← All changes
|
includes/admin/reports/class-ph-report-incomplete-properties.php
+72
-18
1.4.49
→
2.4.0
View file →
| @@ -1,6 +1,9 @@ | ||
| 1 | 1 | <?php |
| 2 | +// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean | |
| 3 | +// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate. | |
| 2 | 4 | |
| 5 | + | |
| 3 | 6 | if ( ! defined( 'ABSPATH' ) ) { |
| 4 | 7 | exit; // Exit if accessed directly |
| 5 | 8 | } |
| 6 | 9 | |
| @@ -11,8 +14,9 @@ | ||
| 11 | 14 | * @category Admin |
| 12 | 15 | * @package PropertyHive/Admin/Reports |
| 13 | 16 | * @version 1.0.0 |
| 14 | 17 | */ |
| 18 | +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Report_Incomplete_Properties; preserving the existing PH_* class name is required for plugin and extension compatibility. | |
| 15 | 19 | class PH_Report_Incomplete_Properties extends PH_Admin_Report { |
| 16 | 20 | |
| 17 | 21 | /** |
| 18 | 22 | * Output the report. |
| @@ -38,15 +42,29 @@ | ||
| 38 | 42 | |
| 39 | 43 | <label for="missing">Show Properties Missing:</label> |
| 40 | 44 | <select name="missing" id="missing" style="width:100%;"> |
| 41 | 45 | <option value="">One or more items</option> |
| 42 | - <option value="_photos"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_photos' ) { echo ' selected'; } ?>>Photos</option> | |
| 43 | - <option value="_floorplans"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_floorplans' ) { echo ' selected'; } ?>>Floorplans</option> | |
| 44 | - <option value="_epcs"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_epcs' ) { echo ' selected'; } ?>>EPCS</option> | |
| 45 | - <option value="_brochures"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_brochures' ) { echo ' selected'; } ?>>Brochures</option> | |
| 46 | - <option value="_virtual_tours"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_virtual_tours' ) { echo ' selected'; } ?>>Virtual Tours</option> | |
| 47 | - <option value="summary"<?php if ( isset($_POST['missing']) && $_POST['missing'] == 'summary' ) { echo ' selected'; } ?>>Summary Description</option> | |
| 48 | - <option value="_latitude"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_latitude' ) { echo ' selected'; } ?>>Map Co-ordinates</option> | |
| 46 | + <option value="_photos"<?php | |
| 47 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 48 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_photos' ) { echo ' selected'; } ?>>Photos</option> | |
| 49 | + <option value="_floorplans"<?php | |
| 50 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 51 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_floorplans' ) { echo ' selected'; } ?>>Floorplans</option> | |
| 52 | + <option value="_epcs"<?php | |
| 53 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 54 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_epcs' ) { echo ' selected'; } ?>>EPCS</option> | |
| 55 | + <option value="_brochures"<?php | |
| 56 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 57 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_brochures' ) { echo ' selected'; } ?>>Brochures</option> | |
| 58 | + <option value="_virtual_tours"<?php | |
| 59 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 60 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_virtual_tours' ) { echo ' selected'; } ?>>Virtual Tours</option> | |
| 61 | + <option value="summary"<?php | |
| 62 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 63 | + if ( isset($_POST['missing']) && $_POST['missing'] == 'summary' ) { echo ' selected'; } ?>>Summary Description</option> | |
| 64 | + <option value="_latitude"<?php | |
| 65 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 66 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_latitude' ) { echo ' selected'; } ?>>Map Co-ordinates</option> | |
| 49 | 67 | </select> |
| 50 | 68 | |
| 51 | 69 | <br><br> |
| 52 | 70 | |
| @@ -60,11 +78,12 @@ | ||
| 60 | 78 | foreach ( $departments as $key => $value ) |
| 61 | 79 | { |
| 62 | 80 | if ( get_option( 'propertyhive_active_departments_' . str_replace("residential-", "", $key) ) == 'yes' ) |
| 63 | 81 | { |
| 64 | - echo '<option value="' . $key . '"'; | |
| 82 | + echo '<option value="' . esc_attr($key) . '"'; | |
| 83 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 65 | 84 | if ( isset($_POST['department']) && $_POST['department'] == $key ) { echo ' selected'; } |
| 66 | - echo '>' . $value . '</option>'; | |
| 85 | + echo '>' . esc_html($value) . '</option>'; | |
| 67 | 86 | } |
| 68 | 87 | } |
| 69 | 88 | ?> |
| 70 | 89 | </select> |
| @@ -72,10 +91,14 @@ | ||
| 72 | 91 | <br><br> |
| 73 | 92 | |
| 74 | 93 | <label for="on_market">Market Status:</label> |
| 75 | 94 | <select name="on_market" id="on_market" style="width:100%;"> |
| 76 | - <option value=""<?php if ( isset($_POST['on_market']) && $_POST['on_market'] == '' ) { echo ' selected'; } ?>>On Market Properties Only</option> | |
| 77 | - <option value="all"<?php if ( isset($_POST['on_market']) && $_POST['on_market'] == 'all' ) { echo ' selected'; } ?>>All Properties</option> | |
| 95 | + <option value=""<?php | |
| 96 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 97 | + if ( isset($_POST['on_market']) && $_POST['on_market'] == '' ) { echo ' selected'; } ?>>On Market Properties Only</option> | |
| 98 | + <option value="all"<?php | |
| 99 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 100 | + if ( isset($_POST['on_market']) && $_POST['on_market'] == 'all' ) { echo ' selected'; } ?>>All Properties</option> | |
| 78 | 101 | </select> |
| 79 | 102 | |
| 80 | 103 | <br><br> |
| 81 | 104 | |
| @@ -84,8 +107,10 @@ | ||
| 84 | 107 | <option value="">All Offices</option> |
| 85 | 108 | <?php |
| 86 | 109 | $args = array( |
| 87 | 110 | 'post_type' => 'office', |
| 111 | + 'orderby' => 'post_title', | |
| 112 | + 'order' => 'ASC', | |
| 88 | 113 | 'nopaging' => true, |
| 89 | 114 | ); |
| 90 | 115 | |
| 91 | 116 | $office_query = new WP_Query( $args ); |
| @@ -95,9 +120,11 @@ | ||
| 95 | 120 | while ( $office_query->have_posts() ) |
| 96 | 121 | { |
| 97 | 122 | $office_query->the_post(); |
| 98 | 123 | ?> |
| 99 | - <option value="<?php echo get_the_ID(); ?>"<?php if ( isset($_POST['office_id']) && ($_POST['office_id'] == get_the_ID()) ) { echo ' selected'; } ?>><?php echo get_the_title(get_the_ID()); ?></option> | |
| 124 | + <option value="<?php | |
| 125 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 126 | + echo esc_attr(get_the_ID()); ?>"<?php if ( isset($_POST['office_id']) && ($_POST['office_id'] == get_the_ID()) ) { echo ' selected'; } ?>><?php echo esc_html(get_the_title(get_the_ID())); ?></option> | |
| 100 | 127 | <?php |
| 101 | 128 | } |
| 102 | 129 | } |
| 103 | 130 | |
| @@ -122,8 +149,9 @@ | ||
| 122 | 149 | ); |
| 123 | 150 | |
| 124 | 151 | $meta_query = array('relation' => 'AND'); |
| 125 | 152 | |
| 153 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 126 | 154 | if ( isset($_POST['on_market']) && $_POST['on_market'] == 'all' ) |
| 127 | 155 | { |
| 128 | 156 | |
| 129 | 157 | } |
| @@ -134,24 +162,29 @@ | ||
| 134 | 162 | 'value' => 'yes', |
| 135 | 163 | ); |
| 136 | 164 | } |
| 137 | 165 | |
| 138 | - if ( isset($_POST['department']) && $_POST['department'] != '' ) | |
| 166 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 167 | + if ( isset($_POST['department']) && is_string( $_POST['department'] ) && $_POST['department'] != '' ) | |
| 139 | 168 | { |
| 140 | 169 | $meta_query[] = array( |
| 141 | 170 | 'key' => '_department', |
| 142 | - 'value' => ph_clean($_POST['department']), | |
| 171 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 172 | + 'value' => ph_clean( wp_unslash( $_POST['department'] ) ), | |
| 143 | 173 | ); |
| 144 | 174 | } |
| 145 | 175 | |
| 146 | - if ( isset($_POST['office_id']) && $_POST['office_id'] != '' ) | |
| 176 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 177 | + if ( isset($_POST['office_id']) && is_scalar( $_POST['office_id'] ) && $_POST['office_id'] != '' ) | |
| 147 | 178 | { |
| 148 | 179 | $meta_query[] = array( |
| 149 | 180 | 'key' => '_office_id', |
| 181 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 150 | 182 | 'value' => (int)$_POST['office_id'] |
| 151 | 183 | ); |
| 152 | 184 | } |
| 153 | 185 | |
| 186 | + // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Incomplete-property report must filter existing department, office and market metadata before inspecting all matching properties; the query retrieves IDs only. | |
| 154 | 187 | $args['meta_query'] = $meta_query; |
| 155 | 188 | |
| 156 | 189 | $property_query = new WP_Query( $args ); |
| 157 | 190 | |
| @@ -170,10 +203,13 @@ | ||
| 170 | 203 | |
| 171 | 204 | $missing = array(); |
| 172 | 205 | |
| 173 | 206 | if ( |
| 207 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 174 | 208 | (isset($_POST['missing']) && $_POST['missing'] == '_photos') || |
| 209 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 175 | 210 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 211 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 176 | 212 | !isset($_POST['missing']) |
| 177 | 213 | ) |
| 178 | 214 | { |
| 179 | 215 | $photo = $property->get_main_photo_src(); |
| @@ -183,10 +219,13 @@ | ||
| 183 | 219 | } |
| 184 | 220 | } |
| 185 | 221 | |
| 186 | 222 | if ( |
| 223 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 187 | 224 | (isset($_POST['missing']) && $_POST['missing'] == '_floorplans') || |
| 225 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 188 | 226 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 227 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 189 | 228 | !isset($_POST['missing']) |
| 190 | 229 | ) |
| 191 | 230 | { |
| 192 | 231 | if ( get_option('propertyhive_brochures_stored_as', '') == 'urls' ) |
| @@ -211,10 +250,13 @@ | ||
| 211 | 250 | } |
| 212 | 251 | } |
| 213 | 252 | |
| 214 | 253 | if ( |
| 254 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 215 | 255 | (isset($_POST['missing']) && $_POST['missing'] == '_epcs') || |
| 256 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 216 | 257 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 258 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 217 | 259 | !isset($_POST['missing']) |
| 218 | 260 | ) |
| 219 | 261 | { |
| 220 | 262 | if ( get_option('propertyhive_epcs_stored_as', '') == 'urls' ) |
| @@ -239,10 +281,13 @@ | ||
| 239 | 281 | } |
| 240 | 282 | } |
| 241 | 283 | |
| 242 | 284 | if ( |
| 285 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 243 | 286 | (isset($_POST['missing']) && $_POST['missing'] == '_brochures') || |
| 287 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 244 | 288 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 289 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 245 | 290 | !isset($_POST['missing']) |
| 246 | 291 | ) |
| 247 | 292 | { |
| 248 | 293 | if ( get_option('propertyhive_brochures_stored_as', '') == 'urls' ) |
| @@ -267,10 +312,13 @@ | ||
| 267 | 312 | } |
| 268 | 313 | } |
| 269 | 314 | |
| 270 | 315 | if ( |
| 316 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 271 | 317 | (isset($_POST['missing']) && $_POST['missing'] == '_virtual_tours') || |
| 318 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 272 | 319 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 320 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 273 | 321 | !isset($_POST['missing']) |
| 274 | 322 | ) |
| 275 | 323 | { |
| 276 | 324 | $virtual_tours = $property->get_virtual_tour_urls(); |
| @@ -280,10 +328,13 @@ | ||
| 280 | 328 | } |
| 281 | 329 | } |
| 282 | 330 | |
| 283 | 331 | if ( |
| 332 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 284 | 333 | (isset($_POST['missing']) && $_POST['missing'] == 'summary') || |
| 334 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 285 | 335 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 336 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 286 | 337 | !isset($_POST['missing']) |
| 287 | 338 | ) |
| 288 | 339 | { |
| 289 | 340 | $summary = $property->post_excerpt; |
| @@ -293,10 +344,13 @@ | ||
| 293 | 344 | } |
| 294 | 345 | } |
| 295 | 346 | |
| 296 | 347 | if ( |
| 348 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 297 | 349 | (isset($_POST['missing']) && $_POST['missing'] == '_latitude') || |
| 350 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 298 | 351 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 352 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 299 | 353 | !isset($_POST['missing']) |
| 300 | 354 | ) |
| 301 | 355 | { |
| 302 | 356 | $latitude = $property->latitude; |
| @@ -309,11 +363,11 @@ | ||
| 309 | 363 | if ( !empty($missing) ) |
| 310 | 364 | { |
| 311 | 365 | echo '<tr>'; |
| 312 | 366 | |
| 313 | - echo '<td><a href="' . get_edit_post_link( get_the_ID() ) . '">' . $property->get_formatted_full_address() . '</a></td>'; | |
| 367 | + echo '<td><a href="' . esc_url(get_edit_post_link( get_the_ID() )) . '">' . esc_html($property->get_formatted_full_address()) . '</a></td>'; | |
| 314 | 368 | |
| 315 | - echo '<td>' . implode(", ", $missing) . '</td>'; | |
| 369 | + echo '<td>' . esc_html(implode(", ", $missing)) . '</td>'; | |
| 316 | 370 | |
| 317 | 371 | echo '</tr>'; |
| 318 | 372 | } |
| 319 | 373 | } |
| @@ -328,5 +382,5 @@ | ||
| 328 | 382 | |
| 329 | 383 | <?php |
| 330 | 384 | } |
| 331 | 385 | |
| 332 | -} | |
| 386 | +} | |