← All changes | includes/page-availability/availability__resource.php +31 -8 10.10 → 11.8.3 View file →

		@@ -68,10 +68,21 @@
68	68
69	69	foreach ( $search_dates as $date_ymd ) {
70	70	$search_dates_arr[] = $date_ymd . ' 00:00:00';
71	71	}
72		- $search_dates_formated = implode( ',', $search_dates_arr );
73	72
	73	+ /**
	74	+ * // FixIn: 10.14.17.1.
	75	+ * If we have only one date param,eter, it is means that we defined only one parameter in shortcode: calendar_dates_start or calendar_dates_end
	76	+ * and in this case we need to search >= or <= (but because in this function, we do not know what exactly it was parameter, start or end), we will search for all dates.
	77	+ */
	78	+ if ( count( $search_dates_arr ) === 1 ) {
	79	+ $search_dates_formated = 'ALL';
	80	+ } else {
	81	+ $search_dates_formated = implode( ',', $search_dates_arr );
	82	+ }
	83	+
	84	+
74	85	} else { // Probably 'CURDATE' | 'ALL'
75	86
76	87	$search_dates_formated = ( in_array( $search_dates, array( 'ALL', 'CURDATE' ) ) )
77	88	? $search_dates
		@@ -190,9 +201,9 @@
190	201	if ( 'ALL' == $params['calendar_date'] ) {
191	202	// All dates
192	203	} else if ( 'CURDATE' == $params['calendar_date'] ) {
193	204
194		- $sql['where'] .= " AND calendar_date >= CURDATE() "; // Current dates
	205	+ $sql['where'] .= " AND calendar_date >= " . wpbc_sql_date_math_expr_explicit('', 'curdate') . " "; // Current dates
195	206
196	207	} else { // Specific Date(s)
197	208
198	209	if ( false === strpos( $params['calendar_date'], ',' ) ) { // One date: - '2023-07-15 00:00:00'
		@@ -206,10 +217,22 @@
206	217	foreach ( $dates_arr as $date_ymd ) {
207	218	$in_search_arr[] = '%s';
208	219	$sql_args[] = $date_ymd;
209	220	}
210		- $in_search_dates_csv = implode( ',', $in_search_arr );
211		- $sql['where'] .= " AND calendar_date IN ( {$in_search_dates_csv} ) ";
	221	+ // FixIn: 10.14.17.1.
	222	+ $sql_args = wpbc_sanitize_date_ymdhis_to_check( $sql_args );
	223	+ /**
	224	+ * If we have onbly 2 dates, then we understand such dates as from - to.
	225	+ * usually such situation in shortcodes with these parameters calendar_dates_start / calendar_dates_end.
	226	+ * E.g.: [bookingcalendar resource_id=2 nummonths=2 calendar_dates_start='2026-02-01' calendar_dates_end='2026-03-31']
	227	+ */
	228	+ if ( 2 === count( $sql_args ) ) {
	229	+ $sql['where'] .= " AND calendar_date >= %s ";
	230	+ $sql['where'] .= " AND calendar_date <= %s ";
	231	+ } else {
	232	+ $in_search_dates_csv = implode( ',', $in_search_arr );
	233	+ $sql['where'] .= " AND calendar_date IN ( {$in_search_dates_csv} ) ";
	234	+ }
212	235	}
213	236	}
214	237	}
215	238
		@@ -249,9 +272,9 @@
249	272	*
250	273	*/
251	274	/* phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare */
252	275	$sql_prepared = $wpdb->prepare( $sql['start_select'] . $sql['from'] . $sql['where'] . $sql['order'] . $sql['limit'], $sql_args );
253		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	276	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
254	277	$bookings_sql_obj = $wpdb->get_results( $sql_prepared );
255	278
256	279	// CACHE - SAVE :: ------------------------------------------------------------------------------------------------
257	280	$cache_result = wpbc_cache__save( 'wpbc_availability__get_dates_status__sql', $params_for_cache, $bookings_sql_obj );
		@@ -346,9 +369,9 @@
346	369	$sql .= " )";
347	370	}
348	371	/* phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare */
349	372	$sql_prepared = $wpdb->prepare( $sql, $sql_args );
350		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	373	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
351	374	$row_number = $wpdb->query( $sql_prepared );
352	375
353	376
354	377	// If we set the dates as 'available', then we skip INSERT into DB, because previously we have already deleted all 'unavailable' dates status for such dates
		@@ -374,9 +397,9 @@
374	397	$sub_sql = implode( ',', $sub_sql );
375	398	$sql .= $sub_sql;
376	399	/* phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare */
377	400	$sql_prepared = $wpdb->prepare( $sql, $sql_args );
378		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	401	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
379	402	$row_number = $wpdb->query( $sql_prepared );
380	403	}
381	404
382	405	return $row_number;
		@@ -472,9 +495,9 @@
472	495	}
473	496	}
474	497	/* phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare */
475	498	$sql_prepared = $wpdb->prepare( $sql, $sql_args );
476		- // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	499	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
477	500	$row_number = $wpdb->query( $sql_prepared );
478	501
479	502	return $row_number;
480	503	}