| @@ -124,10 +124,10 @@ | ||
| 124 | 124 | |
| 125 | 125 | $per_page = $this->get_pagination_count(); |
| 126 | 126 | |
| 127 | 127 | $page_number = 1; |
| 128 | - if ( ! empty( $_REQUEST['paged'] ) ) { | |
| 129 | - $page_number = absint( sanitize_text_field( $_REQUEST['paged'] ) ); | |
| 128 | + if ( ! empty( $_REQUEST['paged'] ) ) {// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 129 | + $page_number = absint( sanitize_text_field(wp_unslash( $_REQUEST['paged'] ) ));// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 130 | 130 | } |
| 131 | 131 | |
| 132 | 132 | $sql = "SELECT * FROM " . $this->db_table; |
| 133 | 133 | |
| @@ -132,11 +132,11 @@ | ||
| 132 | 132 | $sql = "SELECT * FROM " . $this->db_table; |
| 133 | 133 | |
| 134 | 134 | $sql .= self::get_where_condition(); |
| 135 | 135 | |
| 136 | - if ( ! empty( $_REQUEST['orderby'] ) ) { | |
| 137 | - $order_by = ( isset( $_REQUEST['orderby'] ) && sanitize_text_field( $_REQUEST['orderby'] ) != '' ) ? sanitize_text_field( $_REQUEST['orderby'] ) : 'id'; | |
| 138 | - $order_by .= ( ! empty( $_REQUEST['order'] ) && strtolower( $_REQUEST['order'] ) == 'asc' ) ? ' ASC' : ' DESC'; | |
| 136 | + if ( ! empty( $_REQUEST['orderby'] ) ) {// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 137 | + $order_by = ( isset( $_REQUEST['orderby'] ) && sanitize_text_field( wp_unslash($_REQUEST['orderby'] )) != '' ) ? sanitize_text_field( wp_unslash($_REQUEST['orderby'] ) ) : 'id';// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 138 | + $order_by .= ( ! empty( $_REQUEST['order'] ) && strtolower( sanitize_text_field(wp_unslash( $_REQUEST['order'] ) ) ) == 'asc' ) ? ' ASC' : ' DESC';// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 139 | 139 | |
| 140 | 140 | $sql_orderby = sanitize_sql_orderby( $order_by ); |
| 141 | 141 | |
| 142 | 142 | if ( $sql_orderby ) { |
| @@ -151,10 +151,10 @@ | ||
| 151 | 151 | $p_page = ($page_number - 1) * $per_page; |
| 152 | 152 | $sql .= " LIMIT " . $per_page; |
| 153 | 153 | $sql .= " OFFSET " . $p_page; |
| 154 | 154 | $result = $wpdb->get_results( $sql, 'ARRAY_A' ); |
| 155 | - | |
| 156 | - return $result; | |
| 155 | + // $result = $wpdb->get_results( $wpdb->prepare($sql, ...$params), 'ARRAY_A' ); | |
| 156 | + return $result; | |
| 157 | 157 | } |
| 158 | 158 | |
| 159 | 159 | /** |
| 160 | 160 | * @return mixed |
| @@ -206,10 +206,10 @@ | ||
| 206 | 206 | 'last_year' => "year", |
| 207 | 207 | ); |
| 208 | 208 | $where = array(); |
| 209 | 209 | $sql = ''; |
| 210 | - | |
| 211 | - $search = (isset($_REQUEST['s'])) ? sanitize_text_field($_REQUEST['s']) : false; | |
| 210 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 211 | + $search = (isset($_REQUEST['s'])) ? sanitize_text_field(wp_unslash($_REQUEST['s'])) : false; | |
| 212 | 212 | if ($search) { |
| 213 | 213 | $s = array(); |
| 214 | 214 | $s[] = sprintf( "`title` LIKE '%%%s%%' ", esc_sql( $wpdb->esc_like( $search ) ) ); |
| 215 | 215 | $where[] = ' ( ' . implode(' OR ', $s) . ' ) '; |
| @@ -219,25 +219,25 @@ | ||
| 219 | 219 | // $where[] = ' `status` = "' . esc_sql( sanitize_text_field( $_GET['fstatus'] ) ) . '" '; |
| 220 | 220 | // } else { |
| 221 | 221 | // $where[] = ' `status` != "trashed" '; |
| 222 | 222 | // } |
| 223 | - if( isset( $_REQUEST['filterbytype'] ) && absint( sanitize_text_field( $_REQUEST['filterbytype'] ) ) > 0){ | |
| 224 | - $key = intval( sanitize_text_field( $_REQUEST['filterbytype'] ) ); | |
| 223 | + if( isset( $_REQUEST['filterbytype'] ) && absint( sanitize_text_field( wp_unslash( $_REQUEST['filterbytype'] ) ) ) > 0){// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 224 | + $key = intval( sanitize_text_field( wp_unslash( $_REQUEST['filterbytype'] ) ) );// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 225 | 225 | $where[] = ' `source_chart_type` = "'. $chart_types[$key-1] .'" '; |
| 226 | 226 | } |
| 227 | 227 | |
| 228 | - if( isset( $_REQUEST['filterbysource'] ) && absint( sanitize_text_field( $_REQUEST['filterbysource'] ) ) > 0){ | |
| 229 | - $key = intval( sanitize_text_field( $_REQUEST['filterbysource'] ) ); | |
| 228 | + if( isset( $_REQUEST['filterbysource'] ) && absint( sanitize_text_field( wp_unslash($_REQUEST['filterbysource'] ) ) ) > 0){// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 229 | + $key = intval( sanitize_text_field( wp_unslash($_REQUEST['filterbysource'] )) );// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 230 | 230 | $where[] = ' `source_type` = "'. $chart_sources[$key-1] .'" '; |
| 231 | 231 | } |
| 232 | 232 | |
| 233 | - if( isset( $_REQUEST['filterbychartsource'] ) && absint( sanitize_text_field( $_REQUEST['filterbychartsource'] ) ) > 0){ | |
| 234 | - $key = intval( sanitize_text_field( $_REQUEST['filterbychartsource'] ) ); | |
| 233 | + if( isset( $_REQUEST['filterbychartsource'] ) && absint( sanitize_text_field( wp_unslash($_REQUEST['filterbychartsource'] )) ) > 0){// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 234 | + $key = intval( sanitize_text_field( wp_unslash($_REQUEST['filterbychartsource']) ) );// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 235 | 235 | $where[] = ' `type` = "'. $chart_source_types[$key-1] .'" '; |
| 236 | 236 | } |
| 237 | 237 | |
| 238 | - if( isset( $_REQUEST['filterbydate'] ) && sanitize_text_field( $_REQUEST['filterbydate'] ) !== ''){ | |
| 239 | - $interval = sanitize_text_field( $_REQUEST['filterbydate'] ); | |
| 238 | + if( isset( $_REQUEST['filterbydate'] ) && sanitize_text_field(wp_unslash( $_REQUEST['filterbydate'] )) !== ''){// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 239 | + $interval = sanitize_text_field( wp_unslash($_REQUEST['filterbydate'] ));// phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 240 | 240 | if ($chart_dates[$interval] !== '') { |
| 241 | 241 | $where[] = ' DATE(date_created) >= DATE_SUB(CURDATE(), INTERVAL 1 '. strtoupper($chart_dates[$interval]) .') AND DATE(date_created) < CURDATE() '; |
| 242 | 242 | } else{ |
| 243 | 243 | $where[] = ' DATE(date_created) = CURDATE() '; |
| @@ -243,10 +243,10 @@ | ||
| 243 | 243 | $where[] = ' DATE(date_created) = CURDATE() '; |
| 244 | 244 | } |
| 245 | 245 | } |
| 246 | 246 | |
| 247 | - if( isset( $_REQUEST['filterbyauthor'] ) && absint( sanitize_text_field( $_REQUEST['filterbyauthor'] ) ) > 0){ | |
| 248 | - $where[] = ' `author_id` = "'. absint(sanitize_text_field($_REQUEST['filterbyauthor'])) .'" '; | |
| 247 | + if( isset( $_REQUEST['filterbyauthor'] ) && absint( sanitize_text_field( wp_unslash($_REQUEST['filterbyauthor']) ) ) > 0){ | |
| 248 | + $where[] = ' `author_id` = "'. absint(sanitize_text_field(wp_unslash($_REQUEST['filterbyauthor']))) .'" '; | |
| 249 | 249 | } |
| 250 | 250 | |
| 251 | 251 | if (!empty($where)) { |
| 252 | 252 | $sql = " WHERE " . implode( " AND ", $where ); |
| @@ -255,21 +255,29 @@ | ||
| 255 | 255 | return $sql; |
| 256 | 256 | } |
| 257 | 257 | |
| 258 | 258 | public static function get_search_value () { |
| 259 | - $search = (isset($_REQUEST['s'])) ? sanitize_text_field($_REQUEST['s']) : ''; | |
| 259 | + $search = (isset($_REQUEST['s'])) ? sanitize_text_field(wp_unslash($_REQUEST['s'])) : ''; | |
| 260 | 260 | return $search; |
| 261 | 261 | } |
| 262 | 262 | |
| 263 | 263 | public static function get_searched_author_info () { |
| 264 | - $id = (isset($_REQUEST['filterbyauthor'])) ? absint(sanitize_text_field($_REQUEST['filterbyauthor'])) : 0; | |
| 264 | + global $wpdb; | |
| 265 | + | |
| 266 | + $id = (isset($_REQUEST['filterbyauthor'])) ? absint(sanitize_text_field(wp_unslash($_REQUEST['filterbyauthor']))) : 0; | |
| 265 | 267 | $author_data = array(); |
| 266 | 268 | if ( $id && $id > 0 ) { |
| 267 | 269 | global $wpdb; |
| 268 | 270 | $users_table = esc_sql( $wpdb->prefix . 'users' ); |
| 269 | - $sql_users = "SELECT ID, display_name FROM {$users_table} WHERE ID = {$id}"; | |
| 270 | - | |
| 271 | - $author_data = $wpdb->get_row($sql_users, "ARRAY_A"); | |
| 271 | + $author_data = $wpdb->get_row(// phpcs:ignore | |
| 272 | + $wpdb->prepare( | |
| 273 | + "SELECT ID, display_name | |
| 274 | + FROM {$users_table} | |
| 275 | + WHERE ID = %d", | |
| 276 | + $id | |
| 277 | + ), | |
| 278 | + ARRAY_A | |
| 279 | + ); | |
| 272 | 280 | } |
| 273 | 281 | |
| 274 | 282 | return $author_data; |
| 275 | 283 | } |
| @@ -290,10 +298,17 @@ | ||
| 290 | 298 | if( is_null( $id ) ){ |
| 291 | 299 | return false; |
| 292 | 300 | } |
| 293 | 301 | |
| 294 | - $sql = "SELECT * FROM ". $this->db_table ." WHERE id = '". $id ."'"; | |
| 295 | - $result = $wpdb->get_row( $sql, ARRAY_A ); | |
| 302 | + $result = $wpdb->get_row(// phpcs:ignore | |
| 303 | + $wpdb->prepare( | |
| 304 | + "SELECT * | |
| 305 | + FROM {$this->db_table} | |
| 306 | + WHERE id = %d", | |
| 307 | + $id | |
| 308 | + ), | |
| 309 | + ARRAY_A | |
| 310 | + ); | |
| 296 | 311 | |
| 297 | 312 | if( $result ){ |
| 298 | 313 | return $result; |
| 299 | 314 | } |
| @@ -318,20 +333,20 @@ | ||
| 318 | 333 | if( is_null( $id ) ){ |
| 319 | 334 | return false; |
| 320 | 335 | } |
| 321 | 336 | |
| 322 | - if( isset( $_POST["chart_builder_action"] ) && wp_verify_nonce( $_POST["chart_builder_action"], 'chart_builder_action' ) ){ | |
| 337 | + if ( isset( $_POST["chart_builder_action"] ) && wp_verify_nonce( sanitize_text_field(wp_unslash( $_POST["chart_builder_action"] )), 'chart_builder_action' ) ) { | |
| 323 | 338 | $success = 0; |
| 324 | 339 | $name_prefix = 'ays_'; |
| 325 | 340 | |
| 326 | 341 | // Save type |
| 327 | - $save_type = isset( $_POST['save_type'] ) && $_POST['save_type'] != '' ? sanitize_text_field( $_POST['save_type'] ) : ''; | |
| 342 | + $save_type = isset( $_POST['save_type'] ) && $_POST['save_type'] != '' ? sanitize_text_field(wp_unslash( $_POST['save_type'] ) ) : ''; | |
| 328 | 343 | |
| 329 | 344 | // Author_id |
| 330 | 345 | $author_id = get_current_user_id(); |
| 331 | 346 | |
| 332 | 347 | // Title |
| 333 | - $title = isset( $_POST[ $name_prefix . 'title' ] ) && $_POST[ $name_prefix . 'title' ] != '' ? stripslashes( sanitize_text_field( $_POST[ $name_prefix . 'title' ] ) ) : 'Untitled chart'; | |
| 348 | + $title = isset( $_POST[ $name_prefix . 'title' ] ) && $_POST[ $name_prefix . 'title' ] != '' ? stripslashes( sanitize_text_field( wp_unslash($_POST[ $name_prefix . 'title' ] )) ) : 'Untitled chart'; | |
| 334 | 349 | |
| 335 | 350 | // if( $title == '' ){ |
| 336 | 351 | // $message = 'empty-title'; |
| 337 | 352 | // $url = esc_url_raw( remove_query_arg( false ) ); |
| @@ -343,23 +358,23 @@ | ||
| 343 | 358 | // } |
| 344 | 359 | |
| 345 | 360 | |
| 346 | 361 | // Description |
| 347 | - $description = isset( $_POST[ $name_prefix . 'description' ] ) && $_POST[ $name_prefix . 'description' ] != '' ? stripslashes( sanitize_text_field($_POST[ $name_prefix . 'description' ]) ) : ''; | |
| 362 | + $description = isset( $_POST[ $name_prefix . 'description' ] ) && $_POST[ $name_prefix . 'description' ] != '' ? stripslashes( sanitize_text_field(wp_unslash($_POST[ $name_prefix . 'description' ])) ) : ''; | |
| 348 | 363 | |
| 349 | 364 | // Type |
| 350 | - $type = isset( $_POST[ $name_prefix . 'type' ] ) && $_POST[ $name_prefix . 'type' ] != '' ? sanitize_text_field( $_POST[ $name_prefix . 'type' ] ) : 'google-charts'; | |
| 365 | + $type = isset( $_POST[ $name_prefix . 'type' ] ) && $_POST[ $name_prefix . 'type' ] != '' ? sanitize_text_field( wp_unslash($_POST[ $name_prefix . 'type' ] )) : 'google-charts'; | |
| 351 | 366 | |
| 352 | 367 | // Source chart type |
| 353 | - $source_chart_type = isset( $_POST[ $name_prefix . 'source_chart_type' ] ) && $_POST[ $name_prefix . 'source_chart_type' ] != '' ? sanitize_text_field( $_POST[ $name_prefix . 'source_chart_type' ] ) : 'pie_chart'; | |
| 368 | + $source_chart_type = isset( $_POST[ $name_prefix . 'source_chart_type' ] ) && $_POST[ $name_prefix . 'source_chart_type' ] != '' ? sanitize_text_field( wp_unslash($_POST[ $name_prefix . 'source_chart_type' ] )) : 'pie_chart'; | |
| 354 | 369 | |
| 355 | 370 | // Source type |
| 356 | - $source_type = isset( $_POST[ $name_prefix . 'source_type' ] ) && $_POST[ $name_prefix . 'source_type' ] != '' ? sanitize_text_field( $_POST[ $name_prefix . 'source_type' ] ) : 'manual'; | |
| 371 | + $source_type = isset( $_POST[ $name_prefix . 'source_type' ] ) && $_POST[ $name_prefix . 'source_type' ] != '' ? sanitize_text_field( wp_unslash($_POST[ $name_prefix . 'source_type' ] )) : 'manual'; | |
| 357 | 372 | |
| 358 | 373 | // Manual data |
| 359 | 374 | $chart_source_filtered_data = array(); |
| 360 | 375 | if ($source_chart_type == "org_chart") { |
| 361 | - $chart_source_data_add = isset($_POST[ $name_prefix . 'chart_source_data_org_type' ]) && !empty( $_POST[ $name_prefix . 'chart_source_data_org_type' ] ) ? $_POST[ $name_prefix . 'chart_source_data_org_type' ] : array(); | |
| 376 | + $chart_source_data_add = isset($_POST[ $name_prefix . 'chart_source_data_org_type' ]) && !empty( $_POST[ $name_prefix . 'chart_source_data_org_type' ] ) ? wp_unslash($_POST[ $name_prefix . 'chart_source_data_org_type' ]) : array(); | |
| 362 | 377 | foreach($chart_source_data_add as $chart_source_data_key => $chart_source_data_value){ |
| 363 | 378 | $chart_source_data_key = (int)filter_var($chart_source_data_key, FILTER_SANITIZE_NUMBER_INT); |
| 364 | 379 | foreach($chart_source_data_value as $s_data_key => $s_data_value){ |
| 365 | 380 | if ($s_data_key === 5) { |
| @@ -364,9 +379,9 @@ | ||
| 364 | 379 | foreach($chart_source_data_value as $s_data_key => $s_data_value){ |
| 365 | 380 | if ($s_data_key === 5) { |
| 366 | 381 | $chart_source_filtered_data[$chart_source_data_key][] = (isset($s_data_value) && $s_data_value != '') ? esc_url( $s_data_value ) : ''; |
| 367 | 382 | } else { |
| 368 | - $chart_source_filtered_data[$chart_source_data_key][] = (isset($s_data_value) && $s_data_value != '') ? esc_attr(stripslashes( sanitize_text_field( $s_data_value ) )) : ''; | |
| 383 | + $chart_source_filtered_data[$chart_source_data_key][] = (isset($s_data_value) && $s_data_value != '') ? stripslashes(sanitize_text_field( wp_strip_all_tags( html_entity_decode( $s_data_value, ENT_QUOTES, 'UTF-8' )) )) : ''; | |
| 369 | 384 | } |
| 370 | 385 | } |
| 371 | 386 | } |
| 372 | 387 | } else { |
| @@ -374,9 +389,9 @@ | ||
| 374 | 389 | foreach($chart_source_data_add as $chart_source_data_key => $chart_source_data_value){ |
| 375 | 390 | if ($chart_source_data_key == 0) { |
| 376 | 391 | if(!empty($chart_source_data_value)){ |
| 377 | 392 | foreach($chart_source_data_value as $s_data_key => $s_data_value){ |
| 378 | - $chart_source_filtered_data[$chart_source_data_key][] = (isset($s_data_value) && trim(esc_attr(stripslashes( sanitize_text_field( $s_data_value ) ))) != '') ? esc_attr(stripslashes( sanitize_text_field( $s_data_value ) )) : 'Title '.$s_data_key; | |
| 393 | + $chart_source_filtered_data[$chart_source_data_key][] = (isset($s_data_value) && trim(stripslashes(sanitize_text_field( wp_strip_all_tags( html_entity_decode( $s_data_value, ENT_QUOTES, 'UTF-8' )) ))) != '') ? stripslashes(sanitize_text_field( wp_strip_all_tags( html_entity_decode( $s_data_value, ENT_QUOTES, 'UTF-8' )) )) : 'Title '.$s_data_key; | |
| 379 | 394 | } |
| 380 | 395 | } |
| 381 | 396 | } else { |
| 382 | 397 | if(!empty($chart_source_data_value) && (isset($chart_source_data_value[0]) && trim($chart_source_data_value[0]) != '')){ |
| @@ -381,11 +396,11 @@ | ||
| 381 | 396 | } else { |
| 382 | 397 | if(!empty($chart_source_data_value) && (isset($chart_source_data_value[0]) && trim($chart_source_data_value[0]) != '')){ |
| 383 | 398 | foreach($chart_source_data_value as $s_data_key => $s_data_value){ |
| 384 | 399 | if ($s_data_key === 0) { |
| 385 | - $chart_source_filtered_data[$chart_source_data_key][] = (isset($s_data_value) && esc_attr(stripslashes( sanitize_text_field( $s_data_value ) )) != '') ? esc_attr(stripslashes( sanitize_text_field( $s_data_value ) )) : 'Option'; | |
| 400 | + $chart_source_filtered_data[$chart_source_data_key][] = (isset($s_data_value) && stripslashes(sanitize_text_field( wp_strip_all_tags( html_entity_decode( $s_data_value, ENT_QUOTES, 'UTF-8' )) )) != '') ? stripslashes(sanitize_text_field( wp_strip_all_tags( html_entity_decode( $s_data_value, ENT_QUOTES, 'UTF-8' )) )) : 'Option'; | |
| 386 | 401 | } else { |
| 387 | - $chart_source_filtered_data[$chart_source_data_key][] = (isset($s_data_value) && esc_attr(stripslashes( sanitize_text_field( $s_data_value ) )) != '') ? esc_attr(stripslashes( sanitize_text_field( $s_data_value ) )) : '0'; | |
| 402 | + $chart_source_filtered_data[$chart_source_data_key][] = (isset($s_data_value) && stripslashes(sanitize_text_field( wp_strip_all_tags( html_entity_decode( $s_data_value, ENT_QUOTES, 'UTF-8' )) )) != '') ? stripslashes(sanitize_text_field( wp_strip_all_tags( html_entity_decode( $s_data_value, ENT_QUOTES, 'UTF-8' )) )) : '0'; | |
| 388 | 403 | } |
| 389 | 404 | } |
| 390 | 405 | } |
| 391 | 406 | } |
| @@ -398,9 +413,9 @@ | ||
| 398 | 413 | $quiz_data = get_option( $quiz_maker_data_option_name_for_quiz ); |
| 399 | 414 | |
| 400 | 415 | $quiz_maker_data_option_name = $id == 0 ? 'ays_chart_quiz_maker_results_temp' : 'ays_chart_quiz_maker_results_' . $id; |
| 401 | 416 | $quiz_maker_data = get_option( $quiz_maker_data_option_name, array() ); |
| 402 | - $query_id = isset( $_POST[ $name_prefix . 'quiz_query' ] ) && $_POST[ $name_prefix . 'quiz_query' ] != '' ? sanitize_text_field( $_POST[ $name_prefix . 'quiz_query' ] ) : ''; | |
| 417 | + $query_id = isset( $_POST[ $name_prefix . 'quiz_query' ] ) && $_POST[ $name_prefix . 'quiz_query' ] != '' ? sanitize_text_field(wp_unslash($_POST[ $name_prefix . 'quiz_query' ] )) : ''; | |
| 403 | 418 | $quiz_id = isset( $_POST[ $name_prefix . 'quiz_id' ] ) && $_POST[ $name_prefix . 'quiz_id' ] != '' ? intval( $_POST[ $name_prefix . 'quiz_id' ] ) : 0; |
| 404 | 419 | |
| 405 | 420 | // Source |
| 406 | 421 | switch ( $source_type ){ |
| @@ -469,18 +484,18 @@ | ||
| 469 | 484 | break; |
| 470 | 485 | } |
| 471 | 486 | |
| 472 | 487 | // Status |
| 473 | - $status = isset( $_POST[ $name_prefix . 'status' ] ) && $_POST[ $name_prefix . 'status' ] != '' ? sanitize_text_field( $_POST[ $name_prefix . 'status' ] ) : 'draft'; | |
| 488 | + $status = isset( $_POST[ $name_prefix . 'status' ] ) && $_POST[ $name_prefix . 'status' ] != '' ? sanitize_text_field( wp_unslash($_POST[ $name_prefix . 'status' ] )) : 'draft'; | |
| 474 | 489 | |
| 475 | 490 | // Date created |
| 476 | - $date_created = isset( $_POST[ $name_prefix . 'date_created' ] ) && CBFunctions()->validateDate( $_POST[ $name_prefix . 'date_created' ] ) ? sanitize_text_field($_POST[ $name_prefix . 'date_created' ]) : current_time( 'mysql' ); | |
| 491 | + $date_created = isset( $_POST[ $name_prefix . 'date_created' ] ) && CBFunctions()->validateDate( sanitize_text_field(wp_unslash( $_POST[ $name_prefix . 'date_created' ] )) ) ? sanitize_text_field( wp_unslash( $_POST[ $name_prefix . 'date_created' ] ) ) : current_time( 'mysql' ); | |
| 477 | 492 | |
| 478 | 493 | // Date modified |
| 479 | - $date_modified = isset( $_POST[ $name_prefix . 'date_modified' ] ) && CBFunctions()->validateDate( $_POST[ $name_prefix . 'date_modified' ] ) ? sanitize_text_field($_POST[ $name_prefix . 'date_modified' ]) : current_time( 'mysql' ); | |
| 494 | + $date_modified = isset( $_POST[ $name_prefix . 'date_modified' ] ) && CBFunctions()->validateDate(sanitize_text_field(wp_unslash($_POST[ $name_prefix . 'date_modified' ])) ) ? sanitize_text_field(wp_unslash($_POST[ $name_prefix . 'date_modified' ])) : current_time( 'mysql' ); | |
| 480 | 495 | |
| 481 | 496 | // Change the author of the current chart |
| 482 | - $create_author = ( isset($_POST[$name_prefix . 'create_author']) && $_POST[$name_prefix . 'create_author'] != "" ) ? absint( sanitize_text_field( $_POST[$name_prefix . 'create_author'] ) ) : ''; | |
| 497 | + $create_author = ( isset($_POST[$name_prefix . 'create_author']) && $_POST[$name_prefix . 'create_author'] != "" ) ? absint( sanitize_text_field( wp_unslash($_POST[$name_prefix . 'create_author'] )) ) : ''; | |
| 483 | 498 | |
| 484 | 499 | if ( $create_author != "" && $create_author > 0 ) { |
| 485 | 500 | $user = get_userdata($create_author); |
| 486 | 501 | if ( ! is_null( $user ) && $user ) { |
| @@ -491,9 +506,9 @@ | ||
| 491 | 506 | |
| 492 | 507 | $author = json_encode($author, JSON_UNESCAPED_SLASHES); |
| 493 | 508 | } else { |
| 494 | 509 | $author_data = json_decode($create_author, true); |
| 495 | - $create_author = (isset( $author_data['id'] ) && $author_data['id'] != "") ? absint( sanitize_text_field( $author_data['id'] ) ) : get_current_user_id(); | |
| 510 | + $create_author = (isset( $author_data['id'] ) && $author_data['id'] != "") ? absint( sanitize_text_field( wp_unslash($author_data['id'] )) ) : get_current_user_id(); | |
| 496 | 511 | } |
| 497 | 512 | |
| 498 | 513 | $author_id = $create_author; |
| 499 | 514 | } |
| @@ -500,11 +515,11 @@ | ||
| 500 | 515 | |
| 501 | 516 | // Options |
| 502 | 517 | $options = array(); |
| 503 | 518 | if( isset( $_POST[ $name_prefix . 'options' ] ) && !empty( $_POST[ $name_prefix . 'options' ] )) { |
| 504 | - foreach($_POST[ $name_prefix . 'options' ] as $each_option_key => $each_option_value){ | |
| 505 | - $each_option_value = isset($each_option_value) && $each_option_value != '' ? sanitize_text_field($each_option_value) : ''; | |
| 506 | - $each_option_key = isset($each_option_key) && $each_option_key != '' ? sanitize_text_field($each_option_key) : ''; | |
| 519 | + foreach(sanitize_text_field( wp_unslash($_POST[ $name_prefix . 'options' ])) as $each_option_key => $each_option_value){ | |
| 520 | + $each_option_value = isset($each_option_value) && $each_option_value != '' ? sanitize_text_field(wp_unslash($each_option_value)) : ''; | |
| 521 | + $each_option_key = isset($each_option_key) && $each_option_key != '' ? sanitize_text_field(wp_unslash($each_option_key)) : ''; | |
| 507 | 522 | $options[$each_option_key] = sanitize_text_field($each_option_value); |
| 508 | 523 | } |
| 509 | 524 | } |
| 510 | 525 | |
| @@ -515,14 +530,14 @@ | ||
| 515 | 530 | $settings = array(); |
| 516 | 531 | if( isset( $_POST[ $name_prefix . 'settings' ] ) && !empty( $_POST[ $name_prefix . 'settings' ] )) { |
| 517 | 532 | foreach($_POST[ $name_prefix . 'settings' ] as $each_setting_key => $each_setting_value){ |
| 518 | 533 | if (!is_array($each_setting_value)) { |
| 519 | - $each_setting_value = isset($each_setting_value) && $each_setting_value != '' ? esc_attr(stripslashes(sanitize_text_field($each_setting_value))) : ''; | |
| 520 | - $each_setting_key = isset($each_setting_key) && $each_setting_key != '' ? esc_attr(stripslashes(sanitize_text_field($each_setting_key))) : ''; | |
| 534 | + $each_setting_value = isset($each_setting_value) && $each_setting_value != '' ? stripslashes(sanitize_text_field( wp_strip_all_tags( html_entity_decode( $each_setting_value, ENT_QUOTES, 'UTF-8' )) )) : ''; | |
| 535 | + $each_setting_key = isset($each_setting_key) && $each_setting_key != '' ? stripslashes(sanitize_text_field( wp_strip_all_tags( html_entity_decode( $each_setting_key, ENT_QUOTES, 'UTF-8' )) )) : ''; | |
| 521 | 536 | $settings[$each_setting_key] = $each_setting_value; |
| 522 | 537 | } else { |
| 523 | 538 | foreach($each_setting_value as $each_index => $each_value){ |
| 524 | - $each_value = isset($each_value) && $each_value != '' ? esc_attr(stripslashes(sanitize_text_field($each_value))) : ''; | |
| 539 | + $each_value = isset($each_value) && $each_value != '' ? stripslashes(sanitize_text_field( wp_strip_all_tags( html_entity_decode( $each_value, ENT_QUOTES, 'UTF-8' )) )) : ''; | |
| 525 | 540 | $each_index = isset($each_index) && $each_index >= 0 ? intval($each_index) : -1; |
| 526 | 541 | $settings[$each_setting_key][$each_index] = $each_value; |
| 527 | 542 | } |
| 528 | 543 | $settings[$each_setting_key] = json_encode($settings[$each_setting_key]); |
| @@ -544,8 +559,10 @@ | ||
| 544 | 559 | $settings['vaxis_bold'] = ( isset( $settings['vaxis_bold'] ) && $settings['vaxis_bold'] != '' ) ? sanitize_text_field($settings['vaxis_bold']) : 'off'; |
| 545 | 560 | $settings['reverse_categories'] = ( isset( $settings['reverse_categories'] ) && $settings['reverse_categories'] != '' ) ? sanitize_text_field($settings['reverse_categories']) : 'off'; |
| 546 | 561 | $settings['haxis_title_italic'] = ( isset( $settings['haxis_title_italic'] ) && $settings['haxis_title_italic'] != '' ) ? sanitize_text_field($settings['haxis_title_italic']) : 'off'; |
| 547 | 562 | $settings['haxis_title_bold'] = ( isset( $settings['haxis_title_bold'] ) && $settings['haxis_title_bold'] != '' ) ? sanitize_text_field($settings['haxis_title_bold']) : 'off'; |
| 563 | + $settings['haxis_enable_divide_percent'] = ( isset( $settings['haxis_enable_divide_percent'] ) && $settings['haxis_enable_divide_percent'] != '' ) ? sanitize_text_field($settings['haxis_enable_divide_percent']) : 'off'; | |
| 564 | + $settings['vaxis_enable_divide_percent'] = ( isset( $settings['vaxis_enable_divide_percent'] ) && $settings['vaxis_enable_divide_percent'] != '' ) ? sanitize_text_field($settings['vaxis_enable_divide_percent']) : 'off'; | |
| 548 | 565 | $settings['vaxis_title_italic'] = ( isset( $settings['vaxis_title_italic'] ) && $settings['vaxis_title_italic'] != '' ) ? sanitize_text_field($settings['vaxis_title_italic']) : 'off'; |
| 549 | 566 | $settings['vaxis_title_bold'] = ( isset( $settings['vaxis_title_bold'] ) && $settings['vaxis_title_bold'] != '' ) ? sanitize_text_field($settings['vaxis_title_bold']) : 'off'; |
| 550 | 567 | $settings['enable_row_settings'] = ( isset( $settings['enable_row_settings'] ) && $settings['enable_row_settings'] != '' ) ? sanitize_text_field($settings['enable_row_settings']) : 'off'; |
| 551 | 568 | $settings['is_stacked'] = ( isset( $settings['is_stacked'] ) && $settings['is_stacked'] != '' ) ? sanitize_text_field($settings['is_stacked']) : 'off'; |
| @@ -571,12 +588,12 @@ | ||
| 571 | 588 | $settings['enable_img'] = ( isset( $settings['enable_img'] ) && $settings['enable_img'] != '' ) ? sanitize_text_field($settings['enable_img']) : 'off'; |
| 572 | 589 | // $settings['index_axis'] = ( isset( $settings['index_axis'] ) && $settings['index_axis'] != '' ) ? sanitize_text_field($settings['index_axis']) : 'off'; |
| 573 | 590 | |
| 574 | 591 | $settings = apply_filters( 'ays_chart_item_save_settings', $settings ); |
| 575 | - | |
| 592 | + $current_chart = $this->get_item($id); | |
| 576 | 593 | $message = ''; |
| 577 | 594 | if( $id == 0 ){ |
| 578 | - $result = $wpdb->insert( | |
| 595 | + $result = $wpdb->insert(// phpcs:ignore | |
| 579 | 596 | $this->db_table, |
| 580 | 597 | array( |
| 581 | 598 | 'author_id' => $author_id, |
| 582 | 599 | 'title' => $title, |
| @@ -610,8 +627,16 @@ | ||
| 610 | 627 | ); |
| 611 | 628 | |
| 612 | 629 | $inserted_id = $wpdb->insert_id; |
| 613 | 630 | |
| 631 | + $post_type_args = array( | |
| 632 | + 'chart_id' => $inserted_id, | |
| 633 | + 'author_id' => !empty($create_author) ? $create_author : get_current_user_id(), | |
| 634 | + 'chart_title' => $title, | |
| 635 | + ); | |
| 636 | + | |
| 637 | + $custom_post_id = Chart_Builder_Custom_Post_Type::ays_chart_add_custom_post($post_type_args); | |
| 638 | + | |
| 614 | 639 | if( is_array( $settings ) && ! empty( $settings ) ){ |
| 615 | 640 | foreach ( $settings as $key => $setting ){ |
| 616 | 641 | $this->add_meta( $inserted_id, $key, $setting ); |
| 617 | 642 | } |
| @@ -624,9 +649,9 @@ | ||
| 624 | 649 | delete_option( $quiz_maker_data_option_name_for_quiz ); |
| 625 | 650 | |
| 626 | 651 | $message = 'created'; |
| 627 | 652 | }else{ |
| 628 | - $result = $wpdb->update( | |
| 653 | + $result = $wpdb->update(// phpcs:ignore | |
| 629 | 654 | $this->db_table, |
| 630 | 655 | array( |
| 631 | 656 | 'author_id' => $author_id, |
| 632 | 657 | 'title' => $title, |
| @@ -671,14 +696,34 @@ | ||
| 671 | 696 | } |
| 672 | 697 | } |
| 673 | 698 | |
| 674 | 699 | $message = 'updated'; |
| 700 | + if( !empty($current_chart) && empty($current_chart['custom_post_id']) ){ | |
| 701 | + $post_type_args = array( | |
| 702 | + 'chart_id' => $inserted_id, | |
| 703 | + 'author_id' => get_current_user_id(), | |
| 704 | + 'chart_title' => $title, | |
| 705 | + ); | |
| 706 | + | |
| 707 | + $custom_post_id = Chart_Builder_Custom_Post_Type::ays_chart_add_custom_post($post_type_args); | |
| 708 | + } | |
| 675 | 709 | } |
| 676 | 710 | |
| 677 | - $ays_chart_tab = isset($_POST[ $name_prefix . 'chart_tab' ]) ? $_POST[ $name_prefix . 'chart_tab' ] : 'tab1'; | |
| 711 | + $ays_chart_tab = isset($_POST[ $name_prefix . 'chart_tab' ]) ? sanitize_text_field( wp_unslash($_POST[ $name_prefix . 'chart_tab' ])) : 'tab1'; | |
| 678 | 712 | |
| 679 | 713 | if($message == 'created'){ |
| 680 | 714 | setcookie('ays_chart_created_new', $inserted_id, time() + 3600, '/'); |
| 715 | + if(!empty($custom_post_id)){ | |
| 716 | + $custom_post_url = array( | |
| 717 | + 'post_type' => 'ays-chart-builder', | |
| 718 | + 'p' => $custom_post_id, | |
| 719 | + 'preview' => 'true', | |
| 720 | + ); | |
| 721 | + $custom_post_url_ready = http_build_query($custom_post_url); | |
| 722 | + $ready_url = get_home_url(); | |
| 723 | + $ready_url .= '/?' . $custom_post_url_ready; | |
| 724 | + setcookie('ays_chart_created_new_'.$inserted_id.'_post_id', $ready_url, time() + 3600, '/'); | |
| 725 | + } | |
| 681 | 726 | } |
| 682 | 727 | |
| 683 | 728 | if( $result >= 0 ) { |
| 684 | 729 | if( $save_type == 'apply' ){ |
| @@ -740,15 +785,15 @@ | ||
| 740 | 785 | if( is_null( $id ) ){ |
| 741 | 786 | return false; |
| 742 | 787 | } |
| 743 | 788 | |
| 744 | - $wpdb->delete( | |
| 789 | + $wpdb->delete(// phpcs:ignore | |
| 745 | 790 | $this->db_table_meta, |
| 746 | 791 | array( 'chart_id' => absint( $id ) ), |
| 747 | 792 | array( '%d' ) |
| 748 | 793 | ); |
| 749 | 794 | |
| 750 | - $wpdb->delete( | |
| 795 | + $wpdb->delete(// phpcs:ignore | |
| 751 | 796 | $this->db_table, |
| 752 | 797 | array( 'id' => absint( $id ) ), |
| 753 | 798 | array( '%d' ) |
| 754 | 799 | ); |
| @@ -772,9 +817,9 @@ | ||
| 772 | 817 | if( is_null( $id ) ){ |
| 773 | 818 | return false; |
| 774 | 819 | } |
| 775 | 820 | |
| 776 | - $result = $wpdb->update( | |
| 821 | + $result = $wpdb->update(// phpcs:ignore | |
| 777 | 822 | $this->db_table, |
| 778 | 823 | array( 'status' => 'trashed' ), |
| 779 | 824 | array( 'id' => absint( $id ) ), |
| 780 | 825 | array( '%s' ), |
| @@ -804,9 +849,9 @@ | ||
| 804 | 849 | if( is_null( $id ) ){ |
| 805 | 850 | return false; |
| 806 | 851 | } |
| 807 | 852 | |
| 808 | - $result = $wpdb->update( | |
| 853 | + $result = $wpdb->update(// phpcs:ignore | |
| 809 | 854 | $this->db_table, |
| 810 | 855 | array( 'status' => 'published' ), |
| 811 | 856 | array( 'id' => absint( $id ) ), |
| 812 | 857 | array( '%s' ), |
| @@ -836,9 +881,9 @@ | ||
| 836 | 881 | if( is_null( $id ) ){ |
| 837 | 882 | return false; |
| 838 | 883 | } |
| 839 | 884 | |
| 840 | - $result = $wpdb->update( | |
| 885 | + $result = $wpdb->update(// phpcs:ignore | |
| 841 | 886 | $this->db_table, |
| 842 | 887 | array( 'status' => 'draft' ), |
| 843 | 888 | array( 'id' => absint( $id ) ), |
| 844 | 889 | array( '%s' ), |
| @@ -873,9 +918,9 @@ | ||
| 873 | 918 | array_shift($current_data); |
| 874 | 919 | $current_data['title'] .= __(' (Copy)', 'chart-builder'); |
| 875 | 920 | $current_data['date_created'] = current_time( 'mysql' ); |
| 876 | 921 | $current_data['date_modified'] = current_time( 'mysql' ); |
| 877 | - $result = $wpdb->insert( | |
| 922 | + $result = $wpdb->insert(// phpcs:ignore | |
| 878 | 923 | $this->db_table, |
| 879 | 924 | $current_data, |
| 880 | 925 | array('%s','%s','%s','%s','%s','%s','%s','%s','%s','%s','%s','%d','%s') |
| 881 | 926 | ); |
| @@ -896,9 +941,9 @@ | ||
| 896 | 941 | $current_metadata = $this->get_metadata($id); |
| 897 | 942 | foreach ($current_metadata as $meta_id => &$meta_row) { |
| 898 | 943 | $meta_row['chart_id'] = $new_id; |
| 899 | 944 | array_shift($meta_row); |
| 900 | - $result = $wpdb->insert( | |
| 945 | + $result = $wpdb->insert(// phpcs:ignore | |
| 901 | 946 | $this->db_table_meta, |
| 902 | 947 | $meta_row, |
| 903 | 948 | array( '%s', '%s', '%s', '%s' ) |
| 904 | 949 | ); |
| @@ -926,12 +971,18 @@ | ||
| 926 | 971 | if( is_null( $id ) ){ |
| 927 | 972 | return array(); |
| 928 | 973 | } |
| 929 | 974 | |
| 930 | - $sql = "SELECT * FROM " . $this->db_table_meta . " WHERE chart_id = " . $id; | |
| 975 | + $results = $wpdb->get_results(// phpcs:ignore | |
| 976 | + $wpdb->prepare( | |
| 977 | + "SELECT * | |
| 978 | + FROM {$this->db_table_meta} | |
| 979 | + WHERE chart_id = %d", | |
| 980 | + $id | |
| 981 | + ), | |
| 982 | + ARRAY_A | |
| 983 | + ); | |
| 931 | 984 | |
| 932 | - $results = $wpdb->get_results($sql, ARRAY_A); | |
| 933 | - | |
| 934 | 985 | if( count( $results ) > 0 ){ |
| 935 | 986 | return $results; |
| 936 | 987 | }else{ |
| 937 | 988 | return array(); |
| @@ -1014,12 +1065,18 @@ | ||
| 1014 | 1065 | |
| 1015 | 1066 | if( is_null( $meta_key ) || trim( $meta_key ) === '' ){ |
| 1016 | 1067 | return false; |
| 1017 | 1068 | } |
| 1069 | + $result = $wpdb->get_var(// phpcs:ignore | |
| 1070 | + $wpdb->prepare( | |
| 1071 | + "SELECT {$select_value} | |
| 1072 | + FROM {$this->db_table_meta} | |
| 1073 | + WHERE meta_key = %s AND chart_id = %d", | |
| 1074 | + $meta_key, | |
| 1075 | + $id | |
| 1076 | + ) | |
| 1077 | + ); | |
| 1018 | 1078 | |
| 1019 | - $sql = "SELECT ".$select_value." FROM ". $this->db_table_meta ." WHERE meta_key = '".$meta_key."' AND chart_id = '".$id."'"; | |
| 1020 | - $result = $wpdb->get_var($sql); | |
| 1021 | - | |
| 1022 | 1079 | if( $result != "" ){ |
| 1023 | 1080 | return $result; |
| 1024 | 1081 | } |
| 1025 | 1082 | |
| @@ -1050,14 +1107,14 @@ | ||
| 1050 | 1107 | if( is_null( $meta_key ) || trim( $meta_key ) === '' ){ |
| 1051 | 1108 | return false; |
| 1052 | 1109 | } |
| 1053 | 1110 | |
| 1054 | - $result = $wpdb->insert( | |
| 1111 | + $result = $wpdb->insert(// phpcs:ignore | |
| 1055 | 1112 | $this->db_table_meta, |
| 1056 | 1113 | array( |
| 1057 | 1114 | 'chart_id' => absint( $id ), |
| 1058 | - 'meta_key' => $meta_key, | |
| 1059 | - 'meta_value' => $meta_value, | |
| 1115 | + 'meta_key' => $meta_key,// phpcs:ignore | |
| 1116 | + 'meta_value' => $meta_value,// phpcs:ignore | |
| 1060 | 1117 | 'note' => $note, |
| 1061 | 1118 | 'options' => $options |
| 1062 | 1119 | ), |
| 1063 | 1120 | array( '%s', '%s', '%s', '%s' ) |
| @@ -1095,9 +1152,9 @@ | ||
| 1095 | 1152 | return false; |
| 1096 | 1153 | } |
| 1097 | 1154 | |
| 1098 | 1155 | $value = array( |
| 1099 | - 'meta_value' => $meta_value, | |
| 1156 | + 'meta_value' => $meta_value,// phpcs:ignore | |
| 1100 | 1157 | ); |
| 1101 | 1158 | |
| 1102 | 1159 | $value_s = array( '%s' ); |
| 1103 | 1160 | if($note != null){ |
| @@ -1109,14 +1166,14 @@ | ||
| 1109 | 1166 | $value['options'] = $options; |
| 1110 | 1167 | $value_s[] = '%s'; |
| 1111 | 1168 | } |
| 1112 | 1169 | |
| 1113 | - $result = $wpdb->update( | |
| 1170 | + $result = $wpdb->update(// phpcs:ignore | |
| 1114 | 1171 | $this->db_table_meta, |
| 1115 | 1172 | $value, |
| 1116 | 1173 | array( |
| 1117 | 1174 | 'chart_id' => absint( $id ), |
| 1118 | - 'meta_key' => $meta_key, | |
| 1175 | + 'meta_key' => $meta_key,// phpcs:ignore | |
| 1119 | 1176 | ), |
| 1120 | 1177 | $value_s, |
| 1121 | 1178 | array( '%d', '%s' ) |
| 1122 | 1179 | ); |
| @@ -1149,13 +1206,13 @@ | ||
| 1149 | 1206 | if( is_null( $meta_key ) || trim( $meta_key ) === '' ){ |
| 1150 | 1207 | return false; |
| 1151 | 1208 | } |
| 1152 | 1209 | |
| 1153 | - $wpdb->delete( | |
| 1210 | + $wpdb->delete(// phpcs:ignore | |
| 1154 | 1211 | $this->db_table_meta, |
| 1155 | 1212 | array( |
| 1156 | 1213 | 'chart_id' => absint( $id ), |
| 1157 | - 'meta_key' => $meta_key, | |
| 1214 | + 'meta_key' => $meta_key,// phpcs:ignore | |
| 1158 | 1215 | ), |
| 1159 | 1216 | array( '%d', '%s' ) |
| 1160 | 1217 | ); |
| 1161 | 1218 | |
| @@ -1186,13 +1243,13 @@ | ||
| 1186 | 1243 | * |
| 1187 | 1244 | * @return void|html |
| 1188 | 1245 | */ |
| 1189 | 1246 | public function chart_notices(){ |
| 1190 | - $page = (isset($_REQUEST['page'])) ? sanitize_text_field( $_REQUEST['page'] ) : ''; | |
| 1247 | + $page = (isset($_REQUEST['page'])) ? sanitize_text_field( wp_unslash( $_REQUEST['page'] )) : ''; | |
| 1191 | 1248 | if ( !($page == "chart-builder") ) |
| 1192 | 1249 | return; |
| 1193 | 1250 | |
| 1194 | - $status = (isset($_REQUEST['status'])) ? sanitize_text_field( $_REQUEST['status'] ) : ''; | |
| 1251 | + $status = (isset($_REQUEST['status'])) ? sanitize_text_field( wp_unslash( $_REQUEST['status'] )) : ''; | |
| 1195 | 1252 | |
| 1196 | 1253 | if ( empty( $status ) ) |
| 1197 | 1254 | return; |
| 1198 | 1255 | |
