← All changes | includes/replace_macro.php +6 -6 5.0.4 → 4.0.6 View file →

		@@ -6,10 +6,10 @@
6	6	global $current_user, $wppmfunction,$wpdb;
7	7	$current_user_data = get_userdata($current_user->ID);
8	8	$project_id = intval(sanitize_text_field($project_id));
9	9	$wppm_project_data = $wppmfunction->get_project($project_id);
10		-$orderby_sql = (sanitize_sql_orderby( "id DESC" ));
11		-$wppm_proj_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_comment where proj_id=%d ORDER BY $orderby_sql LIMIT 1",$project_id));
	10	+$orderby_sql = esc_sql(sanitize_sql_orderby( "id DESC" ));
	11	+$wppm_proj_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_comment where proj_id='".esc_sql($project_id)."' ORDER BY $orderby_sql LIMIT 1;");
12	12	$attachments = array();
13	13	$auth_id = $wppmfunction->get_project_meta($project_id,'project_auth_code',true);
14	14	if(!empty($wppm_proj_comment)){
15	15	$attachments = explode(',',$wppm_proj_comment->attachment_ids);
		@@ -104,15 +104,15 @@
104	104	if($flag == true){
105	105	if(!empty($attachments)){
106	106	foreach($attachments as $attach_id){
107	107	$upload_dir = wp_upload_dir();
108		- $attach_id = absint($attach_id);
109		- $attachment = $wpdb->get_row($wpdb->prepare("select * from {$wpdb->prefix}wppm_attachments where id=%d",$attach_id));
	108	+ $attach_id = esc_sql($attach_id);
	109	+ $attachment = $wpdb->get_row("select * from {$wpdb->prefix}wppm_attachments where id='".$attach_id."'");
110	110	if(!empty($attachment)){
111	111	$updated_time = sanitize_text_field($attachment->date_created);
112	112	$time = strtotime(sanitize_text_field($updated_time));
113		- $month = wp_date("m",$time);
114		- $year = wp_date("Y",$time);
	113	+ $month = date("m",$time);
	114	+ $year = date("Y",$time);
115	115	$findStr = ".txt";
116	116	$attachment_name = preg_replace('/' . $findStr . '/', "", sanitize_file_name($attachment->name), 1);
117	117	$file_url = $upload_dir['basedir'] . '/wppm/'.'/'.$year.'/'.$month.'/'. $attachment_name;
118	118	$download_url = home_url('/').'?wppm_attachment='.sanitize_text_field($attachment->id).'&pid='.sanitize_text_field($project_id).'&pac='.sanitize_text_field($auth_id);