "SELECT form_id FROM `{$this->_wpdb->prefix}bitforms_form_entries` WHERE id=%d",
	171	+ $formID
	172	+ );
	173	+ $result = $this->_wpdb->get_results($sql);
	174	+ return $result;
	175	+ }
147	176
	177	+ public function getOnSubmitWorkflow($formID)
	178	+ {
	179	+ $sql = $this->_wpdb->prepare(
	180	+ "SELECT `id`, `workflow_name`, `workflow_type`, `workflow_run`, `workflow_behaviour`, `workflow_status` FROM `{$this->_wpdb->prefix}bitforms_workflows` WHERE `form_id`=%d AND `workflow_type`='onsubmit' ORDER BY id DESC",
	181	+ $formID
	182	+ );
	183	+ $result = $this->_wpdb->get_results($sql);
	184	+ return $result;
	185	+ }
148	186	}