← All changes | class/class-mainwp-db-backup.php +14 -9 5.2 → 6.2.1 View file →

		@@ -8,8 +8,13 @@
8	8	*/
9	9
10	10	namespace MainWP\Dashboard;
11	11
	12	+// Exit if accessed directly.
	13	+if ( ! defined( 'ABSPATH' ) ) {
	14	+ exit;
	15	+}
	16	+
12	17	/**
13	18	* Class MainWP_DB_Backup
14	19	*
15	20	* @package MainWP\Dashboard
		@@ -122,9 +127,9 @@
122	127	*
123	128	* @return (array|null) Backup Progress or null on failer.
124	129	*/
125	130	public function get_backup_task_progress( $task_id, $wp_id ) {
126		- $progress = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT * FROM ' . $this->table_name( 'wp_backup_progress' ) . ' WHERE task_id= %d AND wp_id = %d ', $task_id, $wp_id ) );
	131	+ $progress = $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT * FROM ' . esc_sql( $this->table_name( 'wp_backup_progress' ) ) . ' WHERE task_id= %d AND wp_id = %d ', $task_id, $wp_id ) );
127	132
128	133	if ( $progress && '' !== $progress->fetchResult ) {
129	134	$progress->fetchResult = json_decode( $progress->fetchResult, true );
130	135	}
		@@ -146,9 +151,9 @@
146	151	if ( ! get_option( 'mainwp_enableLegacyBackupFeature' ) ) {
147	152	return false;
148	153	}
149	154
150		- $progresses = $this->wpdb->get_results( $this->wpdb->prepare( 'SELECT * FROM ' . $this->table_name( 'wp_backup_progress' ) . ' WHERE wp_id = %d AND dtsFetched > %d ', $wp_id, time() - ( 30 * 60 ) ) );
	155	+ $progresses = $this->wpdb->get_results( $this->wpdb->prepare( 'SELECT * FROM ' . esc_sql( $this->table_name( 'wp_backup_progress' ) ) . ' WHERE wp_id = %d AND dtsFetched > %d ', $wp_id, time() - ( 30 * 60 ) ) );
151	156	if ( is_array( $progresses ) ) {
152	157	foreach ( $progresses as $progress ) {
153	158	if ( empty( $progress->downloadedDBComplete ) && empty( $progress->downloadedFULLComplete ) ) {
154	159	$task = $this->get_backup_task_by_id( $progress->task_id );
		@@ -170,9 +175,9 @@
170	175	*
171	176	* @return void
172	177	*/
173	178	public function remove_backup_task( $id ) {
174		- $this->wpdb->query( $this->wpdb->prepare( 'DELETE FROM ' . $this->table_name( 'wp_backup' ) . ' WHERE id = %d', $id ) );
	179	+ $this->wpdb->query( $this->wpdb->prepare( 'DELETE FROM ' . esc_sql( $this->table_name( 'wp_backup' ) ) . ' WHERE id = %d', $id ) );
175	180	}
176	181
177	182	/**
178	183	* Method get_backup_task_by_id()
		@@ -183,9 +188,9 @@
183	188	*
184	189	* @return (object|null) Database query result for Backup Task or null on failure
185	190	*/
186	191	public function get_backup_task_by_id( $id ) {
187		- return $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT * FROM ' . $this->table_name( 'wp_backup' ) . ' WHERE id= %d ', $id ) );
	192	+ return $this->wpdb->get_row( $this->wpdb->prepare( 'SELECT * FROM ' . esc_sql( $this->table_name( 'wp_backup' ) ) . ' WHERE id= %d ', $id ) );
188	193	}
189	194
190	195	/**
191	196	* Method get_backup_tasks_for_user()
		@@ -223,9 +228,9 @@
223	228	*
224	229	* @return (object|null) Database query result for backup tasks for current user or null on failer.
225	230	*/
226	231	public function get_backup_tasks( $userid = null, $orderBy = null ) {
227		- return $this->wpdb->get_results( 'SELECT * FROM ' . $this->table_name( 'wp_backup' ) . ' WHERE ' . ( null === $userid ? '' : 'userid= ' . $userid . ' AND ' ) . ' template = 0 ' . ( null !== $orderBy ? 'ORDER BY ' . $orderBy : '' ), OBJECT );
	232	+ return $this->wpdb->get_results( 'SELECT * FROM ' . esc_sql( $this->table_name( 'wp_backup' ) ) . ' WHERE ' . ( null === $userid ? '' : 'userid= ' . absint( $userid ) . ' AND ' ) . ' template = 0 ' . ( null !== $orderBy ? 'ORDER BY ' . esc_sql( $orderBy ) : '' ), OBJECT );
228	233	}
229	234
230	235	/**
231	236	* Method add_backup_task()
		@@ -540,9 +545,9 @@
540	545	*
541	546	* @return object Backup tasks.
542	547	*/
543	548	public function get_backup_tasks_to_complete() {
544		- return $this->wpdb->get_results( 'SELECT * FROM ' . $this->table_name( 'wp_backup' ) . ' WHERE paused = 0 AND completed < last_run', OBJECT );
	549	+ return $this->wpdb->get_results( 'SELECT * FROM ' . esc_sql( $this->table_name( 'wp_backup' ) ) . ' WHERE paused = 0 AND completed < last_run', OBJECT );
545	550	}
546	551
547	552	/**
548	553	* Method get backup tasks daily.
		@@ -551,9 +556,9 @@
551	556	*
552	557	* @return object Backup tasks.
553	558	*/
554	559	public function get_backup_tasks_todo_daily() {
555		- return $this->wpdb->get_results( 'SELECT * FROM ' . $this->table_name( 'wp_backup' ) . ' WHERE paused = 0 AND schedule="daily" AND ' . time() . ' - last_run >= ' . ( 60 * 60 * 24 ), OBJECT );
	560	+ return $this->wpdb->get_results( 'SELECT * FROM ' . esc_sql( $this->table_name( 'wp_backup' ) ) . ' WHERE paused = 0 AND schedule="daily" AND ' . absint( time() ) . ' - last_run >= ' . ( 60 * 60 * 24 ), OBJECT );
556	561	}
557	562
558	563	/**
559	564	* Method get backup tasks weekly.
		@@ -562,9 +567,9 @@
562	567	*
563	568	* @return object Backup tasks.
564	569	*/
565	570	public function get_backup_tasks_todo_weekly() {
566		- return $this->wpdb->get_results( 'SELECT * FROM ' . $this->table_name( 'wp_backup' ) . ' WHERE paused = 0 AND schedule="weekly" AND ' . time() . ' - last_run >= ' . ( 60 * 60 * 24 * 7 ), OBJECT );
	571	+ return $this->wpdb->get_results( 'SELECT * FROM ' . esc_sql( $this->table_name( 'wp_backup' ) ) . ' WHERE paused = 0 AND schedule="weekly" AND ' . absint( time() ) . ' - last_run >= ' . ( 60 * 60 * 24 * 7 ), OBJECT );
567	572	}
568	573
569	574	/**
570	575	* Method get backup tasks monthly.
		@@ -573,7 +578,7 @@
573	578	*
574	579	* @return object Backup tasks.
575	580	*/
576	581	public function get_backup_tasks_todo_monthly() {
577		- return $this->wpdb->get_results( 'SELECT * FROM ' . $this->table_name( 'wp_backup' ) . ' WHERE paused = 0 AND schedule="monthly" AND ' . time() . ' - last_run >= ' . ( 60 * 60 * 24 * 30 ), OBJECT );
	582	+ return $this->wpdb->get_results( 'SELECT * FROM ' . esc_sql( $this->table_name( 'wp_backup' ) ) . ' WHERE paused = 0 AND schedule="monthly" AND ' . absint( time() ) . ' - last_run >= ' . ( 60 * 60 * 24 * 30 ), OBJECT );
578	583	}
579	584	}