← All changes | includes/admin/projects/get_users.php +22 -20 5.0.6 → 4.0.6 View file →

		@@ -3,11 +3,12 @@
3	3	exit; // Exit if accessed directly
4	4	}
5	5	global $wpdb,$wppmfunction,$current_user;
6	6	$wppm_users_role = get_option('wppm_user_role');
7		-$proj_id = isset($_POST['proj_id']) ? absint(sanitize_text_field(wp_unslash($_POST['proj_id']))) : '' ;
	7	+$proj_id = isset($_POST['proj_id']) ? sanitize_text_field($_POST['proj_id']) : '' ;
	8	+$proj_id = esc_sql($proj_id);
8	9	$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
9		-$project = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project where id = %d", $proj_id));
	10	+$project = $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}wppm_project where id = '$proj_id'" );
10	11	if (!(($current_user->ID && $current_user->has_cap('manage_options')) || $wppmfunction->has_project_permission('assign_project_users',$proj_id) || ($project->created_by==$current_user->ID && $wppm_current_user_capability == 'wppm_manager') || ($current_user->ID && $current_user->has_cap('wppm_admin')))) {exit;}
11	12	if(!empty($project->users)){
12	13	$users = explode(",",$project->users);
13	14	}
		@@ -22,30 +23,31 @@
22	23	foreach($users as $user){ ?>
23	24	<div id="wppm_user_display_container_<?php echo esc_attr($user)?>" class="row wppm_user_display_container">
24	25	<?php
25	26	$userdata = get_userdata( $user );
26		- $user = absint($user);
27		- $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $proj_id, $user));
	27	+ $user = esc_sql($user);
	28	+ $project_user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = '$proj_id' AND user_id = '$user'");
28	29	?>
29	30	<div class="flex-container col-sm-4">
30	31	<span class="wppm_filter_display_text">
31		- <?php echo esc_html($userdata->display_name); ?>
	32	+ <?php echo esc_html_e($userdata->display_name,'taskbuilder'); ?>
32	33	<input type="hidden" name="user_names[]" value="<?php echo esc_attr($user) ?>">
33	34	</span>
34	35	</div>
35	36	<div class="col-sm-4 wppm_user_role">
36		- <select size="sm" class="form-control" id="wppm_select_user_role_<?php echo esc_attr( $user ); ?>" name="wppm_select_user_role_<?php echo esc_attr( $user ); ?>">
37		- <?php if ( ! empty( $wppm_users_role ) ) : ?>
38		- <?php foreach ( $wppm_users_role as $key => $role ) : ?><?php
39		- $selected = ( ! empty( $project_user ) && $key == $project_user->role_id )
40		- ? 'selected="selected"'
41		- : '';
42		- ?>
43		- <option <?php echo esc_attr( $selected ); ?> value="<?php echo esc_attr( $key ); ?>">
44		- <?php echo esc_html( $role['label'] ); ?>
45		- </option>
46		- <?php endforeach; ?>
47		- <?php endif; ?>
	37	+ <select size="sm" class="form-control" id="wppm_select_user_role_<?php echo esc_attr($user) ?>" name="wppm_select_user_role_<?php echo esc_attr($user) ?>">
	38	+ <?php
	39	+ if(!empty($wppm_users_role)){
	40	+ foreach($wppm_users_role as $key=>$role){
	41	+ if(!empty($role)){
	42	+ foreach($role as $k=>$val){
	43	+ $selected = (!empty($project_user) && $key == $project_user->role_id) ? 'selected="selected"' : '';
	44	+ ?><option <?php echo $selected?> value="<?php echo esc_attr($key) ?>"><?php echo esc_html_e($role['label'],'taskbuilder') ?></option><?php
	45	+ }
	46	+ }
	47	+ }
	48	+ }
	49	+ ?>
48	50	</select>
49	51	</div>
50	52	<div class="col-sm-4 wppm_delete_user_icon">
51	53	<span onclick="wppm_remove_filter(<?php echo esc_attr($user)?>);"><img src="<?php echo esc_url( WPPM_PLUGIN_URL . 'asset/images/trash.svg'); ?>" alt="delete"></span>
		@@ -53,9 +55,9 @@
53	55	?>
54	56	</div>
55	57	<?php }
56	58	} else{
57		- ?><span class="wppm_project_users_not_assign_label"><?php echo esc_html_e('None','taskbuilder');?></span><?php
	59	+ ?><span class="wppm_project_users_not_assign_label"><?php echo esc_html_e('None','wp_projects');?></span><?php
58	60	}
59	61	?>
60	62	</div>
61	63	<input type="hidden" name="action" value="wppm_set_project_users" />
		@@ -105,9 +107,9 @@
105	107	if(!empty($wppm_users_role)){
106	108	foreach($wppm_users_role as $key=>$role){
107	109	if(!empty($role)){
108	110	foreach($role as $k=>$val){
109		- ?>'<option value="<?php echo esc_attr($key) ?>"><?php echo esc_html($role['label']) ?></option>'+<?php
	111	+ ?>'<option value="<?php echo esc_attr($key) ?>"><?php echo esc_html_e($role['label'],'taskbuilder') ?></option>'+<?php
110	112	}
111	113	}
112	114	}
113	115	}
		@@ -138,5 +140,5 @@
138	140	$output = array(
139	141	'body' => $body,
140	142	'footer' => $footer
141	143	);
142		-echo wp_json_encode($output);
	144	+echo json_encode($output);