← All changes | importExtensions/MediaHandling.php +86 -13 1.7.1 → 2.1 View file →

		@@ -79,20 +79,49 @@
79	79	}
80	80	return $attach_id;
81	81	}
82	82	else{
83		- $attachment_id = $wpdb->get_results("SELECT ID FROM {$wpdb->prefix}posts WHERE post_type = 'attachment' AND guid LIKE '%$image_title%'", ARRAY_A);
	83	+ $attachment_id = $wpdb->get_results(
	84	+ $wpdb->prepare(
	85	+ "SELECT ID FROM {$wpdb->prefix}posts WHERE post_type = 'attachment' AND guid LIKE %s",
	86	+ '%' . $wpdb->esc_like( $image_title ) . '%'
	87	+ ),
	88	+ ARRAY_A
	89	+ );
84	90
85	91	}
86	92	if(is_array($attachment_id) && !empty($attachment_id[0]['ID']) && $image_type != 'Featured'){
87	93	$table_name = $wpdb->prefix . 'smackcsv_file_events';
88		- $post_title = $wpdb->get_var("SELECT post_title FROM {$wpdb->prefix}posts WHERE ID = '{$post_id}' AND post_status != 'trash'");
89		- $file_name = $wpdb->get_var("SELECT file_name FROM $table_name WHERE hash_key = '$hash_key'");
	94	+ $post_title = $wpdb->get_var(
	95	+ $wpdb->prepare(
	96	+ "SELECT post_title FROM {$wpdb->prefix}posts WHERE ID = %d AND post_status != 'trash'",
	97	+ absint( $post_id )
	98	+ )
	99	+ );
	100	+ $file_name = $wpdb->get_var(
	101	+ $wpdb->prepare(
	102	+ "SELECT file_name FROM $table_name WHERE hash_key = %s",
	103	+ $hash_key
	104	+ )
	105	+ );
90	106	$shortcode_table = $wpdb->prefix . "ultimate_csv_importer_shortcode_manager";
91	107	$attach_id = $attachment_id[0]['ID'];
92		- $check_id = $wpdb->get_results("SELECT ID FROM {$wpdb->prefix}posts WHERE ID ='{$attach_id}' AND post_title ='image-failed' AND post_type = 'attachment' AND guid LIKE '%$image_title%'", ARRAY_A);
	108	+ $check_id = $wpdb->get_results(
	109	+ $wpdb->prepare(
	110	+ "SELECT ID FROM {$wpdb->prefix}posts WHERE ID = %d AND post_title ='image-failed' AND post_type = 'attachment' AND guid LIKE %s",
	111	+ absint( $attach_id ),
	112	+ '%' . $wpdb->esc_like( $image_title ) . '%'
	113	+ ),
	114	+ ARRAY_A
	115	+ );
93	116	if(!empty($check_id)){
94		- $failed_ids = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}ultimate_csv_importer_shortcode_manager WHERE post_id='{$post_id}' AND media_id = '{$attach_id}'");
	117	+ $failed_ids = $wpdb->get_results(
	118	+ $wpdb->prepare(
	119	+ "SELECT * FROM {$wpdb->prefix}ultimate_csv_importer_shortcode_manager WHERE post_id = %d AND media_id = %d",
	120	+ absint( $post_id ),
	121	+ absint( $attach_id )
	122	+ )
	123	+ );
95	124	if(!empty($failed_ids) && $failed_ids[0]->post_id != $post_id){
96	125	$attach_id = $check_id[0]['ID'];;
97	126	$insert_status = $wpdb->insert($shortcode_table,
98	127	array(
		@@ -229,10 +258,14 @@
229	258	$fimg_name = @basename($f_img);
230	259	$fimg_name = str_replace(' ', '-', trim($fimg_name));
231	260	$fimg_name = preg_replace('/[^a-zA-Z0-9._\-\s]/', '', $fimg_name);
232	261	}
233		- $attachment_id = $wpdb->get_var("SELECT ID FROM ".$wpdb->prefix."posts WHERE post_type = 'attachment' AND guid LIKE '%$fimg_name'");
234		-
	262	+ $attachment_id = $wpdb->get_var(
	263	+ $wpdb->prepare(
	264	+ "SELECT ID FROM ".$wpdb->prefix."posts WHERE post_type = 'attachment' AND guid LIKE %s",
	265	+ '%' . $wpdb->esc_like( $fimg_name )
	266	+ )
	267	+ );
235	268	if($attachment_id){
236	269	if(!empty($data_array['featured_image'])){
237	270	set_post_thumbnail( $post_id, $attachment_id );
238	271	return $attachment_id;
		@@ -306,8 +339,12 @@
306	339	//update_post_meta($postID['id'], '_wp_attachment_image_alt', $data_array['alt_text']);
307	340	//}
308	341	}
309	342	else{
	343	+ // Never write a file the web server could execute.
	344	+ if (preg_match('/^\.|\.(php[0-9]*|pht|phtml|phar|phps|cgi|pl|py|sh|shtml|asp|aspx|jsp)(\.|$)/i', basename($uploaddir_path))) {
	345	+ return null;
	346	+ }
310	347	if (file_exists($uploaddir_path)) {
311	348	$i = 1;
312	349	$exist = true;
313	350	while($exist){
		@@ -397,11 +434,27 @@
397	434	}
398	435	public function image_meta_table_entry($line_number ,$post_values, $post_id ,$acf_wpname_element, $acf_csv_name, $hash_key, $plugin,$get_import_type,$templatekey = null,$gmode = null,$header_array = null, $value_array = null,$imgformat = null,$typecct = null,$indexs=null){
399	436	global $wpdb;
400	437	$table_name = $wpdb->prefix . 'smackcsv_file_events';
401		- $file_name = $wpdb->get_var("SELECT file_name FROM $table_name WHERE hash_key = '$hash_key'");
402		- $post_title = $wpdb->get_var("SELECT post_title FROM {$wpdb->prefix}posts WHERE ID = '{$post_id}' AND post_status != 'trash'");
403		- $failed_ids = $wpdb->get_results("SELECT post_title,post_id,image_shortcode,media_id,original_image FROM {$wpdb->prefix}ultimate_csv_importer_shortcode_manager WHERE image_shortcode ='Featured_image_' AND post_id = '{$post_id}' AND original_image = '{$acf_csv_name}' ");
	438	+ $file_name = $wpdb->get_var(
	439	+ $wpdb->prepare(
	440	+ "SELECT file_name FROM $table_name WHERE hash_key = %s",
	441	+ $hash_key
	442	+ )
	443	+ );
	444	+ $post_title = $wpdb->get_var(
	445	+ $wpdb->prepare(
	446	+ "SELECT post_title FROM {$wpdb->prefix}posts WHERE ID = %d AND post_status != 'trash'",
	447	+ absint( $post_id )
	448	+ )
	449	+ );
	450	+ $failed_ids = $wpdb->get_results(
	451	+ $wpdb->prepare(
	452	+ "SELECT post_title,post_id,image_shortcode,media_id,original_image FROM {$wpdb->prefix}ultimate_csv_importer_shortcode_manager WHERE image_shortcode ='Featured_image_' AND post_id = %d AND original_image = %s",
	453	+ absint( $post_id ),
	454	+ $acf_csv_name
	455	+ )
	456	+ );
404	457	//$core_instance = CoreFieldsImport::getInstance();
405	458	//$core_instance = new WooCommerceCoreImport;
406	459	$shortcode_table = $wpdb->prefix . "ultimate_csv_importer_shortcode_manager";
407	460
		@@ -423,9 +476,16 @@
423	476	$acf_image_meta =json_encode($image_meta_value);
424	477	}
425	478	$acf_image_meta = isset($acf_image_meta) ? $acf_image_meta : null;
426	479	$attach_id = $this->media_handling($acf_csv_name, $post_id, $post_values,$get_import_type,$plugin,$hash_key,'',$header_array,$value_array,$indexs,$acf_wpname_element,$acf_image_meta);
427		- $failed_id = $wpdb->get_results("SELECT post_title,post_id,image_shortcode,media_id,original_image FROM {$wpdb->prefix}ultimate_csv_importer_shortcode_manager WHERE post_id = '{$post_id}' AND original_image = '{$acf_csv_name}' AND image_shortcode = '" . esc_sql($plugin.'_image__'.$acf_wpname_element) . "' ");
	480	+ $failed_id = $wpdb->get_results(
	481	+ $wpdb->prepare(
	482	+ "SELECT post_title,post_id,image_shortcode,media_id,original_image FROM {$wpdb->prefix}ultimate_csv_importer_shortcode_manager WHERE post_id = %d AND original_image = %s AND image_shortcode = %s",
	483	+ absint( $post_id ),
	484	+ $acf_csv_name,
	485	+ $plugin . '_image__' . $acf_wpname_element
	486	+ )
	487	+ );
428	488	if(!empty($attach_id)){
429	489	$this->store_image_ids($attach_id ); //store the image id
430	490	return $attach_id;
431	491	}
		@@ -485,14 +545,27 @@
485	545	}
486	546	}
487	547	else{
488	548	$media_id = $failed_id[0]->media_id;
489		- $attachment_id = $wpdb->get_results("SELECT ID FROM {$wpdb->prefix}posts WHERE ID = $media_id AND post_title ='image-failed' AND post_type = 'attachment' AND guid LIKE '%$fimg_name%'", ARRAY_A);
	549	+ $attachment_id = $wpdb->get_results(
	550	+ $wpdb->prepare(
	551	+ "SELECT ID FROM {$wpdb->prefix}posts WHERE ID = %d AND post_title ='image-failed' AND post_type = 'attachment' AND guid LIKE %s",
	552	+ absint( $media_id ),
	553	+ '%' . $wpdb->esc_like( $fimg_name ) . '%'
	554	+ ),
	555	+ ARRAY_A
	556	+ );
490	557	$attach_id= $attachment_id[0]['ID'];
491	558	}
492	559	return isset($attach_id) ? $attach_id : '';
493	560	}else{
494		- $attachment_id = $wpdb->get_results("SELECT ID FROM {$wpdb->prefix}posts WHERE post_title ='image-failed' AND post_type = 'attachment' AND guid LIKE '%$fimg_name%'", ARRAY_A);
	561	+ $attachment_id = $wpdb->get_results(
	562	+ $wpdb->prepare(
	563	+ "SELECT ID FROM {$wpdb->prefix}posts WHERE post_title ='image-failed' AND post_type = 'attachment' AND guid LIKE %s",
	564	+ '%' . $wpdb->esc_like( $fimg_name ) . '%'
	565	+ ),
	566	+ ARRAY_A
	567	+ );
495	568	}
496	569	return $attach_id;
497	570	}
498	571	}