← All changes | includes/admin/tools/export/export-functions.php +48 -34 2.3.2 → 4.16.9 View file →

		@@ -15,12 +15,12 @@
15	15	exit;
16	16	}
17	17
18	18
19		-
20	19	/**
21	20	* Process batch exports via ajax
22	21	*
	22	+ * @since 2.21.0 Sanitize file name. Allow plain file name only.
23	23	* @since 1.5
24	24	* @return void
25	25	*/
26	26	function give_do_ajax_export() {
		@@ -31,11 +31,11 @@
31	31
32	32	$_REQUEST = $form = (array) $form;
33	33
34	34	if (
35		- ! wp_verify_nonce( $_REQUEST['give_ajax_export'], 'give_ajax_export' )
36		- || ! current_user_can( 'manage_give_settings' )
37		- ) {
	35	+ ! wp_verify_nonce( $_REQUEST['give_ajax_export'], 'give_ajax_export' ) ||
	36	+ ! current_user_can( 'manage_give_settings' )
	37	+ ) {
38	38	die( '-2' );
39	39	}
40	40
41	41	/**
		@@ -46,13 +46,20 @@
46	46	* @param string $class Export class.
47	47	*/
48	48	do_action( 'give_batch_export_class_include', $form['give-export-class'] );
49	49
50		- $step = absint( $_POST['step'] );
51		- $class = sanitize_text_field( $form['give-export-class'] );
	50	+ if( ! is_subclass_of( $form['give-export-class'], \Give_Batch_Export::class ) ) {
	51	+ die(-2);
	52	+ }
52	53
	54	+ $step = absint( $_POST['step'] );
	55	+ $class = sanitize_text_field( $form['give-export-class'] );
	56	+ $filename = isset( $_POST['file_name'] ) ?
	57	+ basename(sanitize_file_name( $_POST['file_name'] ), '.csv') :
	58	+ null;
	59	+
53	60	/* @var Give_Batch_Export $export */
54		- $export = new $class( $step );
	61	+ $export = new $class( $step, $filename );
55	62
56	63	if ( ! $export->can_export() ) {
57	64	die( '-1' );
58	65	}
		@@ -57,13 +64,13 @@
57	64	die( '-1' );
58	65	}
59	66
60	67	if ( ! $export->is_writable ) {
61		- $json_args = array(
	68	+ $json_args = [
62	69	'error' => true,
63		- 'message' => esc_html__( 'Export location or file not writable.', 'give' )
64		- );
65		- echo json_encode($json_args);
	70	+ 'message' => esc_html__( 'Export location or file not writable.', 'give' ),
	71	+ ];
	72	+ echo json_encode( $json_args );
66	73	exit;
67	74	}
68	75
69	76	$export->set_properties( give_clean( $_REQUEST ) );
		@@ -75,20 +82,21 @@
75	82	$percentage = $export->get_percentage_complete();
76	83
77	84	if ( $ret ) {
78	85
79		- $step += 1;
80		- $json_data = array(
81		- 'step' => $step,
82		- 'percentage' => $percentage
83		- );
	86	+ $step += 1;
	87	+ $json_data = [
	88	+ 'step' => $step,
	89	+ 'percentage' => $percentage,
	90	+ 'file_name' => $export->filename,
	91	+ ];
84	92
85	93	} elseif ( true === $export->is_empty ) {
86	94
87		- $json_data = array(
	95	+ $json_data = [
88	96	'error' => true,
89		- 'message' => esc_html__( 'No data found for export parameters.', 'give' )
90		- );
	97	+ 'message' => esc_html__( 'No data found for export parameters.', 'give' ),
	98	+ ];
91	99
92	100	} elseif ( true === $export->done && true === $export->is_void ) {
93	101
94	102	$message = ! empty( $export->message ) ?
		@@ -94,26 +102,30 @@
94	102	$message = ! empty( $export->message ) ?
95	103	$export->message :
96	104	esc_html__( 'Batch Processing Complete', 'give' );
97	105
98		- $json_data = array(
	106	+ $json_data = [
99	107	'success' => true,
100		- 'message' => $message
101		- );
	108	+ 'message' => $message,
	109	+ ];
102	110
103	111	} else {
104	112
105		- $args = array_merge( $_REQUEST, array(
106		- 'step' => $step,
107		- 'class' => $class,
108		- 'nonce' => wp_create_nonce( 'give-batch-export' ),
109		- 'give_action' => 'form_batch_export',
110		- ) );
	113	+ $args = array_merge(
	114	+ $_REQUEST,
	115	+ [
	116	+ 'step' => $step,
	117	+ 'class' => $class,
	118	+ 'nonce' => wp_create_nonce( 'give-batch-export' ),
	119	+ 'give_action' => 'form_batch_export',
	120	+ 'file_name' => $export->filename,
	121	+ ]
	122	+ );
111	123
112		- $json_data = array(
	124	+ $json_data = [
113	125	'step' => 'done',
114		- 'url' => add_query_arg( $args, admin_url() )
115		- );
	126	+ 'url' => esc_url_raw(add_query_arg( $args, admin_url() )),
	127	+ ];
116	128
117	129	}
118	130
119	131	$export->unset_properties( give_clean( $_REQUEST ), $export );
		@@ -129,8 +141,9 @@
129	141	*
130	142	* Note: This function is for internal purposes only.
131	143	* Use filter "give_export_donors_get_default_columns" instead.
132	144	*
	145	+ * @since 3.12.1 add donor_phone_number column.
133	146	* @since 2.2.6
134	147	*
135	148	* @return array
136	149	*/
		@@ -135,17 +148,18 @@
135	148	* @return array
136	149	*/
137	150	function give_export_donors_get_default_columns() {
138	151
139		- $default_columns = array(
	152	+ $default_columns = [
140	153	'full_name' => __( 'Name', 'give' ),
141	154	'email' => __( 'Email', 'give' ),
142	155	'address' => __( 'Address', 'give' ),
143	156	'userid' => __( 'User ID', 'give' ),
144	157	'donor_created_date' => __( 'Donor Created Date', 'give' ),
145		- 'donations' => __( 'Number of donations', 'give' ),
	158	+ 'donor_phone_number' => __( 'Donor Phone Number', 'give' ),
	159	+ 'donations' => __( 'Number of donations', 'give' ),
146	160	'donation_sum' => __( 'Total Donated', 'give' ),
147		- );
	161	+ ];
148	162
149	163	/**
150	164	* This filter will be used to define default columns for export.
151	165	*