← All changes | src/component/class-legacy-versions.php +28 -10 6.2.1 → 6.3.0 View file →

		@@ -49,20 +49,38 @@
49	49	*/
50	50	private function find_all_scan_ignored_items( $ids ) {
51	51	global $wpdb;
52	52
53		- if ( is_array( $ids ) && count( $ids ) > 0 ) {
54		- $sql = 'SELECT t0.ID AS id,t0.post_parent AS parentId,t1.meta_value AS type,t2.meta_value AS raw';
55		- $sql .= ' FROM ' . $wpdb->posts . ' AS t0';
56		- $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t1 ON t1.post_id=ID AND t1.meta_key='type'";
57		- $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t2 ON t2.post_id=ID AND t2.meta_key='raw'";
58		- $sql .= " WHERE t0.post_type='wdf_scan_item' AND t0.post_status = 'ignored'";
59		- $sql .= ' AND t0.ID IN (' . implode( ', ', $ids ) . ')';
60		- // SQL is prepared above. so we will ignore prepare warning.
61		- return $wpdb->get_results( $sql, ARRAY_A ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery
	53	+ if ( ! is_array( $ids ) ) {
	54	+ return array();
62	55	}
63	56
64		- return array();
	57	+ $valid_ids = array();
	58	+ foreach ( $ids as $id ) {
	59	+ if ( ! is_int( $id ) && ! ( is_string( $id ) && ctype_digit( $id ) ) ) {
	60	+ continue;
	61	+ }
	62	+
	63	+ $id = filter_var( $id, FILTER_VALIDATE_INT );
	64	+ if ( false !== $id && 0 < $id ) {
	65	+ $valid_ids[ $id ] = $id;
	66	+ }
	67	+ }
	68	+ $ids = array_values( $valid_ids );
	69	+ if ( array() === $ids ) {
	70	+ return array();
	71	+ }
	72	+
	73	+ $placeholders = implode( ', ', array_fill( 0, count( $ids ), '%d' ) );
	74	+ $sql = 'SELECT t0.ID AS id,t0.post_parent AS parentId,t1.meta_value AS type,t2.meta_value AS raw';
	75	+ $sql .= ' FROM ' . $wpdb->posts . ' AS t0';
	76	+ $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t1 ON t1.post_id=ID AND t1.meta_key='type'";
	77	+ $sql .= ' LEFT JOIN ' . $wpdb->postmeta . " as t2 ON t2.post_id=ID AND t2.meta_key='raw'";
	78	+ $sql .= " WHERE t0.post_type='wdf_scan_item' AND t0.post_status = 'ignored'";
	79	+ $sql .= " AND t0.ID IN ({$placeholders})";
	80	+
	81	+ // SQL is prepared above. so we will ignore prepare warning.
	82	+ return $wpdb->get_results( $wpdb->prepare( $sql, $ids ), ARRAY_A ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery
65	83	}
66	84
67	85	/**
68	86	* Adapts old scan data format to the new format.