← All changes | classes/class-query.php +23 -74 4.2.2 → 3.4.2 View file →

		@@ -1,19 +1,8 @@
1	1	<?php
2		-/**
3		- * Queries the database for stream records.
4		- *
5		- * @package WP_Stream
6		- */
7		-
8	2	namespace WP_Stream;
9	3
10		-/**
11		- * Class - Query
12		- */
13	4	class Query {
14		- const ALLOWED_FIELDS = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'created', 'summary', 'connector', 'context', 'action', 'ip' );
15		-
16	5	/**
17	6	* Hold the number of records found
18	7	*
19	8	* @var int
		@@ -22,9 +11,9 @@
22	11
23	12	/**
24	13	* Query records
25	14	*
26		- * @param array $args Arguments to filter the records by.
	15	+ * @param array Query args
27	16	*
28	17	* @return array Stream Records
29	18	*/
30	19	public function query( $args ) {
		@@ -58,10 +47,11 @@
58	47
59	48	if ( ! empty( $args['search'] ) ) {
60	49	$field = ! empty( $args['search_field'] ) ? $args['search_field'] : 'summary';
61	50
62		- // Sanitize field.
63		- if ( in_array( $field, self::ALLOWED_FIELDS, true ) ) {
	51	+ // Sanitize field
	52	+ $allowed_fields = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'created', 'summary', 'connector', 'context', 'action', 'ip' );
	53	+ if ( in_array( $field, $allowed_fields, true ) ) {
64	54	$where .= $wpdb->prepare( " AND $wpdb->stream.{$field} LIKE %s", "%{$args['search']}%" ); // @codingStandardsIgnoreLine can't prepare column name
65	55	}
66	56	}
67	57
		@@ -89,24 +79,24 @@
89	79	$args['date_to'] = $args['date'];
90	80	}
91	81
92	82	if ( ! empty( $args['date_from'] ) ) {
93		- $date = get_gmt_from_date( gmdate( 'Y-m-d H:i:s', strtotime( $args['date_from'] . ' 00:00:00' ) ) );
	83	+ $date = get_gmt_from_date( date( 'Y-m-d H:i:s', strtotime( $args['date_from'] . ' 00:00:00' ) ) );
94	84	$where .= $wpdb->prepare( " AND DATE($wpdb->stream.created) >= %s", $date );
95	85	}
96	86
97	87	if ( ! empty( $args['date_to'] ) ) {
98		- $date = get_gmt_from_date( gmdate( 'Y-m-d H:i:s', strtotime( $args['date_to'] . ' 23:59:59' ) ) );
	88	+ $date = get_gmt_from_date( date( 'Y-m-d H:i:s', strtotime( $args['date_to'] . ' 23:59:59' ) ) );
99	89	$where .= $wpdb->prepare( " AND DATE($wpdb->stream.created) <= %s", $date );
100	90	}
101	91
102	92	if ( ! empty( $args['date_after'] ) ) {
103		- $date = get_gmt_from_date( gmdate( 'Y-m-d H:i:s', strtotime( $args['date_after'] ) ) );
	93	+ $date = get_gmt_from_date( date( 'Y-m-d H:i:s', strtotime( $args['date_after'] ) ) );
104	94	$where .= $wpdb->prepare( " AND DATE($wpdb->stream.created) > %s", $date );
105	95	}
106	96
107	97	if ( ! empty( $args['date_before'] ) ) {
108		- $date = get_gmt_from_date( gmdate( 'Y-m-d H:i:s', strtotime( $args['date_before'] ) ) );
	98	+ $date = get_gmt_from_date( date( 'Y-m-d H:i:s', strtotime( $args['date_before'] ) ) );
109	99	$where .= $wpdb->prepare( " AND DATE($wpdb->stream.created) < %s", $date );
110	100	}
111	101
112	102	/**
		@@ -179,29 +169,24 @@
179	169
180	170	/**
181	171	* PARSE ORDER PARAMS
182	172	*/
	173	+ $order = esc_sql( $args['order'] );
	174	+ $orderby = esc_sql( $args['orderby'] );
183	175	$orderable = array( 'ID', 'site_id', 'blog_id', 'object_id', 'user_id', 'user_role', 'summary', 'created', 'connector', 'context', 'action' );
184	176
185		- // Default to sorting by record ID.
186		- $orderby = "$wpdb->stream.ID";
187		-
188		- if ( in_array( $args['orderby'], $orderable, true ) ) {
189		- $orderby = sprintf( '%s.%s', $wpdb->stream, $args['orderby'] );
190		- } elseif ( 'meta_value_num' === $args['orderby'] && ! empty( $args['meta_key'] ) ) {
	177	+ if ( in_array( $orderby, $orderable, true ) ) {
	178	+ $orderby = sprintf( '%s.%s', $wpdb->stream, $orderby );
	179	+ } elseif ( 'meta_value_num' === $orderby && ! empty( $args['meta_key'] ) ) {
191	180	$orderby = "CAST($wpdb->streammeta.meta_value AS SIGNED)";
192		- } elseif ( 'meta_value' === $args['orderby'] && ! empty( $args['meta_key'] ) ) {
	181	+ } elseif ( 'meta_value' === $orderby && ! empty( $args['meta_key'] ) ) {
193	182	$orderby = "$wpdb->streammeta.meta_value";
	183	+ } else {
	184	+ $orderby = "$wpdb->stream.ID";
194	185	}
195	186
196		- // Show the recent records first by default.
197		- $order = 'DESC';
198		- if ( 'ASC' === strtoupper( $args['order'] ) ) {
199		- $order = 'ASC';
200		- }
	187	+ $orderby = "ORDER BY {$orderby} {$order}";
201	188
202		- $orderby = sprintf( 'ORDER BY %s %s', $orderby, $order );
203		-
204	189	/**
205	190	* PARSE FIELDS PARAMETER
206	191	*/
207	192	$fields = (array) $args['fields'];
		@@ -206,27 +191,18 @@
206	191	*/
207	192	$fields = (array) $args['fields'];
208	193	$selects = array();
209	194
210		- // Column names cannot be passed through $wpdb->prepare(), so restrict
211		- // the selectable fields to a known allowlist to prevent SQL injection
212		- // via the `fields` argument.
213	195	if ( ! empty( $fields ) ) {
214	196	foreach ( $fields as $field ) {
215		- // We'll query the meta table later.
	197	+ // We'll query the meta table later
216	198	if ( 'meta' === $field ) {
217	199	continue;
218	200	}
219	201
220		- if ( ! in_array( $field, self::ALLOWED_FIELDS, true ) ) {
221		- continue;
222		- }
223		-
224	202	$selects[] = sprintf( "$wpdb->stream.%s", $field );
225	203	}
226		- }
227		-
228		- if ( empty( $selects ) ) {
	204	+ } else {
229	205	$selects[] = "$wpdb->stream.*";
230	206	}
231	207
232	208	$select = implode( ', ', $selects );
		@@ -231,21 +207,11 @@
231	207
232	208	$select = implode( ', ', $selects );
233	209
234	210	/**
235		- * Filters query WHERE statement as an alternative to filtering
236		- * the $query using the hook below.
237		- *
238		- * @param string $where WHERE statement.
239		- *
240		- * @return string
241		- */
242		- $where = apply_filters( 'wp_stream_db_query_where', $where );
243		-
244		- /**
245	211	* BUILD THE FINAL QUERY
246	212	*/
247		- $query = "SELECT {$select}
	213	+ $query = "SELECT SQL_CALC_FOUND_ROWS {$select}
248	214	FROM $wpdb->stream
249	215	{$join}
250	216	WHERE 1=1 {$where}
251	217	{$orderby}
		@@ -260,31 +226,14 @@
260	226	* @return string
261	227	*/
262	228	$query = apply_filters( 'wp_stream_db_query', $query, $args );
263	229
264		- // Build result count query.
265		- $count_query = "SELECT COUNT(*) as found
266		- FROM $wpdb->stream
267		- {$join}
268		- WHERE 1=1 {$where}";
269		-
	230	+ $result = array();
270	231	/**
271		- * Filter allows the result count query to be modified before execution.
272		- *
273		- * @param string $query
274		- * @param array $args
275		- *
276		- * @return string
277		- */
278		- $count_query = apply_filters( 'wp_stream_db_count_query', $count_query, $args );
279		-
280		- /**
281	232	* QUERY THE DATABASE FOR RESULTS
282	233	*/
283		- $result = array(
284		- 'items' => $wpdb->get_results( $query ), // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
285		- 'count' => absint( $wpdb->get_var( $count_query ) ), // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
286		- );
	234	+ $result['items'] = $wpdb->get_results( $query ); // @codingStandardsIgnoreLine $query already prepared
	235	+ $result['count'] = $result['items'] ? absint( $wpdb->get_var( 'SELECT FOUND_ROWS()' ) ) : 0;
287	236
288	237	return $result;
289	238	}
290	239	}