| @@ -6,9 +6,10 @@ | ||
| 6 | 6 | global $current_user, $wppmfunction,$wpdb; |
| 7 | 7 | $current_user_data = get_userdata($current_user->ID); |
| 8 | 8 | $task_id = intval(sanitize_text_field($task_id)); |
| 9 | 9 | $wppm_task_data = $wppmfunction->get_task($task_id); |
| 10 | -$wppm_task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment where task_id='".$task_id."' ORDER BY id DESC LIMIT 1;"); | |
| 10 | +$orderby_sql = sanitize_sql_orderby( "id DESC" ); | |
| 11 | +$wppm_task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment where task_id='".$task_id."' ORDER BY $orderby_sql LIMIT 1;"); | |
| 11 | 12 | $wppm_project_data = $wppmfunction->get_project($wppm_task_data['project']); |
| 12 | 13 | $auth_id = sanitize_text_field($wppm_task_data['task_auth_code']); |
| 13 | 14 | $attachments = array(); |
| 14 | 15 | if(!empty($wppm_task_comment)){ |
| @@ -121,8 +122,9 @@ | ||
| 121 | 122 | if($flag == true){ |
| 122 | 123 | if(!empty($attachments)){ |
| 123 | 124 | foreach($attachments as $attach_id){ |
| 124 | 125 | $upload_dir = wp_upload_dir(); |
| 126 | + $attach_id = esc_sql($attach_id); | |
| 125 | 127 | $attachment = $wpdb->get_row("select * from {$wpdb->prefix}wppm_attachments where id='".$attach_id."'"); |
| 126 | 128 | if(!empty($attachment)){ |
| 127 | 129 | $updated_time = sanitize_text_field($attachment->date_created); |
| 128 | 130 | $time = strtotime(sanitize_text_field($updated_time)); |
