← All changes | database/Migrations/TicketsMigrator.php +4 -15 2.3.1 → 2.4.5 View file →

		@@ -80,23 +80,19 @@
80	80	public static function addMissingColumns($table)
81	81	{
82	82	global $wpdb;
83	83
84		- // $table is always $wpdb->prefix . 'fs_tickets' — not user input.
85		- // esc_sql() is the correct escaping for SQL identifiers; $wpdb->prepare()
86		- // cannot quote identifiers in WP < 6.2 (no %i placeholder available).
	84	+ // Our own table name, not user input. esc_sql() because %i needs WP 6.2+.
87	85	$table = esc_sql($table);
88	86
89		- // Get existing columns
90	87	$existing_columns = $wpdb->get_col("DESC `{$table}`", 0); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
91	88
92		- // Add waiting_since column if missing (beta user migration)
93	89	if (!in_array('waiting_since', $existing_columns)) {
94	90	// phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- $table is sanitized via esc_sql(); column name is a hardcoded literal.
95	91	$wpdb->query("ALTER TABLE `{$table}` ADD `waiting_since` TIMESTAMP NULL AFTER `last_customer_response`");
96	92	}
97	93
98		- // Add created_by column to track agent who created ticket on behalf of customer
	94	+ // Agent who created the ticket on behalf of the customer.
99	95	if (!in_array('created_by', $existing_columns)) {
100	96	// phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- $table is sanitized via esc_sql(); column name is a hardcoded literal.
101	97	$wpdb->query("ALTER TABLE `{$table}` ADD `created_by` BIGINT(20) UNSIGNED NULL AFTER `closed_by`");
102	98	}
		@@ -119,14 +115,11 @@
119	115	public static function addMissingIndexes($table)
120	116	{
121	117	global $wpdb;
122	118
123		- // $table is always $wpdb->prefix . 'fs_tickets' — not user input.
124		- // esc_sql() is the correct escaping for SQL identifiers; $wpdb->prepare()
125		- // cannot quote identifiers in WP < 6.2 (no %i placeholder available).
	119	+ // Our own table name, not user input. esc_sql() because %i needs WP 6.2+.
126	120	$table = esc_sql($table);
127	121
128		- // Get existing indexes
129	122	$existing_indexes = $wpdb->get_results("SHOW INDEX FROM `{$table}`"); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
130	123	$existing_index_names = [];
131	124
132	125	foreach ($existing_indexes as $index) {
		@@ -132,10 +125,8 @@
132	125	foreach ($existing_indexes as $index) {
133	126	$existing_index_names[] = $index->Key_name;
134	127	}
135	128
136		- // Desired indexes — keys and values (including composite column lists) are
137		- // all hardcoded string literals; no user input reaches these queries.
138	129	$indexes = [
139	130	'idx_customer_id' => '`customer_id`',
140	131	'idx_agent_id' => '`agent_id`',
141	132	'idx_mailbox_id' => '`mailbox_id`',
		@@ -151,14 +142,12 @@
151	142	'idx_waiting_since_id' => '`waiting_since`, `id`',
152	143	'idx_updated_at_id' => '`updated_at`, `id`',
153	144	'idx_response_count_id' => '`response_count`, `id`',
154	145	];
155		- // Add missing indexes. $table is esc_sql()'d above; $index_name and
156		- // $columns are hardcoded array literals — no user input reaches this query.
157	146	foreach ($indexes as $index_name => $columns) {
158	147	if (!in_array($index_name, $existing_index_names)) {
	148	+ $indexType = $index_name === 'uniq_serial_number' ? 'UNIQUE KEY' : 'INDEX';
159	149	// phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter,WordPress.DB.PreparedSQL.NotPrepared -- all identifiers are either esc_sql()'d or hardcoded literals.
160		- $indexType = $index_name === 'uniq_serial_number' ? 'UNIQUE KEY' : 'INDEX';
161	150	$wpdb->query("ALTER TABLE `{$table}` ADD {$indexType} `{$index_name}` ({$columns})");
162	151	}
163	152	}
164	153	}