← All changes
|
includes/admin/reports/class-ph-report-incomplete-properties.php
+66
-14
2.2.4
→
2.4.0
View file →
| @@ -1,6 +1,9 @@ | ||
| 1 | 1 | <?php |
| 2 | +// phpcs:set WordPress.Security.ValidatedSanitizedInput customSanitizingFunctions[] ph_clean | |
| 3 | +// ph_clean() recursively sanitizes text; presence, shape and unslashing checks remain separate. | |
| 2 | 4 | |
| 5 | + | |
| 3 | 6 | if ( ! defined( 'ABSPATH' ) ) { |
| 4 | 7 | exit; // Exit if accessed directly |
| 5 | 8 | } |
| 6 | 9 | |
| @@ -11,8 +14,9 @@ | ||
| 11 | 14 | * @category Admin |
| 12 | 15 | * @package PropertyHive/Admin/Reports |
| 13 | 16 | * @version 1.0.0 |
| 14 | 17 | */ |
| 18 | +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Report_Incomplete_Properties; preserving the existing PH_* class name is required for plugin and extension compatibility. | |
| 15 | 19 | class PH_Report_Incomplete_Properties extends PH_Admin_Report { |
| 16 | 20 | |
| 17 | 21 | /** |
| 18 | 22 | * Output the report. |
| @@ -38,15 +42,29 @@ | ||
| 38 | 42 | |
| 39 | 43 | <label for="missing">Show Properties Missing:</label> |
| 40 | 44 | <select name="missing" id="missing" style="width:100%;"> |
| 41 | 45 | <option value="">One or more items</option> |
| 42 | - <option value="_photos"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_photos' ) { echo ' selected'; } ?>>Photos</option> | |
| 43 | - <option value="_floorplans"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_floorplans' ) { echo ' selected'; } ?>>Floorplans</option> | |
| 44 | - <option value="_epcs"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_epcs' ) { echo ' selected'; } ?>>EPCS</option> | |
| 45 | - <option value="_brochures"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_brochures' ) { echo ' selected'; } ?>>Brochures</option> | |
| 46 | - <option value="_virtual_tours"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_virtual_tours' ) { echo ' selected'; } ?>>Virtual Tours</option> | |
| 47 | - <option value="summary"<?php if ( isset($_POST['missing']) && $_POST['missing'] == 'summary' ) { echo ' selected'; } ?>>Summary Description</option> | |
| 48 | - <option value="_latitude"<?php if ( isset($_POST['missing']) && $_POST['missing'] == '_latitude' ) { echo ' selected'; } ?>>Map Co-ordinates</option> | |
| 46 | + <option value="_photos"<?php | |
| 47 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 48 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_photos' ) { echo ' selected'; } ?>>Photos</option> | |
| 49 | + <option value="_floorplans"<?php | |
| 50 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 51 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_floorplans' ) { echo ' selected'; } ?>>Floorplans</option> | |
| 52 | + <option value="_epcs"<?php | |
| 53 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 54 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_epcs' ) { echo ' selected'; } ?>>EPCS</option> | |
| 55 | + <option value="_brochures"<?php | |
| 56 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 57 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_brochures' ) { echo ' selected'; } ?>>Brochures</option> | |
| 58 | + <option value="_virtual_tours"<?php | |
| 59 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 60 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_virtual_tours' ) { echo ' selected'; } ?>>Virtual Tours</option> | |
| 61 | + <option value="summary"<?php | |
| 62 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 63 | + if ( isset($_POST['missing']) && $_POST['missing'] == 'summary' ) { echo ' selected'; } ?>>Summary Description</option> | |
| 64 | + <option value="_latitude"<?php | |
| 65 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 66 | + if ( isset($_POST['missing']) && $_POST['missing'] == '_latitude' ) { echo ' selected'; } ?>>Map Co-ordinates</option> | |
| 49 | 67 | </select> |
| 50 | 68 | |
| 51 | 69 | <br><br> |
| 52 | 70 | |
| @@ -61,8 +79,9 @@ | ||
| 61 | 79 | { |
| 62 | 80 | if ( get_option( 'propertyhive_active_departments_' . str_replace("residential-", "", $key) ) == 'yes' ) |
| 63 | 81 | { |
| 64 | 82 | echo '<option value="' . esc_attr($key) . '"'; |
| 83 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 65 | 84 | if ( isset($_POST['department']) && $_POST['department'] == $key ) { echo ' selected'; } |
| 66 | 85 | echo '>' . esc_html($value) . '</option>'; |
| 67 | 86 | } |
| 68 | 87 | } |
| @@ -72,10 +91,14 @@ | ||
| 72 | 91 | <br><br> |
| 73 | 92 | |
| 74 | 93 | <label for="on_market">Market Status:</label> |
| 75 | 94 | <select name="on_market" id="on_market" style="width:100%;"> |
| 76 | - <option value=""<?php if ( isset($_POST['on_market']) && $_POST['on_market'] == '' ) { echo ' selected'; } ?>>On Market Properties Only</option> | |
| 77 | - <option value="all"<?php if ( isset($_POST['on_market']) && $_POST['on_market'] == 'all' ) { echo ' selected'; } ?>>All Properties</option> | |
| 95 | + <option value=""<?php | |
| 96 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 97 | + if ( isset($_POST['on_market']) && $_POST['on_market'] == '' ) { echo ' selected'; } ?>>On Market Properties Only</option> | |
| 98 | + <option value="all"<?php | |
| 99 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 100 | + if ( isset($_POST['on_market']) && $_POST['on_market'] == 'all' ) { echo ' selected'; } ?>>All Properties</option> | |
| 78 | 101 | </select> |
| 79 | 102 | |
| 80 | 103 | <br><br> |
| 81 | 104 | |
| @@ -97,9 +120,11 @@ | ||
| 97 | 120 | while ( $office_query->have_posts() ) |
| 98 | 121 | { |
| 99 | 122 | $office_query->the_post(); |
| 100 | 123 | ?> |
| 101 | - <option value="<?php echo esc_attr(get_the_ID()); ?>"<?php if ( isset($_POST['office_id']) && ($_POST['office_id'] == get_the_ID()) ) { echo ' selected'; } ?>><?php echo esc_html(get_the_title(get_the_ID())); ?></option> | |
| 124 | + <option value="<?php | |
| 125 | +// phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 126 | + echo esc_attr(get_the_ID()); ?>"<?php if ( isset($_POST['office_id']) && ($_POST['office_id'] == get_the_ID()) ) { echo ' selected'; } ?>><?php echo esc_html(get_the_title(get_the_ID())); ?></option> | |
| 102 | 127 | <?php |
| 103 | 128 | } |
| 104 | 129 | } |
| 105 | 130 | |
| @@ -124,8 +149,9 @@ | ||
| 124 | 149 | ); |
| 125 | 150 | |
| 126 | 151 | $meta_query = array('relation' => 'AND'); |
| 127 | 152 | |
| 153 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 128 | 154 | if ( isset($_POST['on_market']) && $_POST['on_market'] == 'all' ) |
| 129 | 155 | { |
| 130 | 156 | |
| 131 | 157 | } |
| @@ -136,24 +162,29 @@ | ||
| 136 | 162 | 'value' => 'yes', |
| 137 | 163 | ); |
| 138 | 164 | } |
| 139 | 165 | |
| 140 | - if ( isset($_POST['department']) && $_POST['department'] != '' ) | |
| 166 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 167 | + if ( isset($_POST['department']) && is_string( $_POST['department'] ) && $_POST['department'] != '' ) | |
| 141 | 168 | { |
| 142 | 169 | $meta_query[] = array( |
| 143 | 170 | 'key' => '_department', |
| 144 | - 'value' => ph_clean($_POST['department']), | |
| 171 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 172 | + 'value' => ph_clean( wp_unslash( $_POST['department'] ) ), | |
| 145 | 173 | ); |
| 146 | 174 | } |
| 147 | 175 | |
| 148 | - if ( isset($_POST['office_id']) && $_POST['office_id'] != '' ) | |
| 176 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 177 | + if ( isset($_POST['office_id']) && is_scalar( $_POST['office_id'] ) && $_POST['office_id'] != '' ) | |
| 149 | 178 | { |
| 150 | 179 | $meta_query[] = array( |
| 151 | 180 | 'key' => '_office_id', |
| 181 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 152 | 182 | 'value' => (int)$_POST['office_id'] |
| 153 | 183 | ); |
| 154 | 184 | } |
| 155 | 185 | |
| 186 | + // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Incomplete-property report must filter existing department, office and market metadata before inspecting all matching properties; the query retrieves IDs only. | |
| 156 | 187 | $args['meta_query'] = $meta_query; |
| 157 | 188 | |
| 158 | 189 | $property_query = new WP_Query( $args ); |
| 159 | 190 | |
| @@ -172,10 +203,13 @@ | ||
| 172 | 203 | |
| 173 | 204 | $missing = array(); |
| 174 | 205 | |
| 175 | 206 | if ( |
| 207 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 176 | 208 | (isset($_POST['missing']) && $_POST['missing'] == '_photos') || |
| 209 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 177 | 210 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 211 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 178 | 212 | !isset($_POST['missing']) |
| 179 | 213 | ) |
| 180 | 214 | { |
| 181 | 215 | $photo = $property->get_main_photo_src(); |
| @@ -185,10 +219,13 @@ | ||
| 185 | 219 | } |
| 186 | 220 | } |
| 187 | 221 | |
| 188 | 222 | if ( |
| 223 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 189 | 224 | (isset($_POST['missing']) && $_POST['missing'] == '_floorplans') || |
| 225 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 190 | 226 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 227 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 191 | 228 | !isset($_POST['missing']) |
| 192 | 229 | ) |
| 193 | 230 | { |
| 194 | 231 | if ( get_option('propertyhive_brochures_stored_as', '') == 'urls' ) |
| @@ -213,10 +250,13 @@ | ||
| 213 | 250 | } |
| 214 | 251 | } |
| 215 | 252 | |
| 216 | 253 | if ( |
| 254 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 217 | 255 | (isset($_POST['missing']) && $_POST['missing'] == '_epcs') || |
| 256 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 218 | 257 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 258 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 219 | 259 | !isset($_POST['missing']) |
| 220 | 260 | ) |
| 221 | 261 | { |
| 222 | 262 | if ( get_option('propertyhive_epcs_stored_as', '') == 'urls' ) |
| @@ -241,10 +281,13 @@ | ||
| 241 | 281 | } |
| 242 | 282 | } |
| 243 | 283 | |
| 244 | 284 | if ( |
| 285 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 245 | 286 | (isset($_POST['missing']) && $_POST['missing'] == '_brochures') || |
| 287 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 246 | 288 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 289 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 247 | 290 | !isset($_POST['missing']) |
| 248 | 291 | ) |
| 249 | 292 | { |
| 250 | 293 | if ( get_option('propertyhive_brochures_stored_as', '') == 'urls' ) |
| @@ -269,10 +312,13 @@ | ||
| 269 | 312 | } |
| 270 | 313 | } |
| 271 | 314 | |
| 272 | 315 | if ( |
| 316 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 273 | 317 | (isset($_POST['missing']) && $_POST['missing'] == '_virtual_tours') || |
| 318 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 274 | 319 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 320 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 275 | 321 | !isset($_POST['missing']) |
| 276 | 322 | ) |
| 277 | 323 | { |
| 278 | 324 | $virtual_tours = $property->get_virtual_tour_urls(); |
| @@ -282,10 +328,13 @@ | ||
| 282 | 328 | } |
| 283 | 329 | } |
| 284 | 330 | |
| 285 | 331 | if ( |
| 332 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 286 | 333 | (isset($_POST['missing']) && $_POST['missing'] == 'summary') || |
| 334 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 287 | 335 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 336 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 288 | 337 | !isset($_POST['missing']) |
| 289 | 338 | ) |
| 290 | 339 | { |
| 291 | 340 | $summary = $property->post_excerpt; |
| @@ -295,10 +344,13 @@ | ||
| 295 | 344 | } |
| 296 | 345 | } |
| 297 | 346 | |
| 298 | 347 | if ( |
| 348 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 299 | 349 | (isset($_POST['missing']) && $_POST['missing'] == '_latitude') || |
| 350 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 300 | 351 | (isset($_POST['missing']) && $_POST['missing'] == '') || |
| 352 | + // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only report filters and form display on the authorized CRM reports screen. | |
| 301 | 353 | !isset($_POST['missing']) |
| 302 | 354 | ) |
| 303 | 355 | { |
| 304 | 356 | $latitude = $property->latitude; |
| @@ -330,5 +382,5 @@ | ||
| 330 | 382 | |
| 331 | 383 | <?php |
| 332 | 384 | } |
| 333 | 385 | |
| 334 | -} | |
| 386 | +} | |