← All changes | includes/class-response-list.php +33 -48 8.5.6 → 5.4.2 View file →

		@@ -1,6 +1,5 @@
1	1	<?php
2		-if (!defined('ABSPATH')) exit; // Exit if accessed directly
3	2	if ( ! class_exists( 'WP_List_Table' ) ) {
4	3	require_once( ABSPATH . 'wp-admin/includes/class-wp-list-table.php' );
5	4	}
6	5
		@@ -11,10 +10,10 @@
11	10	/** Class constructor */
12	11	public function __construct() {
13	12
14	13	parent::__construct( [
15		- 'singular' => __( 'Response', 'chatbot' ), //singular name of the listed records
16		- 'plural' => __( 'Responses', 'chatbot' ), //plural name of the listed records
	14	+ 'singular' => __( 'Response', 'wpchatbot' ), //singular name of the listed records
	15	+ 'plural' => __( 'Responses', 'wpchatbot' ), //plural name of the listed records
17	16	'ajax' => false //does this table support ajax?
18	17	] );
19	18
20	19	$this->chatbot_admin_page = admin_url('admin.php?page=simple-text-response');
		@@ -30,40 +29,26 @@
30	29	*
31	30	* @return mixed
32	31	*/
33	32	public static function get_responses( $per_page = 5, $page_number = 1 ) {
	33	+
	34	+
34	35	global $wpdb;
35	36
36		- // Default order by and order
37		- $orderby = 'id';
38		- $order = 'DESC';
	37	+ $order = "id";
	38	+ $orderby = " ASC";
39	39
40		- // Allow sorting by column and order if provided and valid
41	40	if ( ! empty( $_REQUEST['orderby'] ) ) {
42		- // Whitelist allowed columns to prevent SQL injection
43		- $allowed = array( 'id', 'intent', 'response', 'type' );
44		- $orderby_request = esc_sql( wp_unslash($_REQUEST['orderby']) );
45		- if ( in_array( $orderby_request, $allowed ) ) {
46		- $orderby = $orderby_request;
47		- }
	41	+ $orderby .= sanitize_sql_orderby('ORDER BY ' . esc_sql( $_REQUEST['orderby'] ));
	42	+ $order .= ! empty( $_REQUEST['order'] ) ? '' . sanitize_sql_orderby(esc_sql( $_REQUEST['order'] )) : ' ASC';
	43	+ var_dump($orderby);
48	44	}
49		- if ( ! empty( $_REQUEST['order'] ) ) {
50		- $order_request = strtoupper( esc_sql( wp_unslash($_REQUEST['order']) ) );
51		- if ( in_array( $order_request, array( 'ASC', 'DESC' ) ) ) {
52		- $order = $order_request;
53		- }
54		- }
55	45
56	46	$offset = ( $page_number - 1 ) * $per_page;
57	47
58		- // Build the SQL query with validated orderby and order
59		- $sql = $wpdb->prepare(
60		- "SELECT * FROM {$wpdb->prefix}wpbot_response ORDER BY $orderby $order LIMIT %d OFFSET %d",
61		- $per_page,
62		- $offset
63		- );
	48	+ $safe_sql = $wpdb->prepare("SELECT * FROM {$wpdb->prefix}wpbot_response ORDER BY %s %s LIMIT %d OFFSET %d", $orderby, $order, $per_page, $offset);
64	49
65		- $result = $wpdb->get_results( $sql, 'ARRAY_A' ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
	50	+ $result = $wpdb->get_results( $safe_sql, 'ARRAY_A' ); //DB Call OK, No Caching OK
66	51
67	52	return $result;
68	53	}
69	54
		@@ -75,13 +60,13 @@
75	60	*/
76	61	public static function delete_response( $id ) {
77	62	global $wpdb;
78	63
79		- $wpdb->delete( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	64	+ $wpdb->delete(
80	65	"{$wpdb->prefix}wpbot_response",
81	66	[ 'id' => $id ],
82	67	[ '%d' ]
83		- );
	68	+ ); //DB Call OK, No Caching OK
84	69
85	70	}
86	71
87	72
		@@ -94,15 +79,15 @@
94	79	global $wpdb;
95	80
96	81	$sql = "SELECT COUNT(*) FROM {$wpdb->prefix}wpbot_response";
97	82
98		- return $wpdb->get_var( $sql ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	83	+ return $wpdb->get_var( $sql ); //DB Call OK, No Caching OK
99	84	}
100	85
101	86
102	87	/** Text displayed when no customer data is available */
103	88	public function no_items() {
104		- esc_html_e( 'No responses avaliable.', 'chatbot' );
	89	+ esc_html_e( 'No responses avaliable.', 'wpchatbot' );
105	90	}
106	91
107	92
108	93	/**
		@@ -173,12 +158,12 @@
173	158	$delete_nonce = wp_create_nonce( 'wp_delete_query' );
174	159	$edit_nonce = wp_create_nonce( 'wp_edit_query' );
175	160
176	161	$title = '<strong>' . $item['query'] . '</strong>';
177		-// var_dump($title);
	162	+
178	163	$actions = [
179		- 'edit' => sprintf( '<a href="?page=%s&action=%s&query=%s&_wpnonce=%s">Edit</a>', esc_attr(wp_unslash($_REQUEST['page'])), 'edit', absint( $item['id'] ), $edit_nonce ),
180		- 'delete' => sprintf( '<a href="?page=%s&action=%s&query=%s&_wpnonce=%s">Delete</a>', esc_attr(wp_unslash($_REQUEST['page'])), 'delete', absint( $item['id'] ), $delete_nonce )
	164	+ 'edit' => sprintf( '<a href="?page=%s&action=%s&query=%s&_wpnonce=%s">Edit</a>', esc_attr( $_REQUEST['page'] ), 'edit', absint( $item['id'] ), $edit_nonce ),
	165	+ 'delete' => sprintf( '<a href="?page=%s&action=%s&query=%s&_wpnonce=%s">Delete</a>', esc_attr( $_REQUEST['page'] ), 'delete', absint( $item['id'] ), $delete_nonce )
181	166	];
182	167
183	168	return $title . $this->row_actions( $actions );
184	169	}
		@@ -194,22 +179,22 @@
194	179
195	180	if(class_exists('Qcld_str_pro')){
196	181	$columns = [
197	182	'cb' => '<input type="checkbox" />',
198		- 'query' => __( 'Query', 'chatbot' ),
199		- 'keyword' => __( 'Keyword', 'chatbot' ),
200		- 'responses' => __( 'Response', 'chatbot' ),
201		- 'intent'=> __( 'Intent', 'chatbot' ),
202		- 'category'=> __( 'Category', 'chatbot' ),
	183	+ 'query' => __( 'Query', 'wpchatbot' ),
	184	+ 'keyword' => __( 'Keyword', 'wpchatbot' ),
	185	+ 'responses' => __( 'Response', 'wpchatbot' ),
	186	+ 'intent'=> __( 'Intent', 'wpchatbot' ),
	187	+ 'category'=> __( 'Category', 'wpchatbot' ),
203	188
204	189	];
205	190	}else{
206	191	$columns = [
207	192	'cb' => '<input type="checkbox" />',
208		- 'query' => __( 'Query', 'chatbot' ),
209		- 'keyword' => __( 'Keyword', 'chatbot' ),
210		- 'responses' => __( 'Response', 'chatbot' ),
211		- 'intent'=> __( 'Intent', 'chatbot' ),
	193	+ 'query' => __( 'Query', 'wpchatbot' ),
	194	+ 'keyword' => __( 'Keyword', 'wpchatbot' ),
	195	+ 'responses' => __( 'Response', 'wpchatbot' ),
	196	+ 'intent'=> __( 'Intent', 'wpchatbot' ),
212	197
213	198	];
214	199	}
215	200
		@@ -277,15 +262,15 @@
277	262	//Detect when a bulk action is being triggered...
278	263	if ( 'delete' === $this->current_action() ) {
279	264
280	265	// In our file that handles the request, verify the nonce.
281		- $nonce = esc_attr(wp_unslash($_REQUEST['_wpnonce']));
	266	+ $nonce = esc_attr( $_REQUEST['_wpnonce'] );
282	267
283	268	if ( ! wp_verify_nonce( $nonce, 'wp_delete_query' ) ) {
284	269	die( 'Go get a life script kiddies' );
285	270	}
286	271	else {
287		- self::delete_response( absint( wp_unslash($_GET['query']) ) );
	272	+ self::delete_response( absint( $_GET['query'] ) );
288	273
289	274	// esc_url_raw() is used to prevent converting ampersand in url to "#038;"
290	275	// add_query_arg() return the current url
291	276	//wp_redirect( esc_url_raw($this->chatbot_admin_page) );
		@@ -294,13 +279,13 @@
294	279
295	280	}
296	281
297	282	// If the delete bulk action is triggered
298		- if ( ( isset($_POST['action']) && wp_unslash($_POST['action']) == 'bulk-delete' )
299		- || ( isset($_POST['action2']) && wp_unslash($_POST['action2']) == 'bulk-delete' )
	283	+ if ( ( isset( $_POST['action'] ) && $_POST['action'] == 'bulk-delete' )
	284	+ || ( isset( $_POST['action2'] ) && $_POST['action2'] == 'bulk-delete' )
300	285	) {
301	286
302		- $delete_ids = esc_sql( wp_unslash($_POST['bulk-delete']) );
	287	+ $delete_ids = esc_sql( $_POST['bulk-delete'] );
303	288
304	289
305	290	// loop over the array of record IDs and delete them
306	291	foreach ( $delete_ids as $id ) {
		@@ -309,10 +294,10 @@
309	294	}
310	295
311	296	// esc_url_raw() is used to prevent converting ampersand in url to "#038;"
312	297	// add_query_arg() return the current url
313		- wp_safe_redirect( esc_url_raw($this->chatbot_admin_page) );
	298	+ wp_redirect( esc_url_raw($this->chatbot_admin_page) );
314	299	exit;
315	300	}
316	301	}
317	302
318	303	}