← All changes | classes/class-query.php +19 -129 3.0.0 → 3.4.2 View file →

		@@ -2,13 +2,8 @@
2	2	namespace WP_Stream;
3	3
4	4	class Query {
5	5	/**
6		- * @var DB
7		- */
8		- public $db;
9		-
10		- /**
11	6	* Hold the number of records found
12	7	*
13	8	* @var int
14	9	*/
		@@ -14,17 +9,8 @@
14	9	*/
15	10	public $found_records = 0;
16	11
17	12	/**
18		- * Class constructor.
19		- *
20		- * @param DB $db The parent database class.
21		- */
22		- public function __construct( $db ) {
23		- $this->db = $db;
24		- }
25		-
26		- /**
27	13	* Query records
28	14	*
29	15	* @param array Query args
30	16	*
		@@ -32,72 +18,8 @@
32	18	*/
33	19	public function query( $args ) {
34	20	global $wpdb;
35	21
36		- $defaults = array(
37		- // Search param
38		- 'search' => null,
39		- 'search_field' => 'summary',
40		- 'record_after' => null, // Deprecated, use date_after instead
41		- // Date-based filters
42		- 'date' => null, // Ex: 2015-07-01
43		- 'date_from' => null, // Ex: 2015-07-01
44		- 'date_to' => null, // Ex: 2015-07-01
45		- 'date_after' => null, // Ex: 2015-07-01T15:19:21+00:00
46		- 'date_before' => null, // Ex: 2015-07-01T15:19:21+00:00
47		- // Record ID filters
48		- 'record' => null,
49		- 'record__in' => array(),
50		- 'record__not_in' => array(),
51		- // Pagination params
52		- 'records_per_page' => get_option( 'posts_per_page', 20 ),
53		- 'paged' => 1,
54		- // Order
55		- 'order' => 'desc',
56		- 'orderby' => 'date',
57		- // Fields selection
58		- 'fields' => array(),
59		- );
60		-
61		- // Additional property fields
62		- $properties = array(
63		- 'user_id' => null,
64		- 'user_role' => null,
65		- 'ip' => null,
66		- 'object_id' => null,
67		- 'site_id' => null,
68		- 'blog_id' => null,
69		- 'connector' => null,
70		- 'context' => null,
71		- 'action' => null,
72		- );
73		-
74		- /**
75		- * Filter allows additional query properties to be added
76		- *
77		- * @return array Array of query properties
78		- */
79		- $properties = apply_filters( 'wp_stream_query_properties', $properties );
80		-
81		- // Add property fields to defaults, including their __in/__not_in variations
82		- foreach ( $properties as $property => $default ) {
83		- if ( ! isset( $defaults[ $property ] ) ) {
84		- $defaults[ $property ] = $default;
85		- }
86		-
87		- $defaults[ "{$property}__in" ] = array();
88		- $defaults[ "{$property}__not_in" ] = array();
89		- }
90		-
91		- $args = wp_parse_args( $args, $defaults );
92		-
93		- /**
94		- * Filter allows additional arguments to query $args
95		- *
96		- * @return array Array of query arguments
97		- */
98		- $args = apply_filters( 'wp_stream_query_args', $args );
99		-
100	22	$join = '';
101	23	$where = '';
102	24
103	25	/**
		@@ -123,10 +45,15 @@
123	45	$where .= $wpdb->prepare( " AND $wpdb->stream.user_role = %s", $args['user_role'] );
124	46	}
125	47
126	48	if ( ! empty( $args['search'] ) ) {
127		- $field = ! empty( $args['search_field'] ) ? $args['search_field'] : 'summary';
128		- $where .= $wpdb->prepare( " AND $wpdb->stream.{$field} LIKE %s", "%{$args['search']}%" );
	49	+ $field = ! empty( $args['search_field'] ) ? $args['search_field'] : 'summary';
	50	+
	51	+ // Sanitize field
	52	+ $allowed_fields = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'created', 'summary', 'connector', 'context', 'action', 'ip' );
	53	+ if ( in_array( $field, $allowed_fields, true ) ) {
	54	+ $where .= $wpdb->prepare( " AND $wpdb->stream.{$field} LIKE %s", "%{$args['search']}%" ); // @codingStandardsIgnoreLine can't prepare column name
	55	+ }
129	56	}
130	57
131	58	if ( ! empty( $args['connector'] ) ) {
132	59	$where .= $wpdb->prepare( " AND $wpdb->stream.connector = %s", $args['connector'] );
		@@ -146,8 +73,13 @@
146	73
147	74	/**
148	75	* PARSE DATE PARAM FAMILY
149	76	*/
	77	+ if ( ! empty( $args['date'] ) ) {
	78	+ $args['date_from'] = $args['date'];
	79	+ $args['date_to'] = $args['date'];
	80	+ }
	81	+
150	82	if ( ! empty( $args['date_from'] ) ) {
151	83	$date = get_gmt_from_date( date( 'Y-m-d H:i:s', strtotime( $args['date_from'] . ' 00:00:00' ) ) );
152	84	$where .= $wpdb->prepare( " AND DATE($wpdb->stream.created) >= %s", $date );
153	85	}
		@@ -166,13 +98,8 @@
166	98	$date = get_gmt_from_date( date( 'Y-m-d H:i:s', strtotime( $args['date_before'] ) ) );
167	99	$where .= $wpdb->prepare( " AND DATE($wpdb->stream.created) < %s", $date );
168	100	}
169	101
170		- if ( ! empty( $args['date'] ) ) {
171		- $args['date_from'] = date( 'Y-m-d', strtotime( $args['date'] ) ) . ' 00:00:00';
172		- $args['date_to'] = date( 'Y-m-d', strtotime( $args['date'] ) ) . ' 23:59:59';
173		- }
174		-
175	102	/**
176	103	* PARSE __IN PARAM FAMILY
177	104	*/
178	105	$ins = array();
		@@ -194,9 +121,9 @@
194	121	$type = is_numeric( array_shift( $value ) ) ? '%d' : '%s';
195	122
196	123	if ( ! empty( $value ) ) {
197	124	$format = '(' . join( ',', array_fill( 0, count( $value ), $type ) ) . ')';
198		- $where .= $wpdb->prepare( " AND $wpdb->stream.%s IN {$format}", $field, $value );
	125	+ $where .= $wpdb->prepare( " AND $wpdb->stream.%s IN {$format}", $field, $value ); // @codingStandardsIgnoreLine prepare okay
199	126	}
200	127	}
201	128	}
202	129
		@@ -222,9 +149,9 @@
222	149	$type = is_numeric( array_shift( $value ) ) ? '%d' : '%s';
223	150
224	151	if ( ! empty( $value ) ) {
225	152	$format = '(' . join( ',', array_fill( 0, count( $value ), $type ) ) . ')';
226		- $where .= $wpdb->prepare( " AND $wpdb->stream.%s NOT IN {$format}", $field, $value );
	153	+ $where .= $wpdb->prepare( " AND $wpdb->stream.%s NOT IN {$format}", $field, $value ); // @codingStandardsIgnoreLine prepare okay
227	154	}
228	155	}
229	156	}
230	157
		@@ -246,9 +173,9 @@
246	173	$order = esc_sql( $args['order'] );
247	174	$orderby = esc_sql( $args['orderby'] );
248	175	$orderable = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'summary', 'created', 'connector', 'context', 'action' );
249	176
250		- if ( in_array( $orderby, $orderable ) ) {
	177	+ if ( in_array( $orderby, $orderable, true ) ) {
251	178	$orderby = sprintf( '%s.%s', $wpdb->stream, $orderby );
252	179	} elseif ( 'meta_value_num' === $orderby && ! empty( $args['meta_key'] ) ) {
253	180	$orderby = "CAST($wpdb->streammeta.meta_value AS SIGNED)";
254	181	} elseif ( 'meta_value' === $orderby && ! empty( $args['meta_key'] ) ) {
		@@ -299,51 +226,14 @@
299	226	* @return string
300	227	*/
301	228	$query = apply_filters( 'wp_stream_db_query', $query, $args );
302	229
	230	+ $result = array();
303	231	/**
304	232	* QUERY THE DATABASE FOR RESULTS
305	233	*/
306		- $results = $wpdb->get_results( $query );
	234	+ $result['items'] = $wpdb->get_results( $query ); // @codingStandardsIgnoreLine $query already prepared
	235	+ $result['count'] = $result['items'] ? absint( $wpdb->get_var( 'SELECT FOUND_ROWS()' ) ) : 0;
307	236
308		- // Hold the number of records found
309		- $this->found_records = absint( $wpdb->get_var( 'SELECT FOUND_ROWS()' ) );
310		-
311		- // Add meta to the records, when applicable
312		- if ( empty( $fields ) || in_array( 'meta', $fields ) ) {
313		- $results = $this->add_record_meta( $results );
314		- }
315		-
316		- return (array) $results;
317		- }
318		-
319		- /**
320		- * Add meta to a set of records
321		- *
322		- * @param array $records
323		- *
324		- * @return array
325		- */
326		- public function add_record_meta( $records ) {
327		- global $wpdb;
328		-
329		- $record_ids = array_map( 'absint', wp_list_pluck( $records, 'ID' ) );
330		-
331		- if ( empty( $record_ids ) ) {
332		- return (array) $records;
333		- }
334		-
335		- $sql_meta = sprintf(
336		- "SELECT * FROM $wpdb->streammeta WHERE record_id IN ( %s )",
337		- implode( ',', $record_ids )
338		- );
339		-
340		- $meta = $wpdb->get_results( $sql_meta );
341		- $ids_f = array_flip( $record_ids );
342		-
343		- foreach ( $meta as $meta_record ) {
344		- $records[ $ids_f[ $meta_record->record_id ] ]->meta[ $meta_record->meta_key ] = maybe_unserialize( $meta_record->meta_value );
345		- }
346		-
347		- return (array) $records;
	237	+ return $result;
348	238	}
349	239	}