← All changes | database/Migrations/MetaMigrator.php +21 -13 1.10.4 → 2.4.5 View file →

		@@ -13,9 +13,9 @@
13	13	$charsetCollate = $wpdb->get_charset_collate();
14	14
15	15	$table = $wpdb->prefix . static::$tableName;
16	16
17		- if ($wpdb->get_var("SHOW TABLES LIKE '$table'") != $table) {
	17	+ if ($wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $table)) != $table) {
18	18	$sql = "CREATE TABLE $table (
19	19	`id` BIGINT(20) UNSIGNED NOT NULL PRIMARY KEY AUTO_INCREMENT,
20	20	`object_type` VARCHAR(192) NULL,
21	21	`object_id` BIGINT(20) NULL,
		@@ -24,9 +24,10 @@
24	24	`created_at` TIMESTAMP NULL,
25	25	`updated_at` TIMESTAMP NULL,
26	26	INDEX `idx_object_type` (`object_type`),
27	27	INDEX `idx_object_id` (`object_id`),
28		- INDEX `idx_key` (`key`)
	28	+ INDEX `idx_key` (`key`),
	29	+ INDEX `idx_object_type_created_at` (`object_type`, `created_at`)
29	30	) $charsetCollate;";
30	31	$created = dbDelta($sql);
31	32	return $created;
32	33	} else {
		@@ -35,9 +36,9 @@
35	36
36	37	return false;
37	38	}
38	39
39		- public static function alterTable($table)
	40	+ public static function alterTable($table)
40	41	{
41	42	static::addMissingIndexes($table);
42	43	}
43	44
		@@ -44,13 +45,15 @@
44	45	public static function addMissingIndexes($table)
45	46	{
46	47	global $wpdb;
47	48
48		- // Escape table name
	49	+ // $table is always $wpdb->prefix . 'fs_meta' — not user input.
	50	+ // esc_sql() is the correct escaping for SQL identifiers; $wpdb->prepare()
	51	+ // cannot quote identifiers in WP < 6.2 (no %i placeholder available).
49	52	$table = esc_sql($table);
50	53
51	54	// Get existing indexes
52		- $existing_indexes = $wpdb->get_results("SHOW INDEX FROM `$table`");
	55	+ $existing_indexes = $wpdb->get_results("SHOW INDEX FROM `{$table}`"); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
53	56	$existing_index_names = [];
54	57
55	58	foreach ($existing_indexes as $index) {
56	59	$existing_index_names[] = $index->Key_name;
		@@ -55,20 +58,25 @@
55	58	foreach ($existing_indexes as $index) {
56	59	$existing_index_names[] = $index->Key_name;
57	60	}
58	61
59		- // Desired indexes
	62	+ // Desired indexes — keys and values are all hardcoded string literals.
60	63	$indexes = [
61		- 'idx_object_type' => 'object_type',
62		- 'idx_object_id' => 'object_id',
63		- 'idx_key' => 'key',
	64	+ 'idx_object_type' => ['object_type'],
	65	+ 'idx_object_id' => ['object_id'],
	66	+ 'idx_key' => ['key'],
	67	+ // Serves CleanupHandler::cleanExpiredAuthChallenges(), which purges
	68	+ // rows by object_type + created_at on every hourly cron run.
	69	+ 'idx_object_type_created_at' => ['object_type', 'created_at'],
64	70	];
65	71
66		- // Add missing indexes
67		- foreach ($indexes as $index_name => $column_name) {
	72	+ // Add missing indexes. $table is esc_sql()'d above; $index_name and
	73	+ // $columns are hardcoded array literals — no user input reaches this query.
	74	+ foreach ($indexes as $index_name => $columns) {
68	75	if (!in_array($index_name, $existing_index_names)) {
69		- $sql = "ALTER TABLE `$table` ADD INDEX `$index_name` (`$column_name`)";
70		- $wpdb->query($sql);
	76	+ $columnList = '`' . implode('`, `', $columns) . '`';
	77	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- all identifiers are either esc_sql()'d or hardcoded literals.
	78	+ $wpdb->query("ALTER TABLE `{$table}` ADD INDEX `{$index_name}` ({$columnList})");
71	79	}
72	80	}
73	81	}
74	82	}