newstatpress / includes / api / variables.php

variables.php in NewStatPress trunk, at includes/api/variables.php

383 lines 11.0 KB

Raw Download Zip

1	<?php
2	/**
3	* Get variables with the newstatpress_variables_ajax
4	*
5	* @package NewStatpress
6	*/
7
8	// Make sure plugin remains secure if called directly.
9	if ( ! defined( 'ABSPATH' ) ) {
10	if ( ! headers_sent() ) {
11	header( 'HTTP/1.1 403 Forbidden' );
12	}
13	die( esc_html( __( 'ERROR: This plugin requires WordPress and will not function if called directly.', 'newstatpress' ) ) );
14	}
15
16	/**
17	* Ajax routine for getting variables values
18	*/
19	function newstatpress_variables_ajax() {
20	global $wpdb;
21	global $newstatpress_option_vars;
22	$table_name = "{$wpdb->prefix}statpress";
23
24	// response output.
25	header( 'Content-Type: application/json' );
26
27	// check to see if the submitted nonce matches with the
28	// generated nonce we created earlier.
29	if ( ! ( isset( $_POST['postCommentNonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['postCommentNonce'] ) ), 'newstatpress-nsp_variables-nonce' ) ) ) {
30	die( 'Busted!' );
31	}
32
33	// get the submitted parameters.
34	if ( isset( $_POST['VAR'] ) ) {
35	$var = sanitize_text_field( wp_unslash( $_POST['VAR'] ) );
36	} else {
37	die( 'no var' );
38	}
39
40	$offsets = get_option( $newstatpress_option_vars['stats_offsets']['name'] );
41
42	$table_literal = '`' . esc_sql( $table_name ) . '`';
43
44	// test all vars.
45	if ( 'alltotalvisits' === $var ) {
46	$sql = sprintf( "
47	SELECT COUNT(DISTINCT CONCAT(urlrequested, ip)) AS pageview
48	FROM %s AS t1
49	WHERE
50	spider = '' AND
51	feed = '' AND
52	urlrequested != ''",
53	$table_literal
54	);
55
56	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
57	$qry = $wpdb->get_results(
58	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
59	$sql
60	);
61
62	$num = isset( $offsets['pageviews'] ) ? $offsets['pageviews'] : 0;
63
64	if ( isset( $qry[0]->pageview ) ) {
65	echo wp_json_encode( $qry[0]->pageview + $num );
66	} else {
67	echo wp_json_encode( $num );
68	}
69	} elseif ( 'visits' === $var ) {
70	$sql = sprintf( "
71	SELECT COUNT(DISTINCT(ip)) AS pageview
72	FROM %s
73	WHERE
74	date = %%s AND
75	spider = '' AND
76	feed = ''",
77	$table_literal
78	);
79
80	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
81	$prepared = $wpdb->prepare(
82	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
83	$sql,
84	gmdate( 'Ymd', current_time( 'timestamp' ) )
85	);
86
87	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
88	$qry = $wpdb->get_results(
89	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
90	$prepared
91	);
92
93	if ( isset( $qry[0]->pageview ) ) {
94	echo wp_json_encode( $qry[0]->pageview );
95	}
96	} elseif ( 'yvisits' === $var ) {
97	$sql = sprintf("
98	SELECT COUNT(DISTINCT(ip)) AS pageview
99	FROM %s
100	WHERE
101	date = %%s AND
102	spider = '' AND
103	feed = ''",
104	$table_literal
105	);
106
107	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
108	$prepared = $wpdb->prepare(
109	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
110	$sql,
111	gmdate( 'Ymd', current_time( 'timestamp' ) - 86400 )
112	);
113
114	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
115	$qry = $wpdb->get_results(
116	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
117	$prepared
118	);
119
120	if ( isset( $qry[0]->pageview ) ) {
121	echo wp_json_encode( $qry[0]->pageview );
122	}
123	} elseif ( 'mvisits' === $var ) {
124	if ( get_option( $newstatpress_option_vars['calculation']['name'] ) === 'sum' ) {
125	$sql = sprintf( "
126	SELECT SUM(pagv) AS pageview FROM (
127	SELECT COUNT(DISTINCT(ip)) AS pagv
128	FROM %s
129	WHERE
130	DATE >= DATE_FORMAT(CURDATE(), %%s) AND
131	spider = '' AND feed = ''
132	GROUP BY DATE
133	) AS pageview",
134	$table_literal
135	);
136
137	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
138	$prepared = $wpdb->prepare( $sql, '%Y%m01' );
139
140	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
141	$qry = $wpdb->get_results(
142	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
143	$prepared
144	);
145	} else {
146	$sql = sprintf( "
147	SELECT COUNT(DISTINCT(ip)) AS pageview
148	FROM %s
149	WHERE
150	DATE >= DATE_FORMAT(CURDATE(), %%s) AND
151	spider = '' AND feed = ''",
152	$table_literal
153	);
154
155	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
156	$prepared = $wpdb->prepare( $sql, '%Y%m01' );
157
158	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
159	$qry = $wpdb->get_results(
160	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
161	$prepared
162	);
163	}
164
165	if ( isset( $qry[0]->pageview ) ) {
166	echo wp_json_encode( $qry[0]->pageview );
167	}
168	} elseif ( 'wvisits' === $var ) {
169	if ( get_option( $newstatpress_option_vars['calculation']['name'] ) === 'sum' ) {
170	$sql = sprintf( "
171	SELECT SUM(pagv) AS pageview FROM (
172	SELECT COUNT(DISTINCT(ip)) AS pagv
173	FROM %s
174	WHERE
175	YEARWEEK(date) = YEARWEEK(CURDATE()) AND
176	spider = '' AND feed = ''
177	GROUP BY DATE
178	) AS pageview",
179	$table_literal
180	);
181
182	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
183	$qry = $wpdb->get_results( $sql );
184	} else {
185	$sql = sprintf( "
186	SELECT COUNT(DISTINCT(ip)) AS pageview
187	FROM %s
188	WHERE
189	YEARWEEK(date) = YEARWEEK(CURDATE()) AND
190	spider = '' AND feed = ''",
191	$table_literal
192	);
193
194	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
195	$qry = $wpdb->get_results( $sql );
196	}
197
198	if ( isset( $qry[0]->pageview ) ) {
199	echo wp_json_encode( $qry[0]->pageview );
200	}
201	} elseif ( 'totalvisits' === $var ) {
202	if ( get_option( $newstatpress_option_vars['calculation']['name'] ) === 'sum' ) {
203	$sql = sprintf( "
204	SELECT SUM(pagv) AS pageview FROM (
205	SELECT COUNT(DISTINCT(ip)) AS pagv
206	FROM %s
207	WHERE
208	spider = '' AND
209	feed = ''
210	GROUP BY DATE
211	) AS pageview",
212	$table_literal
213	);
214
215	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
216	$qry = $wpdb->get_results( $sql );
217	} else {
218	$sql = sprintf( "
219	SELECT COUNT(DISTINCT(ip)) AS pageview
220	FROM %s
221	WHERE
222	spider = '' AND
223	feed = ''",
224	$table_literal
225	);
226
227	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
228	$qry = $wpdb->get_results( $sql );
229	}
230
231	if ( isset( $qry[0]->pageview ) ) {
232	echo wp_json_encode( $qry[0]->pageview );
233	}
234	} elseif ( 'totalpageviews' === $var ) {
235	$sql = sprintf( "
236	SELECT COUNT(id) AS pageview
237	FROM %s
238	WHERE
239	spider = '' AND
240	feed = ''",
241	$table_literal
242	);
243
244	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
245	$qry = $wpdb->get_results( $sql );
246
247	$num = isset( $offsets['pageviews'] ) ? $offsets['pageviews'] : 0;
248
249	if ( isset( $qry[0]->pageview ) ) {
250	echo wp_json_encode( $qry[0]->pageview + $num );
251	} else {
252	echo wp_json_encode( $num );
253	}
254	} elseif ( 'todaytotalpageviews' === $var ) {
255	$sql = sprintf("
256	SELECT COUNT(id) AS pageview
257	FROM %s
258	WHERE
259	date = %%s AND
260	spider = '' AND
261	feed = ''",
262	$table_literal
263	);
264
265	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
266	$prepared = $wpdb->prepare(
267	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
268	$sql,
269	gmdate( 'Ymd', current_time( 'timestamp' ) )
270	);
271
272	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
273	$qry = $wpdb->get_results(
274	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
275	$prepared
276	);
277
278	if ( isset( $qry[0]->pageview ) ) {
279	echo wp_json_encode( $qry[0]->pageview );
280	}
281	} elseif ( 'thistotalvisits' === $var ) {
282	if ( isset( $_REQUEST['URL'] ) ) {
283	$url = esc_url_raw( wp_unslash( $_REQUEST['URL'] ) );
284	}
285
286	$sql = sprintf( "
287	SELECT COUNT(DISTINCT(ip)) AS pageview
288	FROM %s
289	WHERE
290	spider = '' AND
291	feed = '' AND
292	urlrequested = %%s",
293	$table_literal
294	);
295
296	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
297	$prepared = $wpdb->prepare( $sql, $url );
298
299	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
300	$qry = $wpdb->get_results(
301	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
302	$prepared
303	);
304
305	if ( isset( $qry[0]->pageview ) ) {
306	echo wp_json_encode( $qry[0]->pageview );
307	}
308	} elseif ( 'monthtotalpageviews' === $var ) {
309	$sql = sprintf( "
310	SELECT COUNT(id) AS pageview
311	FROM %s
312	WHERE
313	DATE >= DATE_FORMAT(CURDATE(), %%s) AND
314	spider = '' AND
315	feed = ''",
316	$table_literal
317	);
318
319	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
320	$prepared = $wpdb->prepare( $sql, '%Y%m01' );
321
322	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
323	$qry = $wpdb->get_results(
324	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
325	$prepared
326	);
327
328	if ( isset( $qry[0]->pageview ) ) {
329	echo wp_json_encode( $qry[0]->pageview );
330	}
331	} elseif ( 'widget_topposts' === $var ) {
332	if ( isset( $_REQUEST['LIMIT'] ) ) {
333	$limit = intval( $_REQUEST['LIMIT'] );
334	}
335
336	if ( isset( $_REQUEST['FLAG'] ) ) {
337	$showcounts = preg_replace(
338	'/[^a-zA-Z]+/',
339	'',
340	sanitize_text_field( wp_unslash( $_REQUEST['FLAG'] ) )
341	);
342	}
343
344	$res = "\n<ul>\n";
345
346	$sql = sprintf( "
347	SELECT urlrequested, COUNT(*) AS totale
348	FROM %s
349	WHERE
350	spider = '' AND
351	feed = '' AND
352	urlrequested LIKE %%s
353	GROUP BY urlrequested
354	ORDER BY totale DESC
355	LIMIT %%d",
356	$table_literal
357	);
358
359	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
360	$prepared = $wpdb->prepare( $sql, '%p=%', $limit );
361
362	// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
363	$qry = $wpdb->get_results(
364	// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
365	$prepared
366	);
367
368	foreach ( $qry as $rk ) {
369	$res .= "<li><a href='" . esc_attr( '?' . $rk->urlrequested ) . "' target='_blank'>" .
370	esc_html( newstatpress_decode_url( $rk->urlrequested ) ) .
371	"</a></li>\n";
372
373	if ( 'checked' === strtolower( $showcounts ) ) {
374	$res .= ' (' . $rk->totale . ')';
375	}
376	}
377
378	echo wp_json_encode( "$res</ul>\n" );
379	}
380
381	wp_die();
382	}
383