← All changes | modules/cost-tracker/classes/class-cost-tracker-db-query.php +30 -19 5.2 → 6.2.1 View file →

		@@ -12,8 +12,14 @@
12	12	use MainWP\Dashboard\MainWP_Utility;
13	13	use MainWP\Dashboard\MainWP_DB;
14	14	use MainWP\Dashboard\MainWP_DB_Client;
15	15
	16	+// Exit if accessed directly.
	17	+if ( ! defined( 'ABSPATH' ) ) {
	18	+ exit;
	19	+}
	20	+
	21	+
16	22	/**
17	23	* Class Cost_Tracker_DB_Query
18	24	*/
19	25	class Cost_Tracker_DB_Query extends Cost_Tracker_DB {
		@@ -136,10 +142,11 @@
136	142
137	143	$where_search = array();
138	144	if ( ! empty( $args['search'] ) ) {
139	145	// Sanitize field.
	146	+ $search_term = '%' . esc_sql( $args['search'] ) . '%';
140	147	foreach ( $allowed_search_fields as $field ) {
141		- $where_search[] = $this->wpdb->prepare( " {$field} LIKE %s ", "%{$args['search']}%" ); //phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	148	+ $where_search[] = $this->wpdb->prepare( " {$field} LIKE %s ", $search_term );
142	149	}
143	150	}
144	151
145	152	if ( ! empty( $where_search ) ) {
		@@ -148,14 +155,16 @@
148	155	$join_lookup = '';
149	156	$filter_lookup = ! empty( $filter_site_ids ) || ! empty( $filter_client_ids ) ? true : false;
150	157
151	158	if ( $filter_lookup ) {
152		- $join_lookup = ' JOIN ' . $this->table_name( 'lookup_item_objects' ) . ' lco ON co.id = lco.item_id AND lco.item_name = "cost" ';
	159	+ $lookup_table = '`' . esc_sql( $this->table_name( 'lookup_item_objects' ) ) . '`';
	160	+ $join_lookup = " JOIN {$lookup_table} lco ON co.id = lco.item_id AND lco.item_name = 'cost' ";
153	161	$join_and = array();
154	162
155	163	$clients_sites_ids = array();
156	164	if ( $filter_client_ids ) {
157		- $join_and[] = ' lco.object_name = "client" AND lco.object_id IN (' . implode( ',', $filter_client_ids ) . ') ';
	165	+ $safe_client_ids = array_map( 'intval', $filter_client_ids );
	166	+ $join_and[] = ' lco.object_name = "client" AND lco.object_id IN (' . implode( ',', $safe_client_ids ) . ') ';
158	167
159	168	// if filter by clients need to get sites of the clients to search in lookup table.
160	169	$cli_sites = MainWP_DB_Client::instance()->get_websites_by_client_ids( $filter_client_ids );
161	170	if ( $cli_sites ) {
		@@ -167,9 +176,10 @@
167	176
168	177	$filter_site_ids = array_unique( array_merge( $filter_site_ids, $clients_sites_ids ) );
169	178
170	179	if ( $filter_site_ids ) {
171		- $join_and[] = ' lco.object_name = "site" AND lco.object_id IN (' . implode( ',', $filter_site_ids ) . ') ';
	180	+ $safe_site_ids = array_map( 'intval', $filter_site_ids );
	181	+ $join_and[] = ' lco.object_name = "site" AND lco.object_id IN (' . implode( ',', $safe_site_ids ) . ') ';
172	182	}
173	183
174	184	if ( ! empty( $join_and ) ) {
175	185	if ( 1 === count( $join_and ) ) {
		@@ -186,9 +196,10 @@
186	196
187	197	if ( ! empty( $filter_prod_type_slugs ) && is_array( $filter_prod_type_slugs ) ) {
188	198	$filter_prod_type_slugs = MainWP_DB::instance()->escape_array( $filter_prod_type_slugs );
189	199	if ( ! empty( $filter_prod_type_slugs ) ) {
190		- $where .= ' AND co.product_type IN ("' . implode( '","', $filter_prod_type_slugs ) . '") ';
	200	+ $safe_prod_types = array_map( 'esc_sql', $filter_prod_type_slugs );
	201	+ $where .= ' AND co.product_type IN ("' . implode( '","', $safe_prod_types ) . '") ';
191	202	}
192	203	}
193	204
194	205	if ( ! empty( $filter_cost_state ) && is_array( $filter_cost_state ) ) {
		@@ -193,9 +204,10 @@
193	204
194	205	if ( ! empty( $filter_cost_state ) && is_array( $filter_cost_state ) ) {
195	206	$filter_cost_state = MainWP_DB::instance()->escape_array( $filter_cost_state );
196	207	if ( ! empty( $filter_cost_state ) ) {
197		- $where .= ' AND co.cost_status IN ("' . implode( '","', $filter_cost_state ) . '") ';
	208	+ $safe_cost_states = array_map( 'esc_sql', $filter_cost_state );
	209	+ $where .= ' AND co.cost_status IN ("' . implode( '","', $safe_cost_states ) . '") ';
198	210	}
199	211	}
200	212
201	213	$filter_next_renewal = false;
		@@ -215,21 +227,24 @@
215	227
216	228	if ( ! empty( $filter_license_type ) && is_array( $filter_license_type ) ) {
217	229	$filter_license_type = MainWP_DB::instance()->escape_array( $filter_license_type );
218	230	if ( ! empty( $filter_license_type ) ) {
219		- $where .= ' AND co.license_type IN ("' . implode( '","', $filter_license_type ) . '") ';
	231	+ $safe_license_types = array_map( 'esc_sql', $filter_license_type );
	232	+ $where .= ' AND co.license_type IN ("' . implode( '","', $safe_license_types ) . '") ';
220	233	}
221	234	}
222	235	if ( ! empty( $filter_payment_method ) && is_array( $filter_payment_method ) ) {
223	236	$filter_payment_method = MainWP_DB::instance()->escape_array( $filter_payment_method );
224	237	if ( ! empty( $filter_payment_method ) ) {
225		- $where .= ' AND co.payment_method IN ("' . implode( '","', $filter_payment_method ) . '") ';
	238	+ $safe_payment_methods = array_map( 'esc_sql', $filter_payment_method );
	239	+ $where .= ' AND co.payment_method IN ("' . implode( '","', $safe_payment_methods ) . '") ';
226	240	}
227	241	}
228	242	if ( ! empty( $filter_renewal_type ) && is_array( $filter_renewal_type ) ) {
229	243	$filter_renewal_type = MainWP_DB::instance()->escape_array( $filter_renewal_type );
230	244	if ( ! empty( $filter_renewal_type ) ) {
231		- $where .= ' AND co.renewal_type IN ("' . implode( '","', $filter_renewal_type ) . '") ';
	245	+ $safe_renewal_types = array_map( 'esc_sql', $filter_renewal_type );
	246	+ $where .= ' AND co.renewal_type IN ("' . implode( '","', $safe_renewal_types ) . '") ';
232	247	}
233	248	}
234	249
235	250	/**
		@@ -268,23 +283,19 @@
268	283
269	284	/**
270	285	* BUILD THE FINAL QUERY
271	286	*/
272		- $query = "SELECT {$select}
273		- FROM " . $this->table_name( 'cost_tracker' ) . ' as co ' .
	287	+ $cost_table = '`' . esc_sql( $this->table_name( 'cost_tracker' ) ) . '`';
	288	+ $query = "SELECT {$select}
	289	+ FROM {$cost_table} as co " .
274	290	$join_lookup .
275	291	" WHERE 1 {$where}
276	292	{$orderby}
277	293	{$limits}";
278	294
279		- //phpcs:disable Squiz.PHP.CommentedOutCode.Found
280		- // error_log( print_r( $args, true ) ); //.
281		- // error_log( $query ); //.
282		- //phpcs:enable Squiz.PHP.CommentedOutCode.Found
283		-
284	295	// Build result count query.
285		- $count_query = 'SELECT COUNT(DISTINCT(co.id)) as found
286		- FROM ' . $this->table_name( 'cost_tracker' ) . ' as co ' .
	296	+ $count_query = "SELECT COUNT(DISTINCT(co.id)) as found
	297	+ FROM {$cost_table} as co " .
287	298	$join_lookup .
288	299	" WHERE 1 {$where}";
289	300
290	301	/**
		@@ -290,9 +301,9 @@
290	301	/**
291	302	* QUERY THE DATABASE FOR RESULTS
292	303	*/
293	304	$items = $this->wpdb->get_results( $query ); // phpcs:ignore -- ok.
294		- $total = absint( $this->wpdb->get_var( $count_query ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
	305	+ $total = absint( $this->wpdb->get_var( $count_query ) ); // phpcs:ignore -- ok.
295	306
296	307	return array(
297	308	'items' => $items,
298	309	'count' => $total,