← All changes
|
includes/class-chart-builder-settings-db-actions.php
+17
-14
3.1.1
→
3.8.1
View file →
| @@ -82,21 +82,21 @@ | ||
| 82 | 82 | } |
| 83 | 83 | |
| 84 | 84 | public function store_data(){ |
| 85 | 85 | |
| 86 | - if( isset( $_REQUEST["settings_action"] ) && wp_verify_nonce( $_REQUEST["settings_action"], 'settings_action' ) ){ | |
| 86 | + if( isset( $_REQUEST["settings_action"] ) && wp_verify_nonce( sanitize_text_field(wp_unslash($_REQUEST["settings_action"])), 'settings_action' ) ){ | |
| 87 | 87 | $success = 0; |
| 88 | 88 | $name_prefix = 'ays_'; |
| 89 | 89 | |
| 90 | - $user_roles = (isset($_REQUEST['ays_user_roles']) && !empty($_REQUEST['ays_user_roles'])) ? array_map( 'sanitize_text_field', $_REQUEST['ays_user_roles'] ) : array('administrator'); | |
| 90 | + $user_roles = (isset($_REQUEST['ays_user_roles']) && !empty($_REQUEST['ays_user_roles'])) ? array_map( 'sanitize_text_field', wp_unslash($_REQUEST['ays_user_roles']) ) : array('administrator'); | |
| 91 | 91 | |
| 92 | 92 | // User roles to change plugin |
| 93 | - $user_roles_to_change_plugin = (isset($_REQUEST[$name_prefix . 'user_roles_to_change_plugin']) && !empty( $_REQUEST[$name_prefix . 'user_roles_to_change_plugin'] ) ) ? array_map( 'sanitize_text_field', $_REQUEST[$name_prefix . 'user_roles_to_change_plugin'] ) : array('administrator'); | |
| 93 | + $user_roles_to_change_plugin = (isset($_REQUEST[$name_prefix . 'user_roles_to_change_plugin']) && !empty( $_REQUEST[$name_prefix . 'user_roles_to_change_plugin'] ) ) ? array_map( 'sanitize_text_field',wp_unslash( $_REQUEST[$name_prefix . 'user_roles_to_change_plugin'] )) : array('administrator'); | |
| 94 | 94 | |
| 95 | 95 | // // Do not store IP addresses |
| 96 | 96 | // $disable_user_ip = (isset($_REQUEST[$name_prefix . 'chart_disable_user_ip']) && $_REQUEST[$name_prefix . 'chart_disable_user_ip'] == 'on') ? stripslashes( sanitize_text_field( $_REQUEST[$name_prefix . 'chart_disable_user_ip'] ) ) : ''; |
| 97 | 97 | |
| 98 | - $chart_title_length = (isset($_REQUEST[$name_prefix . 'chart_title_length']) && $_REQUEST[$name_prefix . 'chart_title_length'] != '') ? absint( sanitize_text_field( $_REQUEST[$name_prefix . 'chart_title_length'] ) ) : 5; | |
| 98 | + $chart_title_length = (isset($_REQUEST[$name_prefix . 'chart_title_length']) && $_REQUEST[$name_prefix . 'chart_title_length'] != '') ? absint( sanitize_text_field( wp_unslash($_REQUEST[$name_prefix . 'chart_title_length'] )) ) : 5; | |
| 99 | 99 | |
| 100 | 100 | // // Textarea height (public) |
| 101 | 101 | // $textarea_height = (isset($_REQUEST[$name_prefix . 'chart_textarea_height']) && $_REQUEST[$name_prefix . 'chart_textarea_height'] != '' && $_REQUEST[$name_prefix . 'chart_textarea_height'] != 0 ) ? absint( sanitize_text_field($_REQUEST[$name_prefix . 'chart_textarea_height']) ) : 100; |
| 102 | 102 | |
| @@ -131,9 +131,9 @@ | ||
| 131 | 131 | $message = "saved"; |
| 132 | 132 | if($success > 0){ |
| 133 | 133 | $tab = ""; |
| 134 | 134 | if( isset( $_REQUEST['ays_tab'] ) ){ |
| 135 | - $tab = "&ays_tab=". sanitize_text_field( $_REQUEST['ays_tab'] ); | |
| 135 | + $tab = "&ays_tab=". sanitize_text_field( wp_unslash($_REQUEST['ays_tab'] )); | |
| 136 | 136 | } |
| 137 | 137 | |
| 138 | 138 | $url = admin_url('admin.php') . "?page=". $this->plugin_name ."-settings" . $tab . '&status=' . $message; |
| 139 | 139 | wp_redirect( $url ); |
| @@ -177,10 +177,11 @@ | ||
| 177 | 177 | if( is_null( $meta_key ) || trim( $meta_key ) === '' ){ |
| 178 | 178 | return false; |
| 179 | 179 | } |
| 180 | 180 | |
| 181 | - $sql = "SELECT meta_value FROM ". $this->db_table ." WHERE meta_key = '".$meta_key."'"; | |
| 182 | - $result = $wpdb->get_var($sql); | |
| 181 | + $sql = "SELECT meta_value FROM {$this->db_table} WHERE meta_key = %s"; | |
| 182 | + // phpcs:ignore | |
| 183 | + $result = $wpdb->get_var($wpdb->prepare($sql, $meta_key)); | |
| 183 | 184 | |
| 184 | 185 | if($result != ""){ |
| 185 | 186 | return $result; |
| 186 | 187 | } |
| @@ -195,9 +196,9 @@ | ||
| 195 | 196 | return false; |
| 196 | 197 | } |
| 197 | 198 | |
| 198 | 199 | $value = array( |
| 199 | - 'meta_value' => $meta_value, | |
| 200 | + 'meta_value' => $meta_value,// phpcs:ignore | |
| 200 | 201 | ); |
| 201 | 202 | |
| 202 | 203 | $value_s = array( '%s' ); |
| 203 | 204 | if($note != null){ |
| @@ -209,13 +210,13 @@ | ||
| 209 | 210 | $value['options'] = $options; |
| 210 | 211 | $value_s[] = '%s'; |
| 211 | 212 | } |
| 212 | 213 | |
| 213 | - $result = $wpdb->update( | |
| 214 | + $result = $wpdb->update(// phpcs:ignore | |
| 214 | 215 | $this->db_table, |
| 215 | 216 | $value, |
| 216 | 217 | array( |
| 217 | - 'meta_key' => $meta_key, | |
| 218 | + 'meta_key' => $meta_key,// phpcs:ignore | |
| 218 | 219 | ), |
| 219 | 220 | $value_s, |
| 220 | 221 | array( '%s' ) |
| 221 | 222 | ); |
| @@ -227,12 +228,14 @@ | ||
| 227 | 228 | return false; |
| 228 | 229 | } |
| 229 | 230 | |
| 230 | 231 | public function get_listtables_title_length() { |
| 231 | - global $wpdb; | |
| 232 | - | |
| 233 | - $sql = "SELECT meta_value FROM ".$this->db_table." WHERE meta_key = 'options'"; | |
| 234 | - $result = $wpdb->get_var($sql); | |
| 232 | + global $wpdb; | |
| 233 | + | |
| 234 | + $sql = "SELECT meta_value FROM {$this->db_table} WHERE meta_key = %s"; | |
| 235 | + // phpcs:ignore | |
| 236 | + $result = $wpdb->get_var($wpdb->prepare($sql, 'options')); | |
| 237 | + | |
| 235 | 238 | $options = ($result == "") ? array() : json_decode(stripcslashes($result), true); |
| 236 | 239 | |
| 237 | 240 | $listtable_title_length = 5; |
| 238 | 241 | if( !empty($options) ){ |