← All changes | includes/class-response-list.php +14 -15 8.7.5 → 8.0.0 View file →

		@@ -1,6 +1,5 @@
1	1	<?php
2		-if (!defined('ABSPATH')) exit; // Exit if accessed directly
3	2	if ( ! class_exists( 'WP_List_Table' ) ) {
4	3	require_once( ABSPATH . 'wp-admin/includes/class-wp-list-table.php' );
5	4	}
6	5
		@@ -40,15 +39,15 @@
40	39	// Allow sorting by column and order if provided and valid
41	40	if ( ! empty( $_REQUEST['orderby'] ) ) {
42	41	// Whitelist allowed columns to prevent SQL injection
43	42	$allowed = array( 'id', 'intent', 'response', 'type' );
44		- $orderby_request = esc_sql( wp_unslash($_REQUEST['orderby']) );
	43	+ $orderby_request = esc_sql( $_REQUEST['orderby'] );
45	44	if ( in_array( $orderby_request, $allowed ) ) {
46	45	$orderby = $orderby_request;
47	46	}
48	47	}
49	48	if ( ! empty( $_REQUEST['order'] ) ) {
50		- $order_request = strtoupper( esc_sql( wp_unslash($_REQUEST['order']) ) );
	49	+ $order_request = strtoupper( esc_sql( $_REQUEST['order'] ) );
51	50	if ( in_array( $order_request, array( 'ASC', 'DESC' ) ) ) {
52	51	$order = $order_request;
53	52	}
54	53	}
		@@ -61,9 +60,9 @@
61	60	$per_page,
62	61	$offset
63	62	);
64	63
65		- $result = $wpdb->get_results( $sql, 'ARRAY_A' ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared, PluginCheck.Security.DirectDB.UnescapedDBParameter
	64	+ $result = $wpdb->get_results( $sql, 'ARRAY_A' ); //DB Call OK, No Caching OK
66	65
67	66	return $result;
68	67	}
69	68
		@@ -75,13 +74,13 @@
75	74	*/
76	75	public static function delete_response( $id ) {
77	76	global $wpdb;
78	77
79		- $wpdb->delete( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	78	+ $wpdb->delete(
80	79	"{$wpdb->prefix}wpbot_response",
81	80	[ 'id' => $id ],
82	81	[ '%d' ]
83		- );
	82	+ ); //DB Call OK, No Caching OK
84	83
85	84	}
86	85
87	86
		@@ -94,9 +93,9 @@
94	93	global $wpdb;
95	94
96	95	$sql = "SELECT COUNT(*) FROM {$wpdb->prefix}wpbot_response";
97	96
98		- return $wpdb->get_var( $sql ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	97	+ return $wpdb->get_var( $sql ); //DB Call OK, No Caching OK
99	98	}
100	99
101	100
102	101	/** Text displayed when no customer data is available */
		@@ -175,10 +174,10 @@
175	174
176	175	$title = '<strong>' . $item['query'] . '</strong>';
177	176	// var_dump($title);
178	177	$actions = [
179		- 'edit' => sprintf( '<a href="?page=%s&action=%s&query=%s&_wpnonce=%s">Edit</a>', esc_attr(wp_unslash($_REQUEST['page'])), 'edit', absint( $item['id'] ), $edit_nonce ),
180		- 'delete' => sprintf( '<a href="?page=%s&action=%s&query=%s&_wpnonce=%s">Delete</a>', esc_attr(wp_unslash($_REQUEST['page'])), 'delete', absint( $item['id'] ), $delete_nonce )
	178	+ 'edit' => sprintf( '<a href="?page=%s&action=%s&query=%s&_wpnonce=%s">Edit</a>', esc_attr( $_REQUEST['page'] ), 'edit', absint( $item['id'] ), $edit_nonce ),
	179	+ 'delete' => sprintf( '<a href="?page=%s&action=%s&query=%s&_wpnonce=%s">Delete</a>', esc_attr( $_REQUEST['page'] ), 'delete', absint( $item['id'] ), $delete_nonce )
181	180	];
182	181
183	182	return $title . $this->row_actions( $actions );
184	183	}
		@@ -277,15 +276,15 @@
277	276	//Detect when a bulk action is being triggered...
278	277	if ( 'delete' === $this->current_action() ) {
279	278
280	279	// In our file that handles the request, verify the nonce.
281		- $nonce = esc_attr(wp_unslash($_REQUEST['_wpnonce']));
	280	+ $nonce = esc_attr( $_REQUEST['_wpnonce'] );
282	281
283	282	if ( ! wp_verify_nonce( $nonce, 'wp_delete_query' ) ) {
284	283	die( 'Go get a life script kiddies' );
285	284	}
286	285	else {
287		- self::delete_response( absint( wp_unslash($_GET['query']) ) );
	286	+ self::delete_response( absint( $_GET['query'] ) );
288	287
289	288	// esc_url_raw() is used to prevent converting ampersand in url to "#038;"
290	289	// add_query_arg() return the current url
291	290	//wp_redirect( esc_url_raw($this->chatbot_admin_page) );
		@@ -294,13 +293,13 @@
294	293
295	294	}
296	295
297	296	// If the delete bulk action is triggered
298		- if ( ( isset($_POST['action']) && wp_unslash($_POST['action']) == 'bulk-delete' )
299		- || ( isset($_POST['action2']) && wp_unslash($_POST['action2']) == 'bulk-delete' )
	297	+ if ( ( isset( $_POST['action'] ) && $_POST['action'] == 'bulk-delete' )
	298	+ || ( isset( $_POST['action2'] ) && $_POST['action2'] == 'bulk-delete' )
300	299	) {
301	300
302		- $delete_ids = esc_sql( wp_unslash($_POST['bulk-delete']) );
	301	+ $delete_ids = esc_sql( $_POST['bulk-delete'] );
303	302
304	303
305	304	// loop over the array of record IDs and delete them
306	305	foreach ( $delete_ids as $id ) {
		@@ -309,10 +308,10 @@
309	308	}
310	309
311	310	// esc_url_raw() is used to prevent converting ampersand in url to "#038;"
312	311	// add_query_arg() return the current url
313		- wp_safe_redirect( esc_url_raw($this->chatbot_admin_page) );
	312	+ wp_redirect( esc_url_raw($this->chatbot_admin_page) );
314	313	exit;
315	314	}
316	315	}
317	316
318	317	}