← All changes | includes/replace_task_macro.php +7 -13 5.0.7 → 3.0.8 View file →

		@@ -9,10 +9,10 @@
9	9	$wppm_task_data = $wppmfunction->get_task($task_id);
10	10	$task_creator = $wppm_task_data['created_by'];
11	11	$task_creator_data = get_userdata($task_creator);
12	12	$task_creator_name = $task_creator_data->display_name;
13		-$orderby_sql = (sanitize_sql_orderby( "id DESC" ));
14		-$wppm_task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment where task_id=%d ORDER BY $orderby_sql LIMIT 1",$task_id));
	13	+$orderby_sql = esc_sql(sanitize_sql_orderby( "id DESC" ));
	14	+$wppm_task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment where task_id='".esc_sql($task_id)."' ORDER BY $orderby_sql LIMIT 1;");
15	15	$wppm_project_data = $wppmfunction->get_project($wppm_task_data['project']);
16	16	$auth_id = sanitize_text_field($wppm_task_data['task_auth_code']);
17	17	$attachments = array();
18	18	if(!empty($wppm_task_comment)){
		@@ -20,10 +20,8 @@
20	20	}
21	21	preg_match_all("/{[^}]*}/" ,$str,$matches);
22	22	$matches = array_unique($matches[0]);
23	23	$flag =false;
24		-$page_setting = get_option( 'wppm-page-settings' );
25		-$view = $page_setting['task-url-page'];
26	24	foreach($matches as $match){
27	25	switch($match){
28	26	// Task ID
29	27	case '{task_id}':
		@@ -92,9 +90,9 @@
92	90	$str = preg_replace('/{last_comment_user_name}/', $this->get_last_comment_user_name($task_id), $str);
93	91	break;
94	92	//Project status
95	93	case '{project_status}';
96		- $str = preg_replace('/{project_status}/', $this->get_new_project_status_name(sanitize_text_field($wppm_project_data['status'])), $str);
	94	+ $str = preg_replace('/{project_status}/', $this->get_new_project_status_name((sanitize_text_field($wppm_project_data['status'])), $str));
97	95	break;
98	96	// Project Category
99	97	case '{project_category}';
100	98	if(!empty($wppm_project_data['cat_id'])){
		@@ -128,12 +126,8 @@
128	126	case '{comment_body}':
129	127	$flag= true;
130	128	$str = preg_replace('/{comment_body}/', $this->get_last_comment_body($task_id), $str);
131	129	break;
132		- case '{task_url}':
133		- $task_url = '<a class="wppm_link" href="' . $this->get_task_url($task_id,$view) . '" target="_blank">' . $this->get_task_url($task_id,$view) . '</a>';
134		- $str = preg_replace('/{task_url}/', $task_url, $str);
135		- break;
136	130
137	131	}
138	132	}
139	133	if($flag == true){
		@@ -139,15 +133,15 @@
139	133	if($flag == true){
140	134	if(!empty($attachments)){
141	135	foreach($attachments as $attach_id){
142	136	$upload_dir = wp_upload_dir();
143		- $attach_id = absint($attach_id);
144		- $attachment = $wpdb->get_row($wpdb->prepare("select * from {$wpdb->prefix}wppm_attachments where id=%d",$attach_id));
	137	+ $attach_id = esc_sql($attach_id);
	138	+ $attachment = $wpdb->get_row("select * from {$wpdb->prefix}wppm_attachments where id='".$attach_id."'");
145	139	if(!empty($attachment)){
146	140	$updated_time = sanitize_text_field($attachment->date_created);
147	141	$time = strtotime(sanitize_text_field($updated_time));
148		- $month = wp_date("m",$time);
149		- $year = wp_date("Y",$time);
	142	+ $month = date("m",$time);
	143	+ $year = date("Y",$time);
150	144	$findStr = ".txt";
151	145	$attachment_name = preg_replace('/' . $findStr . '/', "", sanitize_file_name($attachment->name), 1);
152	146	$file_url = $upload_dir['basedir'] . '/wppm/'.'/'.$year.'/'.$month.'/'. $attachment_name;
153	147	$download_url = home_url('/').'?wppm_attachment='.sanitize_text_field($attachment->id).'&tid='.sanitize_text_field($task_id).'&tac='.sanitize_text_field($auth_id);