| 1 |
<?php |
| 2 |
|
| 3 |
/** |
| 4 |
* Extension Factory |
| 5 |
* |
| 6 |
* @package NotificationX\Extensions |
| 7 |
*/ |
| 8 |
|
| 9 |
namespace NotificationX\Admin; |
| 10 |
|
| 11 |
use NotificationX\Core\Database; |
| 12 |
use NotificationX\Core\Helper; |
| 13 |
use NotificationX\GetInstance; |
| 14 |
|
| 15 |
/** |
| 16 |
* @method static Entries get_instance($args = null) |
| 17 |
*/ |
| 18 |
class Entries { |
| 19 |
/** |
| 20 |
* Instance of Entries |
| 21 |
* |
| 22 |
* @var Entries |
| 23 |
*/ |
| 24 |
use GetInstance; |
| 25 |
|
| 26 |
protected $wpdb; |
| 27 |
protected $count = []; |
| 28 |
public $format = [ |
| 29 |
'entry_id' => '%d', |
| 30 |
'nx_id' => '%d', |
| 31 |
'source' => '%s', |
| 32 |
'entry_key' => '%s', |
| 33 |
'data' => '%s', |
| 34 |
'created_at' => '%s', |
| 35 |
'updated_at' => '%s', |
| 36 |
]; |
| 37 |
|
| 38 |
/** |
| 39 |
* Initially Invoked when initialized. |
| 40 |
* @hook init |
| 41 |
*/ |
| 42 |
public function __construct() { |
| 43 |
global $wpdb; |
| 44 |
$this->wpdb = $wpdb; |
| 45 |
} |
| 46 |
|
| 47 |
public function count($source, $col = 'source'){ |
| 48 |
if(empty($this->count)){ |
| 49 |
$this->count = Database::get_instance()->get_source_count(Database::$table_entries, $col, [$col => $source]); |
| 50 |
} |
| 51 |
if(!empty($this->count[$source])){ |
| 52 |
return $this->count[$source]; |
| 53 |
} |
| 54 |
elseif(!empty($source)){ |
| 55 |
return 0; |
| 56 |
} |
| 57 |
return $this->count; |
| 58 |
} |
| 59 |
|
| 60 |
|
| 61 |
/** |
| 62 |
* Recursively sanitize the user-controlled `data` payload of an entry |
| 63 |
* before it is stored. Entry data frequently originates from low-trust, |
| 64 |
* even unauthenticated sources — public form submissions (Gravity Forms, |
| 65 |
* CF7, FluentForm, WPForms, Ninja Forms, WeForms, Formidable, …) and the |
| 66 |
* Zapier / IFTTT REST ingest — and is later rendered on the frontend. The |
| 67 |
* JS renderer only escapes string-typed values, so an array-wrapped value |
| 68 |
* (e.g. `name => ['<img src=x onerror=alert(1)>']`) is coerced back to its |
| 69 |
* raw string and injected via `dangerouslySetInnerHTML` — a stored XSS |
| 70 |
* (Patchstack, NotificationX Pro <= 3.1.3). insert_entry()/insert_entries() |
| 71 |
* are the single storage chokepoint every extension (Free and Pro) funnels |
| 72 |
* through, so sanitizing every string leaf here closes that class of issue |
| 73 |
* regardless of ingest path. Non-string scalars (ints, bools, timestamps) |
| 74 |
* are left untouched so downstream typing is preserved; only strings can |
| 75 |
* carry markup. |
| 76 |
* |
| 77 |
* @param mixed $data |
| 78 |
* @return mixed |
| 79 |
*/ |
| 80 |
public function sanitize_entry_data($data) { |
| 81 |
if (is_array($data)) { |
| 82 |
array_walk_recursive($data, function (&$val) { |
| 83 |
if (is_string($val)) { |
| 84 |
$val = sanitize_text_field($val); |
| 85 |
} |
| 86 |
}); |
| 87 |
} elseif (is_string($data)) { |
| 88 |
$data = sanitize_text_field($data); |
| 89 |
} |
| 90 |
return $data; |
| 91 |
} |
| 92 |
|
| 93 |
public function insert_entry($entry) { |
| 94 |
if(empty($entry['data'])){ |
| 95 |
return false; |
| 96 |
} |
| 97 |
$entry['data'] = $this->sanitize_entry_data($entry['data']); |
| 98 |
$timestamp = !empty($entry['data']['timestamp']) ? $entry['data']['timestamp'] : time(); |
| 99 |
if(empty($entry['created_at'])){ |
| 100 |
$entry['created_at'] = Helper::mysql_time($timestamp); |
| 101 |
} |
| 102 |
if(empty($entry['updated_at'])){ |
| 103 |
$entry['updated_at'] = Helper::mysql_time($timestamp); |
| 104 |
} |
| 105 |
$entry = apply_filters('nx_insert_entry', $entry); |
| 106 |
$result = Database::get_instance()->insert_post(Database::$table_entries, $entry, $this->format); |
| 107 |
if ( $result ) { |
| 108 |
do_action( 'nx_after_entry_inserted', $entry ); |
| 109 |
} |
| 110 |
return $result; |
| 111 |
} |
| 112 |
|
| 113 |
public function insert_entries($entries) { |
| 114 |
foreach ($entries as $key => $entry) { |
| 115 |
if(empty($entry['data'])){ |
| 116 |
unset($entries[$key]); |
| 117 |
continue; |
| 118 |
} |
| 119 |
$entry['data'] = $this->sanitize_entry_data($entry['data']); |
| 120 |
$timestamp = !empty($entry['data']['timestamp']) ? $entry['data']['timestamp'] : time(); |
| 121 |
if(empty($entry['created_at'])){ |
| 122 |
$entry['created_at'] = Helper::mysql_time($timestamp); |
| 123 |
} |
| 124 |
if(empty($entry['updated_at'])){ |
| 125 |
$entry['updated_at'] = Helper::mysql_time($timestamp); |
| 126 |
} |
| 127 |
$entries[$key] = apply_filters('nx_insert_entry', $entry); |
| 128 |
} |
| 129 |
return Database::get_instance()->insert_posts(Database::$table_entries, $entries, $this->format); |
| 130 |
} |
| 131 |
|
| 132 |
public function get_entries($where__or_nx_id = [], $select = "*", $join_table = '', $group_by_col = '', $data_in_entry = false) { |
| 133 |
if (is_int($where__or_nx_id)) { |
| 134 |
$where__or_nx_id = ['nx_id' => $where__or_nx_id]; |
| 135 |
} |
| 136 |
$entries = Database::get_instance()->get_posts(Database::$table_entries, $select, $where__or_nx_id, $join_table, $group_by_col, '', 'ORDER BY `created_at` DESC'); |
| 137 |
if ($data_in_entry) { |
| 138 |
$entries = apply_filters('nx_get_entries', $entries); |
| 139 |
return $entries; |
| 140 |
} |
| 141 |
foreach ($entries as $key => $value) { |
| 142 |
if (!empty($value['data'])) { |
| 143 |
$value = array_merge($value['data'], $value); |
| 144 |
unset($value['data']); |
| 145 |
} |
| 146 |
$entries[$key] = apply_filters('nx_get_entry', $value); |
| 147 |
} |
| 148 |
$entries = apply_filters('nx_get_entries', $entries); |
| 149 |
return $entries; |
| 150 |
} |
| 151 |
|
| 152 |
public function delete_entries($where__or_nx_id, $limit = 0) { |
| 153 |
if (!is_array($where__or_nx_id)) { |
| 154 |
$where__or_nx_id = ['nx_id' => $where__or_nx_id]; |
| 155 |
} |
| 156 |
$results = Database::get_instance()->delete_posts(Database::$table_entries, $where__or_nx_id, $limit); |
| 157 |
// @todo add action. |
| 158 |
return $results; |
| 159 |
} |
| 160 |
|
| 161 |
} |
| 162 |
|
