← All changes | includes/replace_task_macro.php +8 -25 6.0.2 → 3.0.6 View file →

		@@ -6,13 +6,10 @@
6	6	global $current_user, $wppmfunction,$wpdb;
7	7	$current_user_data = get_userdata($current_user->ID);
8	8	$task_id = intval(sanitize_text_field($task_id));
9	9	$wppm_task_data = $wppmfunction->get_task($task_id);
10		-$task_creator = $wppm_task_data['created_by'];
11		-$task_creator_data = get_userdata($task_creator);
12		-$task_creator_name = $task_creator_data->display_name;
13		-$orderby_sql = (sanitize_sql_orderby( "id DESC" ));
14		-$wppm_task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment where task_id=%d ORDER BY $orderby_sql LIMIT 1",$task_id));
	10	+$orderby_sql = sanitize_sql_orderby( "id DESC" );
	11	+$wppm_task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment where task_id='".$task_id."' ORDER BY $orderby_sql LIMIT 1;");
15	12	$wppm_project_data = $wppmfunction->get_project($wppm_task_data['project']);
16	13	$auth_id = sanitize_text_field($wppm_task_data['task_auth_code']);
17	14	$attachments = array();
18	15	if(!empty($wppm_task_comment)){
		@@ -20,10 +17,8 @@
20	17	}
21	18	preg_match_all("/{[^}]*}/" ,$str,$matches);
22	19	$matches = array_unique($matches[0]);
23	20	$flag =false;
24		-$page_setting = get_option( 'wppm-page-settings' );
25		-$view = $page_setting['task-url-page'];
26	21	foreach($matches as $match){
27	22	switch($match){
28	23	// Task ID
29	24	case '{task_id}':
		@@ -28,12 +23,8 @@
28	23	// Task ID
29	24	case '{task_id}':
30	25	$str = preg_replace('/{task_id}/', $task_id, $str);
31	26	break;
32		- // Task Creator Name
33		- case '{task_creator_name}':
34		- $str = preg_replace('/{task_creator_name}/', $task_creator_name, $str);
35		- break;
36	27	//Current User Name
37	28	case '{user_name}':
38	29	$str = preg_replace('/{user_name}/', sanitize_text_field($current_user_data->display_name), $str);
39	30	break;
		@@ -92,17 +83,13 @@
92	83	$str = preg_replace('/{last_comment_user_name}/', $this->get_last_comment_user_name($task_id), $str);
93	84	break;
94	85	//Project status
95	86	case '{project_status}';
96		- $str = preg_replace('/{project_status}/', $this->get_new_project_status_name(sanitize_text_field($wppm_project_data['status'])), $str);
	87	+ $str = preg_replace('/{project_status}/', $this->get_new_project_status_name((sanitize_text_field($wppm_project_data['status'])), $str));
97	88	break;
98	89	// Project Category
99	90	case '{project_category}';
100		- if(!empty($wppm_project_data['cat_id'])){
101		- $str = preg_replace('/{project_category}/', $this->get_project_category_name(sanitize_text_field($wppm_project_data['cat_id'])), $str);
102		- }else{
103		- $str = "";
104		- }
	91	+ $str = preg_replace('/{project_category}/', $this->get_project_category_name((sanitize_text_field($wppm_project_data['cat_id'])), $str));
105	92	break;
106	93	// Project Name
107	94	case '{project_name}':
108	95	$str = preg_replace('/{project_name}/', (sanitize_text_field($wppm_project_data['project_name'])), $str);
		@@ -128,12 +115,8 @@
128	115	case '{comment_body}':
129	116	$flag= true;
130	117	$str = preg_replace('/{comment_body}/', $this->get_last_comment_body($task_id), $str);
131	118	break;
132		- case '{task_url}':
133		- $task_url = '<a class="wppm_link" href="' . $this->get_task_url($task_id,$view) . '" target="_blank">' . $this->get_task_url($task_id,$view) . '</a>';
134		- $str = preg_replace('/{task_url}/', $task_url, $str);
135		- break;
136	119
137	120	}
138	121	}
139	122	if($flag == true){
		@@ -139,15 +122,15 @@
139	122	if($flag == true){
140	123	if(!empty($attachments)){
141	124	foreach($attachments as $attach_id){
142	125	$upload_dir = wp_upload_dir();
143		- $attach_id = absint($attach_id);
144		- $attachment = $wpdb->get_row($wpdb->prepare("select * from {$wpdb->prefix}wppm_attachments where id=%d",$attach_id));
	126	+ $attach_id = esc_sql($attach_id);
	127	+ $attachment = $wpdb->get_row("select * from {$wpdb->prefix}wppm_attachments where id='".$attach_id."'");
145	128	if(!empty($attachment)){
146	129	$updated_time = sanitize_text_field($attachment->date_created);
147	130	$time = strtotime(sanitize_text_field($updated_time));
148		- $month = wp_date("m",$time);
149		- $year = wp_date("Y",$time);
	131	+ $month = date("m",$time);
	132	+ $year = date("Y",$time);
150	133	$findStr = ".txt";
151	134	$attachment_name = preg_replace('/' . $findStr . '/', "", sanitize_file_name($attachment->name), 1);
152	135	$file_url = $upload_dir['basedir'] . '/wppm/'.'/'.$year.'/'.$month.'/'. $attachment_name;
153	136	$download_url = home_url('/').'?wppm_attachment='.sanitize_text_field($attachment->id).'&tid='.sanitize_text_field($task_id).'&tac='.sanitize_text_field($auth_id);