← All changes | includes/replace_macro.php +7 -15 5.0.7 → 3.0.8 View file →

		@@ -6,10 +6,10 @@
6	6	global $current_user, $wppmfunction,$wpdb;
7	7	$current_user_data = get_userdata($current_user->ID);
8	8	$project_id = intval(sanitize_text_field($project_id));
9	9	$wppm_project_data = $wppmfunction->get_project($project_id);
10		-$orderby_sql = (sanitize_sql_orderby( "id DESC" ));
11		-$wppm_proj_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_comment where proj_id=%d ORDER BY $orderby_sql LIMIT 1",$project_id));
	10	+$orderby_sql = esc_sql(sanitize_sql_orderby( "id DESC" ));
	11	+$wppm_proj_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_comment where proj_id='".esc_sql($project_id)."' ORDER BY $orderby_sql LIMIT 1;");
12	12	$attachments = array();
13	13	$auth_id = $wppmfunction->get_project_meta($project_id,'project_auth_code',true);
14	14	if(!empty($wppm_proj_comment)){
15	15	$attachments = explode(',',$wppm_proj_comment->attachment_ids);
		@@ -16,10 +16,8 @@
16	16	}
17	17	preg_match_all("/{[^}]*}/" ,$str,$matches);
18	18	$matches = array_unique($matches[0]);
19	19	$flag =false;
20		-$page_setting = get_option( 'wppm-page-settings' );
21		-$view = $page_setting['project-url-page'];
22	20	foreach($matches as $match){
23	21	switch($match){
24	22	//Current User Name
25	23	case '{user_name}':
		@@ -91,15 +89,9 @@
91	89	break;
92	90
93	91	// Project Description
94	92	case '{project_description}':
95		- $str = preg_replace('/{project_description}/', sanitize_text_field($wppm_project_data['description']), $str);
96		- break;
97		- case '{project_url}':
98		- $project_url = '<a class="wppm_link" href="' . $this->get_project_url($project_id,$view) . '" target="_blank">' . $this->get_project_url($project_id,$view) . '</a>';
99		- $str = preg_replace('/{project_url}/', $project_url, $str);
100		- break;
101		-
	93	+ $str = preg_replace('/{project_description}/', sanitize_text_field($wppm_project_data['description']), $str);
102	94	}
103	95	}
104	96	if($flag == true){
105	97	if(!empty($attachments)){
		@@ -104,15 +96,15 @@
104	96	if($flag == true){
105	97	if(!empty($attachments)){
106	98	foreach($attachments as $attach_id){
107	99	$upload_dir = wp_upload_dir();
108		- $attach_id = absint($attach_id);
109		- $attachment = $wpdb->get_row($wpdb->prepare("select * from {$wpdb->prefix}wppm_attachments where id=%d",$attach_id));
	100	+ $attach_id = esc_sql($attach_id);
	101	+ $attachment = $wpdb->get_row("select * from {$wpdb->prefix}wppm_attachments where id='".$attach_id."'");
110	102	if(!empty($attachment)){
111	103	$updated_time = sanitize_text_field($attachment->date_created);
112	104	$time = strtotime(sanitize_text_field($updated_time));
113		- $month = wp_date("m",$time);
114		- $year = wp_date("Y",$time);
	105	+ $month = date("m",$time);
	106	+ $year = date("Y",$time);
115	107	$findStr = ".txt";
116	108	$attachment_name = preg_replace('/' . $findStr . '/', "", sanitize_file_name($attachment->name), 1);
117	109	$file_url = $upload_dir['basedir'] . '/wppm/'.'/'.$year.'/'.$month.'/'. $attachment_name;
118	110	$download_url = home_url('/').'?wppm_attachment='.sanitize_text_field($attachment->id).'&pid='.sanitize_text_field($project_id).'&pac='.sanitize_text_field($auth_id);