← All changes | database/Migrations/AttachmentsMigrator.php +3 -11 2.2.1 → 2.4.5 View file →

		@@ -50,15 +50,12 @@
50	50	public static function alterTable($table)
51	51	{
52	52	global $wpdb;
53	53
54		- // $table is always $wpdb->prefix . 'fs_attachments' — not user input.
55		- // esc_sql() is the correct escaping for SQL identifiers; $wpdb->prepare()
56		- // cannot quote identifiers in WP < 6.2 (no %i placeholder available).
	54	+ // Our own table name, not user input. esc_sql() because %i needs WP 6.2+.
57	55	$table = esc_sql($table);
58	56
59		- // @todo: We will remove this on final release
60		- // This is only for beta users
	57	+ // @todo: Beta-only migration, remove on final release.
61	58	$existing_columns = $wpdb->get_col("DESC `{$table}`", 0); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
62	59	if (!in_array('status', $existing_columns)) {
63	60	// phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- $table is sanitized via esc_sql(); column name is a hardcoded literal.
64	61	$wpdb->query("ALTER TABLE `{$table}` ADD `status` VARCHAR(100) NULL DEFAULT 'active' AFTER `driver`");
		@@ -70,13 +67,11 @@
70	67	public static function addMissingIndexes($table)
71	68	{
72	69	global $wpdb;
73	70
74		- // $table is already esc_sql()'d by alterTable(); sanitize again defensively
75		- // in case addMissingIndexes() is ever called directly.
	71	+ // Escaped again in case this is called directly.
76	72	$table = esc_sql($table);
77	73
78		- // Get existing indexes
79	74	$existing_indexes = $wpdb->get_results("SHOW INDEX FROM `{$table}`"); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
80	75	$existing_index_names = [];
81	76
82	77	foreach ($existing_indexes as $index) {
		@@ -82,9 +77,8 @@
82	77	foreach ($existing_indexes as $index) {
83	78	$existing_index_names[] = $index->Key_name;
84	79	}
85	80
86		- // Desired indexes — keys and values are all hardcoded string literals.
87	81	$indexes = [
88	82	'idx_ticket_id' => 'ticket_id',
89	83	'idx_person_id' => 'person_id',
90	84	'idx_conversation_id' => 'conversation_id',
		@@ -92,10 +86,8 @@
92	86	'idx_created_at' => 'created_at',
93	87	'idx_file_hash' => 'file_hash',
94	88	];
95	89
96		- // Add missing indexes. $table is esc_sql()'d above; $index_name and
97		- // $column_name are hardcoded array literals — no user input reaches this query.
98	90	foreach ($indexes as $index_name => $column_name) {
99	91	if (!in_array($index_name, $existing_index_names)) {
100	92	// phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- all identifiers are either esc_sql()'d or hardcoded literals.
101	93	$wpdb->query("ALTER TABLE `{$table}` ADD INDEX `{$index_name}` (`{$column_name}`)");