← All changes | database/Migrations/PersonsMigrator.php +3 -13 2.3.0 → 2.4.5 View file →

		@@ -61,18 +61,14 @@
61	61	public static function addMissingColumns($table)
62	62	{
63	63	global $wpdb;
64	64
65		- // $table is always $wpdb->prefix . 'fs_persons' — not user input.
66		- // esc_sql() is the correct escaping for SQL identifiers; $wpdb->prepare()
67		- // cannot quote identifiers in WP < 6.2 (no %i placeholder available).
	65	+ // Our own table name, not user input. esc_sql() because %i needs WP 6.2+.
68	66	$table = esc_sql($table);
69	67
70		- // Get existing columns
71	68	$existing_columns = $wpdb->get_col("DESC `{$table}`", 0); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
72	69
73		- // @todo: We will remove this on final release
74		- // This is only for beta users
	70	+ // @todo: Beta-only migration, remove on final release.
75	71	if (!in_array('title', $existing_columns)) {
76	72	// phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- $table is sanitized via esc_sql(); column name is a hardcoded literal.
77	73	$wpdb->query("ALTER TABLE `{$table}` ADD `title` VARCHAR(192) NULL AFTER `email`");
78	74	}
		@@ -86,14 +82,11 @@
86	82	public static function addMissingIndexes($table)
87	83	{
88	84	global $wpdb;
89	85
90		- // $table is always $wpdb->prefix . 'fs_persons' — not user input.
91		- // esc_sql() is the correct escaping for SQL identifiers; $wpdb->prepare()
92		- // cannot quote identifiers in WP < 6.2 (no %i placeholder available).
	86	+ // Our own table name, not user input. esc_sql() because %i needs WP 6.2+.
93	87	$table = esc_sql($table);
94	88
95		- // Get existing indexes
96	89	$existing_indexes = $wpdb->get_results("SHOW INDEX FROM `{$table}`"); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
97	90	$existing_index_names = [];
98	91
99	92	foreach ($existing_indexes as $index) {
		@@ -99,9 +92,8 @@
99	92	foreach ($existing_indexes as $index) {
100	93	$existing_index_names[] = $index->Key_name;
101	94	}
102	95
103		- // Desired indexes — keys and values are all hardcoded string literals.
104	96	$indexes = [
105	97	'idx_email' => 'email',
106	98	'idx_user_id' => 'user_id',
107	99	'idx_ip_address' => 'ip_address',
		@@ -106,10 +98,8 @@
106	98	'idx_user_id' => 'user_id',
107	99	'idx_ip_address' => 'ip_address',
108	100	];
109	101
110		- // Add missing indexes. $table is esc_sql()'d above; $index_name and
111		- // $column_name are hardcoded array literals — no user input reaches this query.
112	102	foreach ($indexes as $index_name => $column_name) {
113	103	if (!in_array($index_name, $existing_index_names)) {
114	104	// phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- all identifiers are either esc_sql()'d or hardcoded literals.
115	105	$wpdb->query("ALTER TABLE `{$table}` ADD INDEX `{$index_name}` (`{$column_name}`)");