← All changes | src/component/class-legacy-versions.php +40 -23 5.7.1 → 6.3.0 View file →

		@@ -49,20 +49,38 @@
49	49	*/
50	50	private function find_all_scan_ignored_items( $ids ) {
51	51	global $wpdb;
52	52
53		- if ( is_array( $ids ) && count( $ids ) > 0 ) {
54		- $sql = 'SELECT t0.ID AS id,t0.post_parent AS parentId,t1.meta_value AS type,t2.meta_value AS raw';
55		- $sql .= ' FROM ' . $wpdb->posts . ' AS t0';
56		- $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t1 ON t1.post_id=ID AND t1.meta_key='type'";
57		- $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t2 ON t2.post_id=ID AND t2.meta_key='raw'";
58		- $sql .= " WHERE t0.post_type='wdf_scan_item' AND t0.post_status = 'ignored'";
59		- $sql .= ' AND t0.ID IN (' . implode( ', ', $ids ) . ')';
60		- // SQL is prepared above. so we will ignore prepare warning.
61		- return $wpdb->get_results( $sql, ARRAY_A ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery
	53	+ if ( ! is_array( $ids ) ) {
	54	+ return array();
62	55	}
63	56
64		- return array();
	57	+ $valid_ids = array();
	58	+ foreach ( $ids as $id ) {
	59	+ if ( ! is_int( $id ) && ! ( is_string( $id ) && ctype_digit( $id ) ) ) {
	60	+ continue;
	61	+ }
	62	+
	63	+ $id = filter_var( $id, FILTER_VALIDATE_INT );
	64	+ if ( false !== $id && 0 < $id ) {
	65	+ $valid_ids[ $id ] = $id;
	66	+ }
	67	+ }
	68	+ $ids = array_values( $valid_ids );
	69	+ if ( array() === $ids ) {
	70	+ return array();
	71	+ }
	72	+
	73	+ $placeholders = implode( ', ', array_fill( 0, count( $ids ), '%d' ) );
	74	+ $sql = 'SELECT t0.ID AS id,t0.post_parent AS parentId,t1.meta_value AS type,t2.meta_value AS raw';
	75	+ $sql .= ' FROM ' . $wpdb->posts . ' AS t0';
	76	+ $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t1 ON t1.post_id=ID AND t1.meta_key='type'";
	77	+ $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t2 ON t2.post_id=ID AND t2.meta_key='raw'";
	78	+ $sql .= " WHERE t0.post_type='wdf_scan_item' AND t0.post_status = 'ignored'";
	79	+ $sql .= " AND t0.ID IN ({$placeholders})";
	80	+
	81	+ // SQL is prepared above. so we will ignore prepare warning.
	82	+ return $wpdb->get_results( $wpdb->prepare( $sql, $ids ), ARRAY_A ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery
65	83	}
66	84
67	85	/**
68	86	* Adapts old scan data format to the new format.
		@@ -75,9 +93,9 @@
75	93	$raw = '';
76	94	switch ( $old_data['type'] ) {
77	95	case 'vuln':
78	96	$new_type = Scan_Item::TYPE_VULNERABILITY;
79		- if ( isset( $old_data['raw'] ) && ! empty( $old_data['raw'] ) ) {
	97	+ if ( isset( $old_data['raw'] ) && '' !== $old_data['raw'] ) {
80	98	$raw = maybe_unserialize( $old_data['raw'] );
81	99	/**
82	100	* Different $raw['slug'] values depending on the type:
83	101	* 'type' => 'theme', 'slug' => {THEME_SLUG}, ...
		@@ -103,9 +121,9 @@
103	121	}
104	122	break;
105	123	case 'content':
106	124	$new_type = Scan_Item::TYPE_SUSPICIOUS;
107		- if ( isset( $old_data['raw'] ) && ! empty( $old_data['raw'] ) ) {
	125	+ if ( isset( $old_data['raw'] ) && '' !== $old_data['raw'] ) {
108	126	$raw = maybe_unserialize( $old_data['raw'] );
109	127	$file = is_array( $raw ) && isset( $raw['file'] ) ? $raw['file'] : '';
110	128	} else {
111	129	$file = '';
		@@ -116,9 +134,9 @@
116	134	break;
117	135	case 'core':
118	136	default:
119	137	$new_type = Scan_Item::TYPE_INTEGRITY;
120		- if ( isset( $old_data['raw'] ) && ! empty( $old_data['raw'] ) ) {
	138	+ if ( isset( $old_data['raw'] ) && '' !== $old_data['raw'] ) {
121	139	$raw = maybe_unserialize( $old_data['raw'] );
122	140	$file = is_array( $raw ) && isset( $raw['file'] ) ? $raw['file'] : '';
123	141	} else {
124	142	$file = '';
		@@ -149,9 +167,9 @@
149	167	* @param array $issue_items Array of issue items to save.
150	168	* @param Scan $model Scan model instance to use for saving.
151	169	*/
152	170	private function save_scan_issue_data( $issue_items, $model ) {
153		- if ( empty( $issue_items ) ) {
	171	+ if ( ! is_array( $issue_items ) || array() === $issue_items ) {
154	172	return;
155	173	}
156	174	// Get existed issues.
157	175	$existed_issues = $model->get_issues( null, Scan_Item::STATUS_ACTIVE );
		@@ -157,12 +175,12 @@
157	175	$existed_issues = $model->get_issues( null, Scan_Item::STATUS_ACTIVE );
158	176	$unique_arr = array();
159	177	foreach ( $issue_items as $item ) {
160	178	$data = $this->adapt_scan_data( $item );
161		- if ( empty( $data['file'] ) ) {
	179	+ if ( '' === $data['file'] ) {
162	180	continue;
163	181	}
164		- if ( ! empty( $existed_issues ) ) {
	182	+ if ( is_array( $existed_issues ) && array() !== $existed_issues ) {
165	183	// Scan was started in version > 2.3.2.
166	184	foreach ( $existed_issues as $issue ) {
167	185	if ( Scan_Item::TYPE_VULNERABILITY === $data['type'] ) {
168	186	$file_name = $issue->raw_data['base_slug'] ?? '';
		@@ -192,9 +210,9 @@
192	210	* @param array $ignored_items Array of ignored items to save.
193	211	* @param Scan $model Scan model instance to use for saving.
194	212	*/
195	213	private function save_scan_ignored_data( $ignored_items, $model ) {
196		- if ( empty( $ignored_items ) ) {
	214	+ if ( ! is_array( $ignored_items ) || array() === $ignored_items ) {
197	215	return;
198	216	}
199	217	// Get INDEXER of ignored issues.
200	218	$index_lists = get_site_option( Scan::IGNORE_INDEXER, array() );
		@@ -201,12 +219,12 @@
201	219	// Get existed ignored issues.
202	220	$existed_issues = $model->get_issues( null, Scan_Item::STATUS_IGNORE );
203	221	foreach ( $ignored_items as $item ) {
204	222	$data = $this->adapt_scan_data( $item );
205		- if ( empty( $data['file'] ) ) {
	223	+ if ( '' === $data['file'] ) {
206	224	continue;
207	225	}
208		- if ( ! empty( $existed_issues ) ) {
	226	+ if ( is_array( $existed_issues ) && array() !== $existed_issues ) {
209	227	// Scan was started in version > 2.3.2 .
210	228	foreach ( $existed_issues as $issue ) {
211	229	if ( Scan_Item::TYPE_VULNERABILITY === $data['type'] ) {
212	230	$file_name = $issue->raw_data['base_slug'] ?? '';
		@@ -241,9 +259,8 @@
241	259	*
242	260	* @return array Array of all scan issue data.
243	261	*/
244	262	public function get_scan_issue_data() {
245		-
246	263	return $this->find_all_scan_issue_items();
247	264	}
248	265
249	266	/**
		@@ -327,9 +344,9 @@
327	344	* @param array $ignored_list List of ignored items to remove.
328	345	*/
329	346	public function remove_old_scan_data( $issue_list, $ignored_list ) {
330	347	// Delete the list of scan issues.
331		- if ( ! empty( $issue_list ) ) {
	348	+ if ( is_array( $issue_list ) && array() !== $issue_list ) {
332	349	$parent_post_id = (int) $issue_list[0]['parentId'];
333	350	foreach ( $issue_list as $key => $issue ) {
334	351	// Delete scan items.
335	352	wp_delete_post( (int) $issue['id'] );
		@@ -337,9 +354,9 @@
337	354	// Delete scan.
338	355	wp_delete_post( $parent_post_id );
339	356	}
340	357	// Delete the ignored list.
341		- if ( ! empty( $ignored_list ) ) {
	358	+ if ( is_array( $ignored_list ) && array() !== $ignored_list ) {
342	359	$parent_post_id = (int) $ignored_list[0]['parentId'];
343	360	foreach ( $ignored_list as $key => $item ) {
344	361	// Delete scan items.
345	362	wp_delete_post( (int) $item['id'] );
		@@ -368,9 +385,9 @@
368	385	* @return bool|string Decrypted data or false on failure.
369	386	*/
370	387	private static function decrypt_data_with_pub_key( $encrypt_data, $key ) {
371	388	// This is not obfuscation. Just decode a base64-encoded string.
372		- $str = base64_decode( $encrypt_data ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
	389	+ $str = base64_decode( $encrypt_data, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
373	390	if ( ! $str ) {
374	391	return false;
375	392	}
376	393	$cipher = 'aes-256-cbc';