← All changes | classes/Admin/ListTable.php +28 -58 trunk → 6.0 View file →

		@@ -31,22 +31,18 @@
31	31	$this->process_bulk_action();
32	32	}
33	33
34	34	public function column_default( $item, $column_name ) {
35		- return $item[ $column_name ];
	35	+ return $item[ $column_name ];
36	36	}
37	37
38		- // phpcs:disable WordPress.Security.NonceVerification.Recommended
39	38	public function search_box( $text, $input_id ): void {
40	39	$input_id .= '-search-input';
41	40	if ( ! empty( $_REQUEST['orderby'] ) ) {
42		- $orderby = sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) );
43		- echo '<input type="hidden" name="orderby" value="' . esc_attr( $orderby ) . '" />';
	41	+ echo '<input type="hidden" name="orderby" value="' . esc_attr( $_REQUEST['orderby'] ) . '" />';
44	42	}
45		-
46	43	if ( ! empty( $_REQUEST['order'] ) ) {
47		- $order = sanitize_text_field( wp_unslash( $_REQUEST['order'] ) );
48		- echo '<input type="hidden" name="order" value="' . esc_attr( $order ) . '" />';
	44	+ echo '<input type="hidden" name="order" value="' . esc_attr( $_REQUEST['order'] ) . '" />';
49	45	}
50	46	?>
51	47	<p class="search-box">
52	48	<label class="screen-reader-text" for="<?php echo esc_attr( $input_id ) ?>">
		@@ -58,10 +54,8 @@
58	54	</p>
59	55	<?php
60	56	}
61	57
62		- // phpcs:enable
63		-
64	58	public function column_title( $item ): string {
65	59	$title = ! empty( $item['title'] ) ? $item['title'] : __( 'Untitled', 'float-menu' );
66	60	$param = DBManager::get_param_id( $item['ID'] );
67	61	$actions = [
		@@ -181,14 +175,9 @@
181	175	$link = add_query_arg( [ 'id' => $value->id ], $main_link );
182	176	$data[] = array(
183	177	'ID' => $value->id,
184	178	'title' => '<a href="' . esc_url( $link ) . '">' . esc_attr( $title ) . '</a>',
185		- 'code' => '<div class="wpie-field">
186		- <label class="wpie-field__label has-icon">
187		- <span class="has-tooltip is-pointer on-right can-copy" data-tooltip="Copy"><span class="dashicons dashicons-shortcode is-pointer" ></span></span>
188		- <input type="text" value="[' . esc_attr( $shortcode ) . ' id=\'' . absint( $value->id ) . '\']" readonly>
189		- </label>
190		- </div>',
	179	+ 'code' => '<input type="text" value="[' . esc_attr( $shortcode ) . ' id=\'' . absint( $value->id ) . '\']" readonly>',
191	180	'tag' => $tag,
192	181	'mode' => $mode,
193	182	'status' => $status,
194	183	);
		@@ -201,21 +190,13 @@
201	190	return sprintf( '<input type="checkbox" name="%1$s[]" value="%2$s" />', 'ID', $item['ID'] );
202	191	}
203	192
204	193	public function get_paged(): int {
205		- return isset( $_GET['paged'] ) ? absint( $_GET['paged'] ) : 1; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
	194	+ return isset( $_GET['paged'] ) ? absint( $_GET['paged'] ) : 1;
206	195	}
207	196
208	197	public function get_search() {
209		- $verify = AdminActions::verify( WOWP_Plugin::PREFIX . '_list_action' );
210		-
211		- if ( ! $verify ) {
212		- return false;
213		- }
214		-
215		- // phpcs:disable WordPress.Security.NonceVerification.Missing -- Nonce verification is handled elsewhere.
216		- return ! empty( $_POST['s'] ) ? urldecode( trim( sanitize_text_field( wp_unslash( $_POST['s'] ) ) ) ) : false;
217		- // phpcs:enable
	198	+ return ! empty( $_POST['s'] ) ? urldecode( trim( $_POST['s'] ) ) : false;
218	199	}
219	200
220	201	public function list_count(): int {
221	202	$result = $this->get_results();
		@@ -232,41 +213,33 @@
232	213	global $wpdb;
233	214
234	215	$search = $this->get_search();
235	216
236		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
237		- $tag_search = ( ! empty( $_REQUEST['tag'] ) ) ? sanitize_text_field( wp_unslash( $_REQUEST ['tag'] ) ) : '';
	217	+ $tag_search = ( ! empty( $_REQUEST['tag'] ) ) ? sanitize_text_field( $_REQUEST ['tag'] ) : '';
238	218	$tag_search = ( $tag_search === 'all' ) ? '' : $tag_search;
239	219
240	220
241	221	$result = '';
242	222
243		- $table = esc_sql($wpdb->prefix . WOWP_Plugin::PREFIX);
	223	+ $table = $wpdb->prefix . WOWP_Plugin::PREFIX;
244	224
245		- // Table name is sanitized elsewhere.
246	225	if ( empty( $search ) ) {
247		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
248	226	$result = $wpdb->get_results( "SELECT * FROM {$table} ORDER BY id DESC" );
249	227	if ( ! empty( $tag_search ) ) {
250		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
251	228	$result = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$table} WHERE tag=%s ORDER BY id DESC",
252	229	$tag_search ) );
253	230	}
254	231	} elseif ( trim( $search ) === 'UnTitle' ) {
255		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
256	232	$result = $wpdb->get_results( "SELECT * FROM {$table} WHERE title='' ORDER BY id DESC" );
257	233	if ( ! empty( $tag_search ) ) {
258		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
259	234	$result = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$table} WHERE title='' AND tag=%s ORDER BY id DESC",
260	235	$tag_search ) );
261	236	}
262	237	} elseif ( is_numeric( $search ) ) {
263	238	if ( ! empty( $tag_search ) ) {
264		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
265	239	$result = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$table} WHERE id=%d AND tag=%s ORDER BY id DESC",
266	240	absint( $search ), $tag_search ) );
267	241	} else {
268		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
269	242	$result = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$table} WHERE id=%d ORDER BY id DESC",
270	243	absint( $search ) ) );
271	244	}
272	245	} else {
		@@ -273,13 +246,11 @@
273	246	$wild = '%';
274	247	$find = sanitize_text_field( $search );
275	248	$like = $wild . $wpdb->esc_like( $find ) . $wild;
276	249	if ( ! empty( $tag_search ) ) {
277		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
278	250	$result = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$table} WHERE title LIKE %s AND tag=%s ORDER BY id DESC",
279	251	$like, $tag_search ) );
280	252	} else {
281		- // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
282	253	$result = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$table} WHERE title LIKE %s ORDER BY id DESC",
283	254	$like ) );
284	255	}
285	256	}
		@@ -289,9 +260,9 @@
289	260
290	261
291	262	public function get_bulk_actions(): array {
292	263	$actions = [
293		- 'delete' => __( 'Delete', 'float-menu' ),
	264	+ 'delete' => __( 'Delate', 'float-menu' ),
294	265	'activate' => __( 'Activate', 'float-menu' ),
295	266	'deactivate' => __( 'Deactivate', 'float-menu' ),
296	267	'test_on' => __( 'Test mode ON', 'float-menu' ),
297	268	'test_off' => __( 'Test mode OFF', 'float-menu' ),
		@@ -300,14 +271,8 @@
300	271	return $actions;
301	272	}
302	273
303	274	public function process_bulk_action() {
304		- $verify = AdminActions::verify( WOWP_Plugin::PREFIX . '_list_action' );
305		-
306		- if ( ! $verify ) {
307		- return false;
308		- }
309		- // phpcs:ignore WordPress.Security.NonceVerification.Missing
310	275	$ids = isset( $_POST['ID'] ) ? ( map_deep( $_POST['ID'], 'absint' ) ) : false;
311	276	$action = $this->current_action();
312	277	if ( ! is_array( $ids ) ) {
313	278	$ids = [ $ids ];
		@@ -315,8 +280,14 @@
315	280	if ( empty( $action ) ) {
316	281	return false;
317	282	}
318	283
	284	+ $verify = $this->verify();
	285	+
	286	+ if ( ! $verify ) {
	287	+ return false;
	288	+ }
	289	+
319	290	foreach ( $ids as $id ) {
320	291	if ( 'delete' === $this->current_action() ) {
321	292	DBManager::delete( $id );
322	293	}
		@@ -338,10 +309,9 @@
338	309	protected function extra_tablenav( $which ): void {
339	310	if ( 'top' === $which ) {
340	311	$tags = DBManager::get_tags_from_table();
341	312
342		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
343		- $tag_search = ( ! empty( $_REQUEST['tag'] ) ) ? sanitize_text_field( wp_unslash( $_REQUEST['tag'] ) ) : '';
	313	+ $tag_search = ( ! empty( $_REQUEST['tag'] ) ) ? sanitize_text_field( $_REQUEST ['tag'] ) : '';
344	314	$tag_search = ( $tag_search === 'all' ) ? '' : $tag_search;
345	315
346	316	echo '<div class="alignleft actions"><label for="filter-by-tag" class="screen-reader-text">' . esc_html__( 'Filter by tag',
347	317	'float-menu' ) . '</label>';
		@@ -364,24 +334,24 @@
364	334	}
365	335	}
366	336
367	337	private function sort_data( $a, $b ): int {
368		- // If no sort, default to ID
369		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
370		- $orderby = ( ! empty( $_GET['orderby'] ) ) ? sanitize_text_field( wp_unslash($_GET['orderby']) ) : 'ID';
371		-
372		- // Only allow columns that are actually declared as sortable.
373		- if ( ! array_key_exists( $orderby, $this->get_sortable_columns() ) ) {
374		- $orderby = 'ID';
375		- }
376		-
	338	+ // If no sort, default to title
	339	+ $orderby = ( ! empty( $_GET['orderby'] ) ) ? sanitize_text_field( $_GET['orderby'] ) : 'ID';
377	340	// If no order, default to asc
378		- // phpcs:ignore WordPress.Security.NonceVerification.Recommended
379		- $order = ( ! empty( $_GET['order'] ) ) ? sanitize_text_field( wp_unslash($_GET['order']) ) : 'desc';
	341	+ $order = ( ! empty( $_GET['order'] ) ) ? sanitize_text_field( $_GET['order'] ) : 'desc';
380	342	// Determine sort order
381		- $result = strnatcmp( (string) ( $a[ $orderby ] ?? '' ), (string) ( $b[ $orderby ] ?? '' ) );
	343	+ $result = strnatcmp( $a[ $orderby ], $b[ $orderby ] );
382	344
383	345	// Send final sort direction to usort
384	346	return ( $order === 'asc' ) ? $result : - $result;
	347	+ }
	348	+
	349	+ private function verify(): bool {
	350	+ $name = WOWP_Plugin::PREFIX . '_list_action';
	351	+ $nonce_action = WOWP_Plugin::PREFIX . '_nonce';
	352	+
	353	+ return ! ( ! isset( $_POST[ $name ] ) || ! wp_verify_nonce( $_POST[ $name ],
	354	+ $nonce_action ) || ! current_user_can( 'manage_options' ) );
385	355	}
386	356
387	357	}