← All changes | database/Migrations/PersonsMigrator.php +15 -20 1.10.4 → 2.4.5 View file →

		@@ -12,9 +12,9 @@
12	12	$charsetCollate = $wpdb->get_charset_collate();
13	13
14	14	$table = $wpdb->prefix . static::$tableName;
15	15
16		- if ($wpdb->get_var("SHOW TABLES LIKE '$table'") != $table) {
	16	+ if ($wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $table)) != $table) {
17	17	$sql = "CREATE TABLE $table (
18	18	`id` BIGINT(20) UNSIGNED NOT NULL PRIMARY KEY AUTO_INCREMENT,
19	19	`first_name` VARCHAR(192) NULL,
20	20	`last_name` VARCHAR(192) NULL,
		@@ -51,9 +51,9 @@
51	51
52	52	return false;
53	53	}
54	54
55		- public static function alterTable($table)
	55	+ public static function alterTable($table)
56	56	{
57	57	static::addMissingColumns($table);
58	58	static::addMissingIndexes($table);
59	59	}
		@@ -61,24 +61,22 @@
61	61	public static function addMissingColumns($table)
62	62	{
63	63	global $wpdb;
64	64
65		- // Escape table name
	65	+ // Our own table name, not user input. esc_sql() because %i needs WP 6.2+.
66	66	$table = esc_sql($table);
67	67
68		- // Get existing columns
69		- $existing_columns = $wpdb->get_col("DESC `$table`", 0);
	68	+ $existing_columns = $wpdb->get_col("DESC `{$table}`", 0); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
70	69
71		- // @todo: We will remove this on final release
72		- // This is only for beta users
	70	+ // @todo: Beta-only migration, remove on final release.
73	71	if (!in_array('title', $existing_columns)) {
74		- $query = 'ALTER TABLE `' . $table . '` ADD `title` VARCHAR(192) NULL AFTER `email`';
75		- $wpdb->query($query);
	72	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- $table is sanitized via esc_sql(); column name is a hardcoded literal.
	73	+ $wpdb->query("ALTER TABLE `{$table}` ADD `title` VARCHAR(192) NULL AFTER `email`");
76	74	}
77	75
78	76	if (!in_array('description', $existing_columns)) {
79		- $query = 'ALTER TABLE `' . $table . '` ADD `description` MEDIUMTEXT NULL AFTER `user_id`';
80		- $wpdb->query($query);
	77	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- $table is sanitized via esc_sql(); column name is a hardcoded literal.
	78	+ $wpdb->query("ALTER TABLE `{$table}` ADD `description` MEDIUMTEXT NULL AFTER `user_id`");
81	79	}
82	80	}
83	81
84	82	public static function addMissingIndexes($table)
		@@ -84,13 +82,12 @@
84	82	public static function addMissingIndexes($table)
85	83	{
86	84	global $wpdb;
87	85
88		- // Escape table name
	86	+ // Our own table name, not user input. esc_sql() because %i needs WP 6.2+.
89	87	$table = esc_sql($table);
90	88
91		- // Get existing indexes
92		- $existing_indexes = $wpdb->get_results("SHOW INDEX FROM `$table`");
	89	+ $existing_indexes = $wpdb->get_results("SHOW INDEX FROM `{$table}`"); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
93	90	$existing_index_names = [];
94	91
95	92	foreach ($existing_indexes as $index) {
96	93	$existing_index_names[] = $index->Key_name;
		@@ -95,20 +92,18 @@
95	92	foreach ($existing_indexes as $index) {
96	93	$existing_index_names[] = $index->Key_name;
97	94	}
98	95
99		- // Desired indexes
100	96	$indexes = [
101		- 'idx_email' => 'email',
102		- 'idx_user_id' => 'user_id',
	97	+ 'idx_email' => 'email',
	98	+ 'idx_user_id' => 'user_id',
103	99	'idx_ip_address' => 'ip_address',
104	100	];
105	101
106		- // Add missing indexes
107	102	foreach ($indexes as $index_name => $column_name) {
108	103	if (!in_array($index_name, $existing_index_names)) {
109		- $sql = "ALTER TABLE `$table` ADD INDEX `$index_name` (`$column_name`)";
110		- $wpdb->query($sql);
	104	+ // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- all identifiers are either esc_sql()'d or hardcoded literals.
	105	+ $wpdb->query("ALTER TABLE `{$table}` ADD INDEX `{$index_name}` (`{$column_name}`)");
111	106	}
112	107	}
113	108	}
114	109	}