← All changes | database/Migrations/ActivityMigrator.php +54 -3 1.5.5 → 2.4.0 View file →

		@@ -13,9 +13,9 @@
13	13	$charsetCollate = $wpdb->get_charset_collate();
14	14
15	15	$table = $wpdb->prefix . static::$tableName;
16	16
17		- if ($wpdb->get_var("SHOW TABLES LIKE '$table'") != $table) {
	17	+ if ($wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $table)) != $table) {
18	18	$sql = "CREATE TABLE $table (
19	19	`id` BIGINT(20) UNSIGNED NOT NULL PRIMARY KEY AUTO_INCREMENT,
20	20	`person_id` BIGINT(20) NULL,
21	21	`person_type` VARCHAR(192) NULL,
		@@ -23,10 +23,61 @@
23	23	`object_id` BIGINT(20) NULL,
24	24	`object_type` VARCHAR(192) NULL,
25	25	`description` MEDIUMTEXT NULL,
26	26	`created_at` TIMESTAMP NULL,
27		- `updated_at` TIMESTAMP NULL
	27	+ `updated_at` TIMESTAMP NULL,
	28	+ INDEX `idx_person_id` (`person_id`),
	29	+ INDEX `idx_event_type` (`event_type`),
	30	+ INDEX `idx_object_id` (`object_id`),
	31	+ INDEX `idx_object_type` (`object_type`),
	32	+ INDEX `idx_created_at` (`created_at`)
28	33	) $charsetCollate;";
29		- dbDelta($sql);
	34	+ $created = dbDelta($sql);
	35	+ return $created;
	36	+ } else {
	37	+ static::alterTable($table);
	38	+ }
	39	+
	40	+ return false;
	41	+ }
	42	+
	43	+ public static function alterTable($table)
	44	+ {
	45	+ static::addMissingIndexes($table);
	46	+ }
	47	+
	48	+ public static function addMissingIndexes($table)
	49	+ {
	50	+ global $wpdb;
	51	+
	52	+ // $table is always $wpdb->prefix . 'fs_activities' — not user input.
	53	+ // esc_sql() is the correct escaping for SQL identifiers; $wpdb->prepare()
	54	+ // cannot quote identifiers in WP < 6.2 (no %i placeholder available).
	55	+ $table = esc_sql($table);
	56	+
	57	+ // Get existing indexes
	58	+ $existing_indexes = $wpdb->get_results("SHOW INDEX FROM `{$table}`"); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	59	+ $existing_index_names = [];
	60	+
	61	+ foreach ($existing_indexes as $index) {
	62	+ $existing_index_names[] = $index->Key_name;
	63	+ }
	64	+
	65	+ // Desired indexes — keys and values are all hardcoded string literals.
	66	+ $indexes = [
	67	+ 'idx_person_id' => 'person_id',
	68	+ 'idx_event_type' => 'event_type',
	69	+ 'idx_object_id' => 'object_id',
	70	+ 'idx_object_type' => 'object_type',
	71	+ 'idx_created_at' => 'created_at',
	72	+ ];
	73	+
	74	+ // Add missing indexes. $table is esc_sql()'d above; $index_name and
	75	+ // $column_name are hardcoded array literals — no user input reaches this query.
	76	+ foreach ($indexes as $index_name => $column_name) {
	77	+ if (!in_array($index_name, $existing_index_names)) {
	78	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- all identifiers are either esc_sql()'d or hardcoded literals.
	79	+ $wpdb->query("ALTER TABLE `{$table}` ADD INDEX `{$index_name}` (`{$column_name}`)");
	80	+ }
30	81	}
31	82	}
32	83	}