← All changes | includes/replace_task_macro.php +7 -7 6.0.4 → 4.0.6 View file →

		@@ -9,10 +9,10 @@
9	9	$wppm_task_data = $wppmfunction->get_task($task_id);
10	10	$task_creator = $wppm_task_data['created_by'];
11	11	$task_creator_data = get_userdata($task_creator);
12	12	$task_creator_name = $task_creator_data->display_name;
13		-$orderby_sql = (sanitize_sql_orderby( "id DESC" ));
14		-$wppm_task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment where task_id=%d ORDER BY $orderby_sql LIMIT 1",$task_id));
	13	+$orderby_sql = esc_sql(sanitize_sql_orderby( "id DESC" ));
	14	+$wppm_task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment where task_id='".esc_sql($task_id)."' ORDER BY $orderby_sql LIMIT 1;");
15	15	$wppm_project_data = $wppmfunction->get_project($wppm_task_data['project']);
16	16	$auth_id = sanitize_text_field($wppm_task_data['task_auth_code']);
17	17	$attachments = array();
18	18	if(!empty($wppm_task_comment)){
		@@ -92,9 +92,9 @@
92	92	$str = preg_replace('/{last_comment_user_name}/', $this->get_last_comment_user_name($task_id), $str);
93	93	break;
94	94	//Project status
95	95	case '{project_status}';
96		- $str = preg_replace('/{project_status}/', $this->get_new_project_status_name(sanitize_text_field($wppm_project_data['status'])), $str);
	96	+ $str = preg_replace('/{project_status}/', $this->get_new_project_status_name((sanitize_text_field($wppm_project_data['status'])), $str));
97	97	break;
98	98	// Project Category
99	99	case '{project_category}';
100	100	if(!empty($wppm_project_data['cat_id'])){
		@@ -139,15 +139,15 @@
139	139	if($flag == true){
140	140	if(!empty($attachments)){
141	141	foreach($attachments as $attach_id){
142	142	$upload_dir = wp_upload_dir();
143		- $attach_id = absint($attach_id);
144		- $attachment = $wpdb->get_row($wpdb->prepare("select * from {$wpdb->prefix}wppm_attachments where id=%d",$attach_id));
	143	+ $attach_id = esc_sql($attach_id);
	144	+ $attachment = $wpdb->get_row("select * from {$wpdb->prefix}wppm_attachments where id='".$attach_id."'");
145	145	if(!empty($attachment)){
146	146	$updated_time = sanitize_text_field($attachment->date_created);
147	147	$time = strtotime(sanitize_text_field($updated_time));
148		- $month = wp_date("m",$time);
149		- $year = wp_date("Y",$time);
	148	+ $month = date("m",$time);
	149	+ $year = date("Y",$time);
150	150	$findStr = ".txt";
151	151	$attachment_name = preg_replace('/' . $findStr . '/', "", sanitize_file_name($attachment->name), 1);
152	152	$file_url = $upload_dir['basedir'] . '/wppm/'.'/'.$year.'/'.$month.'/'. $attachment_name;
153	153	$download_url = home_url('/').'?wppm_attachment='.sanitize_text_field($attachment->id).'&tid='.sanitize_text_field($task_id).'&tac='.sanitize_text_field($auth_id);