← All changes | database/Migrations/MailBoxMigrator.php +14 -11 1.10.2 → 2.4.5 View file →

		@@ -13,9 +13,9 @@
13	13	$charsetCollate = $wpdb->get_charset_collate();
14	14
15	15	$table = $wpdb->prefix . static::$tableName;
16	16
17		- if ($wpdb->get_var("SHOW TABLES LIKE '$table'") != $table) {
	17	+ if ($wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $table)) != $table) {
18	18	$sql = "CREATE TABLE $table (
19	19	`id` BIGINT(20) UNSIGNED NOT NULL PRIMARY KEY AUTO_INCREMENT,
20	20	`name` VARCHAR(192) NOT NULL,
21	21	`slug` VARCHAR(192) NOT NULL,
		@@ -42,9 +42,9 @@
42	42
43	43	return false;
44	44	}
45	45
46		- public static function alterTable($table)
	46	+ public static function alterTable($table)
47	47	{
48	48	static::addMissingIndexes($table);
49	49	}
50	50
		@@ -51,13 +51,15 @@
51	51	public static function addMissingIndexes($table)
52	52	{
53	53	global $wpdb;
54	54
55		- // Escape table name
	55	+ // $table is always $wpdb->prefix . 'fs_mail_boxes' — not user input.
	56	+ // esc_sql() is the correct escaping for SQL identifiers; $wpdb->prepare()
	57	+ // cannot quote identifiers in WP < 6.2 (no %i placeholder available).
56	58	$table = esc_sql($table);
57	59
58	60	// Get existing indexes
59		- $existing_indexes = $wpdb->get_results("SHOW INDEX FROM `$table`");
	61	+ $existing_indexes = $wpdb->get_results("SHOW INDEX FROM `{$table}`"); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
60	62	$existing_index_names = [];
61	63
62	64	foreach ($existing_indexes as $index) {
63	65	$existing_index_names[] = $index->Key_name;
		@@ -62,21 +64,22 @@
62	64	foreach ($existing_indexes as $index) {
63	65	$existing_index_names[] = $index->Key_name;
64	66	}
65	67
66		- // Desired indexes
	68	+ // Desired indexes — keys and values are all hardcoded string literals.
67	69	$indexes = [
68		- 'idx_slug' => 'slug',
69		- 'idx_email' => 'email',
	70	+ 'idx_slug' => 'slug',
	71	+ 'idx_email' => 'email',
70	72	'idx_created_by' => 'created_by',
71		- 'idx_box_type' => 'box_type',
	73	+ 'idx_box_type' => 'box_type',
72	74	];
73	75
74		- // Add missing indexes
	76	+ // Add missing indexes. $table is esc_sql()'d above; $index_name and
	77	+ // $column_name are hardcoded array literals — no user input reaches this query.
75	78	foreach ($indexes as $index_name => $column_name) {
76	79	if (!in_array($index_name, $existing_index_names)) {
77		- $sql = "ALTER TABLE `$table` ADD INDEX `$index_name` (`$column_name`)";
78		- $wpdb->query($sql);
	80	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- all identifiers are either esc_sql()'d or hardcoded literals.
	81	+ $wpdb->query("ALTER TABLE `{$table}` ADD INDEX `{$index_name}` (`{$column_name}`)");
79	82	}
80	83	}
81	84	}
82	85	}