← All changes | database/Migrations/AIActivityLogsMigrator.php +14 -10 1.10.0 → 2.4.5 View file →

		@@ -2,8 +2,9 @@
2	2
3	3	namespace FluentSupport\Database\Migrations;
4	4
5	5	require_once(ABSPATH . 'wp-admin/includes/upgrade.php');
	6	+
6	7	class AIActivityLogsMigrator
7	8	{
8	9	static $tableName = 'fs_ai_activity_logs';
9	10
		@@ -14,9 +15,9 @@
14	15	$charsetCollate = $wpdb->get_charset_collate();
15	16
16	17	$table = $wpdb->prefix . static::$tableName;
17	18
18		- if ($wpdb->get_var("SHOW TABLES LIKE '$table'") != $table) {
	19	+ if ($wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $table)) != $table) {
19	20	$sql = "CREATE TABLE $table (
20	21	`id` BIGINT(20) UNSIGNED NOT NULL PRIMARY KEY AUTO_INCREMENT,
21	22	`agent_id` BIGINT(20) NULL,
22	23	`ticket_id` BIGINT(20) NULL,
		@@ -38,9 +39,9 @@
38	39
39	40	return false;
40	41	}
41	42
42		- public static function alterTable($table)
	43	+ public static function alterTable($table)
43	44	{
44	45	static::addMissingIndexes($table);
45	46	}
46	47
		@@ -47,13 +48,15 @@
47	48	public static function addMissingIndexes($table)
48	49	{
49	50	global $wpdb;
50	51
51		- // Escape table name
	52	+ // $table is always $wpdb->prefix . 'fs_ai_activity_logs' — not user input.
	53	+ // esc_sql() is the correct escaping for SQL identifiers; $wpdb->prepare()
	54	+ // cannot quote identifiers in WP < 6.2 (no %i placeholder available).
52	55	$table = esc_sql($table);
53	56
54	57	// Get existing indexes
55		- $existing_indexes = $wpdb->get_results("SHOW INDEX FROM `$table`");
	58	+ $existing_indexes = $wpdb->get_results("SHOW INDEX FROM `{$table}`"); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
56	59	$existing_index_names = [];
57	60
58	61	foreach ($existing_indexes as $index) {
59	62	$existing_index_names[] = $index->Key_name;
		@@ -58,21 +61,22 @@
58	61	foreach ($existing_indexes as $index) {
59	62	$existing_index_names[] = $index->Key_name;
60	63	}
61	64
62		- // Desired indexes
	65	+ // Desired indexes — keys and values are all hardcoded string literals.
63	66	$indexes = [
64		- 'idx_agent_id' => 'agent_id',
65		- 'idx_ticket_id' => 'ticket_id',
	67	+ 'idx_agent_id' => 'agent_id',
	68	+ 'idx_ticket_id' => 'ticket_id',
66	69	'idx_model_name' => 'model_name',
67	70	'idx_created_at' => 'created_at',
68	71	];
69	72
70		- // Add missing indexes
	73	+ // Add missing indexes. $table is esc_sql()'d above; $index_name and
	74	+ // $column_name are hardcoded array literals — no user input reaches this query.
71	75	foreach ($indexes as $index_name => $column_name) {
72	76	if (!in_array($index_name, $existing_index_names)) {
73		- $sql = "ALTER TABLE `$table` ADD INDEX `$index_name` (`$column_name`)";
74		- $wpdb->query($sql);
	77	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- all identifiers are either esc_sql()'d or hardcoded literals.
	78	+ $wpdb->query("ALTER TABLE `{$table}` ADD INDEX `{$index_name}` (`{$column_name}`)");
75	79	}
76	80	}
77	81	}
78	82	}