PluginProbe
Taskbuilder – Project Management & Task Management Tool With Kanban Board / 6.0.6
Taskbuilder – Project Management & Task Management Tool With Kanban Board v6.0.6
6.0.6 6.0.5 6.0.2 6.0.3 6.0.4 6.0.1 6.0.0 5.0.8 5.0.9 4.0.9 5.0.0 5.0.1 5.0.2 5.0.3 5.0.4 5.0.5 5.0.6 5.0.7 trunk 1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5 All 58 releases
← All changes | includes/class-wppm-functions.php +839 -88 1.0.3 → 6.0.6 View file →
@@ -11,9 +11,9 @@
11 11 if ( is_array( $value ) ) {
12 12 $value = $this->sanitize_array($value);
13 13 }
14 14 else {
15 - $value = sanitize_text_field( $value );
15 + $value = sanitize_text_field( wp_unslash( $value ) );
16 16 }
17 17 }
18 18 }
19 19 return $array;
@@ -20,8 +20,9 @@
20 20 }
21 21
22 22 public static function create_project($args){
23 23 global $wpdb,$current_user;
24 + $default_proj_status = get_option('wppm_default_project_status');
24 25 $values = array(
25 26 'created_by'=>$current_user->ID,
26 27 'project_name'=>$args['name'],
27 28 'description'=>isset($args['wppm_proj_description']) ? $args['wppm_proj_description']:"",
@@ -26,12 +27,14 @@
26 27 'project_name'=>$args['name'],
27 28 'description'=>isset($args['wppm_proj_description']) ? $args['wppm_proj_description']:"",
28 29 'start_date'=>isset($args['wppm_start_date']) ?$args['wppm_start_date']:"",
29 30 'end_date'=>isset($args['wppm_end_date'])? $args['wppm_end_date']:"",
30 - 'status'=>'1',
31 + 'status'=>isset($args['status'])? $args['status']:$default_proj_status,
31 32 'cat_id'=>isset($args['wppm_create_project_category']) ? $args['wppm_create_project_category']:"",
32 33 'users'=>isset($args['user_names']) ? implode(",",$args['user_names']):"",
33 - 'date_created'=>date("Y-m-d h:i:sa"),
34 + 'date_created'=>isset($args['date_created'])? $args['date_created']:wp_date("Y-m-d h:i:sa"),
35 + 'project_auth_code'=> self::getRandomString(10)
36 +
34 37 );
35 38 $wpdb->insert($wpdb->prefix .'wppm_project', $values);
36 39 $project_id = $wpdb->insert_id;
37 40 return $project_id;
@@ -37,22 +40,24 @@
37 40 return $project_id;
38 41 }
39 42
40 43 public static function create_task($args){
41 - global $wpdb,$current_user,$wppmfunction;
44 + global $wpdb,$current_user;
45 + $default_task_status = get_option('wppm_default_task_status');
42 46 $values = array(
43 - 'created_by'=>$current_user->ID,
47 + 'created_by'=>(isset($args['created_by'])) ? $args['created_by']: $current_user->ID,
44 48 'task_name'=>$args['name'],
45 49 'description'=>(isset($args['wppm_task_description']))?$args['wppm_task_description']:"",
46 50 'project'=>(isset($args['wppm_task_project']))?$args['wppm_task_project']:"",
47 51 'start_date'=>(isset($args['wppm_task_start_date']))?$args['wppm_task_start_date']:"",
48 52 'end_date'=>(isset($args['wppm_task_end_date']))?$args['wppm_task_end_date']:"",
49 - 'status'=>'1',
53 + 'status'=>(isset($args['status']))?$args['status']:$default_task_status,
50 54 'priority'=>(isset($args['wppm_create_task_priority']))?$args['wppm_create_task_priority']:"",
51 55 'users'=>(!empty($args['user_names']))?implode(",",$args['user_names']):"",
52 - 'date_created'=>date("Y-m-d h:i:sa"),
53 - 'task_auth_code'=> $wppmfunction->getRandomString(10),
54 - 'active'=>1
56 + 'date_created'=>isset($args['date_created'])? $args['date_created']:wp_date("Y-m-d h:i:sa"),
57 + 'task_auth_code'=> self::getRandomString(10),
58 + 'active'=>1,
59 + 'parent_task_id'=>(isset($args['parent_task_id']))?absint($args['parent_task_id']):0
55 60 );
56 61 $wpdb->insert($wpdb->prefix .'wppm_task', $values);
57 62 $task_id = $wpdb->insert_id;
58 63 return $task_id;
@@ -57,8 +62,34 @@
57 62 $task_id = $wpdb->insert_id;
58 63 return $task_id;
59 64 }
60 65
66 + public static function create_checklist($args){
67 + global $wpdb,$current_user,$wppmfunction;
68 + $values = array(
69 + 'task_id'=>$args['task_id'],
70 + 'checklist_name' => $args['checklist_name'],
71 + 'created_by'=> $args['created_by']
72 + );
73 + $wpdb->insert($wpdb->prefix .'wppm_checklist', $values);
74 + $checklist_id = $wpdb->insert_id;
75 + return $checklist_id;
76 + }
77 +
78 + public static function create_checklist_item($args){
79 + global $wpdb,$current_user,$wppmfunction;
80 + $chk_items_values = array(
81 + 'checklist_id' => $args['checklist_id'],
82 + 'item_name' => $args['item_name'],
83 + 'checked'=>$args['checked'],
84 + 'members'=>$args['members'],
85 + 'due_date'=> $args['due_date']
86 + );
87 + $wpdb->insert($wpdb->prefix .'wppm_checklist_items', $chk_items_values);
88 + $checklist_item_id = $wpdb->insert_id;
89 + return $checklist_item_id;
90 + }
91 +
61 92 public static function wppm_submit_task_comment($args){
62 93 global $wpdb;
63 94 $wpdb->insert($wpdb->prefix.'wppm_task_comment',$args);
64 95 $comment_id = $wpdb->insert_id;
@@ -64,14 +95,35 @@
64 95 $comment_id = $wpdb->insert_id;
65 96 return $comment_id;
66 97 }
67 98
99 + public static function wppm_submit_task_comment_meta($args){
100 + global $wpdb;
101 + $wpdb->insert($wpdb->prefix.'wppm_task_comment_meta',$args);
102 + $comment_meta_id = $wpdb->insert_id;
103 + return $comment_meta_id;
104 + }
105 +
106 + public static function wppm_submit_proj_comment($args){
107 + global $wpdb;
108 + $wpdb->insert($wpdb->prefix.'wppm_project_comment',$args);
109 + $comment_id = $wpdb->insert_id;
110 + return $comment_id;
111 + }
112 +
113 + public static function wppm_submit_proj_comment_meta($args){
114 + global $wpdb;
115 + $wpdb->insert($wpdb->prefix.'wppm_project_comment_meta',$args);
116 + $comment_meta_id = $wpdb->insert_id;
117 + return $comment_meta_id;
118 + }
119 +
68 120 // Random string
69 121 public static function getRandomString($length = 8) {
70 122 $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
71 123 $string = '';
72 124 for ($i = 0; $i < $length; $i++) {
73 - $string .= $characters[mt_rand(0, strlen($characters) - 1)];
125 + $string .= $characters[wp_rand(0, strlen($characters) - 1)];
74 126 }
75 127 return $string;
76 128 }
77 129
@@ -76,77 +128,292 @@
76 128 }
77 129
78 130 public static function wppm_get_auth_code($id){
79 131 global $wpdb;
80 - $auth_code = $wpdb->get_var( "SELECT task_auth_code FROM {$wpdb->prefix}wppm_task where id=$id" );
132 + $id = absint($id);
133 + $auth_code = $wpdb->get_var(
134 + $wpdb->prepare(
135 + "SELECT task_auth_code
136 + FROM {$wpdb->prefix}wppm_task
137 + WHERE id = %d",
138 + ($id)
139 + )
140 + );
81 141 $auth_code = isset($auth_code) ? $auth_code : "";
82 142 return $auth_code;
83 143 }
84 144
145 + public static function wppm_get_proj_auth_code($id){
146 + global $wpdb;
147 + $id = absint($id);
148 + $auth_code = $wpdb->get_var(
149 + $wpdb->prepare(
150 + "SELECT project_auth_code
151 + FROM {$wpdb->prefix}wppm_project
152 + WHERE id = %d",
153 + ($id)
154 + )
155 + );
156 + $auth_code = isset($auth_code) ? $auth_code : "";
157 + return $auth_code;
158 + }
159 +
85 160 public static function get_task_fields($task_id,$select_field){
86 161 global $wpdb;
162 + $task_id = absint($task_id);
87 163 $task_field_value = '';
164 + $allowed_fields = array(
165 + 'id',
166 + 'created_by',
167 + 'task_name',
168 + 'description',
169 + 'project',
170 + 'start_date',
171 + 'end_date',
172 + 'status',
173 + 'priority',
174 + 'users',
175 + 'date_created',
176 + 'task_auth_code'
177 + );
178 +
179 + // Validate column name
180 + if ( ! in_array( $select_field, $allowed_fields, true ) ) {
181 + return '';
182 + }
88 183 if (apply_filters('wppm_get_select_field',true,$task_id,$select_field)) {
89 - $get_task_field_value = $wpdb->get_var(" SELECT $select_field FROM {$wpdb->prefix}wppm_task WHERE id='$task_id' ");
184 + $get_task_field_value = $wpdb->get_var($wpdb->prepare("SELECT $select_field FROM {$wpdb->prefix}wppm_task WHERE id = %d", $task_id));
90 185 $task_field_value = $get_task_field_value ? $get_task_field_value : '';
91 186 }
92 187 return stripslashes($task_field_value);
93 188 }
94 189
190 + public static function get_project_fields($proj_id,$select_field){
191 + global $wpdb;
192 + $proj_id = absint($proj_id);
193 + $project_field_value = '';
194 + $allowed_fields = array(
195 + 'id',
196 + 'created_by',
197 + 'project_name',
198 + 'description',
199 + 'start_date',
200 + 'end_date',
201 + 'status',
202 + 'cat_id',
203 + 'users',
204 + 'date_created',
205 + 'project_auth_code'
206 + );
207 +
208 + // Validate column name
209 + if ( ! in_array( $select_field, $allowed_fields, true ) ) {
210 + return '';
211 + }
212 + if (apply_filters('wppm_get_select_proj_field',true,$proj_id,$select_field)) {
213 + $get_project_field_value = $wpdb->get_var($wpdb->prepare("SELECT $select_field FROM {$wpdb->prefix}wppm_project WHERE id = %d", $proj_id));
214 + $project_field_value = $get_project_field_value ? $get_project_field_value : '';
215 + }
216 + return stripslashes($project_field_value);
217 + }
218 +
95 219 public function get_task($task_id){
96 220 global $wpdb;
97 221 $task_data = array();
98 - $task = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task WHERE id='$task_id' ");
222 + $task_id = absint($task_id);
223 + $task = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task WHERE id = %d", $task_id));
99 224 if( $task ){
100 - $task_data = json_decode(json_encode($task), true);
225 + $task_data = json_decode(wp_json_encode($task), true);
101 226 }
102 227 return $task_data;
103 228 }
104 229
230 + public function get_checklist($task_id){
231 + global $wpdb;
232 + $task_id = absint($task_id);
233 + $checklist_data = array();
234 + $checklist = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_checklist WHERE task_id = %d", $task_id));
235 + if( $checklist ){
236 + $checklist_data = json_decode(wp_json_encode($checklist), true);
237 + }
238 + return $checklist_data;
239 + }
240 +
241 + public function get_checklist_items($checklist_id){
242 + global $wpdb;
243 + $checklist_items_data = array();
244 + $checklist_id = absint($checklist_id);
245 + $checklist_items = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_checklist_items WHERE checklist_id = %d", $checklist_id));
246 + if( $checklist_items ){
247 + $checklist_items_data = json_decode(wp_json_encode($checklist_items), true);
248 + }
249 + return $checklist_items_data;
250 + }
251 +
252 + public function get_subtasks($task_id){
253 + global $wpdb;
254 + $task_id = absint($task_id);
255 + $subtasks_data = array();
256 + $subtasks = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d ORDER BY id ASC", $task_id));
257 + if( $subtasks ){
258 + $subtasks_data = json_decode(wp_json_encode($subtasks), true);
259 + }
260 + return $subtasks_data;
261 + }
262 +
263 + public function get_subtask_progress($task_id){
264 + global $wpdb;
265 + $task_id = absint($task_id);
266 + $completed_status_id = 4;
267 + $total = (int) $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d", $task_id));
268 + $completed = (int) $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d AND status = %d", $task_id, $completed_status_id));
269 + return array('total'=>$total,'completed'=>$completed);
270 + }
271 +
272 + // Deletes a task along with its subtasks (and each one's checklists/comments/attachments).
273 + public static function delete_task_and_children($task_id){
274 + global $wpdb;
275 + $task_id = absint($task_id);
276 + $child_ids = $wpdb->get_col($wpdb->prepare("SELECT id FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d", $task_id));
277 + foreach($child_ids as $child_id){
278 + self::delete_task_and_children($child_id);
279 + }
280 + $thread_attachment_ids = $wpdb->get_results($wpdb->prepare("SELECT attachment_ids FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d", $task_id));
281 + if(!empty($thread_attachment_ids)){
282 + foreach ($thread_attachment_ids as $thread_attachment_id){
283 + $attachment_ids_temp = array();
284 + if($thread_attachment_id->attachment_ids){
285 + $attachment_ids_temp = explode(',', $thread_attachment_id->attachment_ids);
286 + }
287 + foreach ($attachment_ids_temp as $attachment_id){
288 + $attachment_id = absint($attachment_id);
289 + $result = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id = %d", $attachment_id));
290 + if(!empty($result)){
291 + $attach_result = $wpdb->get_results($wpdb->prepare("SELECT file_path FROM {$wpdb->prefix}wppm_attachments WHERE file_path = %s", $result->file_path));
292 + if(file_exists($result->file_path) && count($attach_result) < 2){
293 + wp_delete_file($result->file_path);
294 + }
295 + $wpdb->delete($wpdb->prefix.'wppm_attachments', array('id' => $attachment_id));
296 + }
297 + }
298 + }
299 + }
300 + $checklists = $wpdb->get_results($wpdb->prepare("SELECT id FROM {$wpdb->prefix}wppm_checklist WHERE task_id = %d", $task_id));
301 + if(!empty($checklists)){
302 + foreach($checklists as $checklist){
303 + $checklist_id = absint($checklist->id);
304 + $wpdb->delete($wpdb->prefix.'wppm_checklist_items', array('checklist_id'=>$checklist_id));
305 + $wpdb->delete($wpdb->prefix.'wppm_checklist', array('id'=>$checklist_id));
306 + }
307 + }
308 + $wpdb->delete($wpdb->prefix.'wppm_task', array('id'=>$task_id));
309 + $wpdb->delete($wpdb->prefix.'wppm_task_meta', array('task_id'=>$task_id));
310 + $wpdb->delete($wpdb->prefix.'wppm_task_comment', array('task_id'=>$task_id));
311 + $wpdb->delete($wpdb->prefix.'wppm_task_comment_meta', array('task_id'=>$task_id));
312 + do_action('wppm_after_delete_task', $task_id);
313 + }
314 +
105 315 public function get_project($project_id){
106 316 global $wpdb;
107 317 $project_data = array();
108 - $project = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project WHERE id='$project_id' ");
318 + $project_id = absint($project_id);
319 + $project = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
109 320 if( $project ){
110 - $project_data = json_decode(json_encode($project), true);
321 + $project_data = json_decode(wp_json_encode($project), true);
111 322 }
112 323 return $project_data;
113 324 }
114 325
326 + public function get_attachment($attachment_id){
327 + global $wpdb;
328 + $attachment_data = array();
329 + $attachment_id = absint($attachment_id);
330 + $attachment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id = %d", $attachment_id));
331 + if( $attachment ){
332 + $attachment_data = json_decode(wp_json_encode($attachment), true);
333 + }
334 + return $attachment_data;
335 + }
336 +
115 337 public function has_permission($permission, $task_id){
116 338 global $current_user,$wppmfunction,$wpdb;
339 + $task_id = absint($task_id);
340 + $wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
341 + $wppm_edit_tasks_permission = get_option('wppm_default_edit_tasks_permission');
342 + $wppm_allow_coworkers_add_checklist = get_option('wppm_allow_coworkers_add_checklist');
343 + $wppm_allow_coworkers_create_task = get_option('wppm_allow_coworkers_create_task');
344 + $wppm_allow_coworkers_change_status = get_option('wppm_allow_coworkers_change_status');
345 + $wppm_allow_coworkers_assign_users = get_option('wppm_allow_coworkers_assign_users');
117 346 if(empty($comment_id)){
118 347 $comment_id = 0;
119 348 }
349 + $comment_id = absint($comment_id);
120 350 $task_data = $wppmfunction->get_task($task_id);
121 - $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = $task_id AND id = $comment_id");
351 + $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d AND id = %d", $task_id, $comment_id));
122 352
123 353 if(!empty($task_data['project'])){
124 354 $project_id = $task_data['project'];
125 - $project_user_role = $wpdb->get_var("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = $project_id AND user_id = $current_user->ID");
355 + $project_id = absint($project_id);
356 + $project_data = $wppmfunction->get_project($project_id);
357 + $cu_user_id = absint($current_user->ID);
358 + $project_user_role = $wpdb->get_var($wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_user_id));
359 + $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
360 + $project_users_arr = explode(',',(string)$project_users);
126 361 }
127 362 $response = false;
128 363 $flag = false;
129 364 if(!empty($task_data)){
130 365 $co_worker = $task_data['users'];
131 - $co_worker_array = explode(",",$co_worker);
366 + $co_worker_array = explode(",",(string)$co_worker);
132 367 }
133 - if((!empty($project_user_role)) && ($project_user_role == 1)){
368 + if((!empty($project_user_role)) && ($project_user_role == 1) && in_array($current_user->ID,$project_users_arr)){
134 369 $flag= true;
135 370 }
371 + if($wppm_current_user_capability=='wppm_admin'){
372 + $flag = true;
373 + }
374 + if(!empty($project_data) && $project_data['created_by']==$current_user->ID && $wppm_current_user_capability=='wppm_manager'){
375 + $flag = true;
376 + }
377 + if($current_user->has_cap('manage_options')){
378 + $flag = true;
379 + }
380 + if(!empty($project_id)){
381 + $project_id = absint($project_id);
382 + $public_proj_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta where project_id= %d AND meta_key='public_project'", $project_id));
383 + }else{
384 + $public_proj_meta ="";
385 + }
136 386 switch ($permission) {
137 387 case 'change_status':
138 388 case 'view_task':
139 - ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) )|| ($current_user->ID == $task_data['created_by']) || ($flag==true) ? $response = true: $response = false;
389 + case 'add_task_comment':
390 + ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) )|| ($current_user->ID == $task_data['created_by']) || $public_proj_meta==1 || ($flag==true) || $current_user->has_cap('manage_options') ? $response = true: $response = false;
140 391 break;
141 392 case 'change_task_details':
393 + (($flag==true) || ($current_user->ID == $task_data['created_by']) || $wppm_edit_tasks_permission == 1) ? $response = true: $response = false;
394 + break;
395 + case 'add_new_task':
396 + (($flag==true) || $wppm_allow_coworkers_create_task == 1) ? $response = true: $response = false;
397 + break;
398 + case 'add_checklist':
399 + (($flag==true) || $wppm_allow_coworkers_add_checklist == 1) ? $response = true: $response = false;
400 + break;
401 + case 'change_task_status':
402 + (($flag==true) || $wppm_allow_coworkers_change_status == 1) ? $response = true: $response = false;
403 + break;
142 404 case 'delete_task':
405 + case 'clone_task':
143 406 (($flag==true) || ($current_user->ID == $task_data['created_by'])) ? $response = true: $response = false;
144 407 break;
145 408 case 'assign_task_users':
409 + (($flag==true) || $wppm_allow_coworkers_assign_users == 1) ? $response = true: $response = false;
410 + break;
146 411 case 'change_raised_by':
412 + case 'edit_checklist':
413 + case 'delete_checklist':
147 414 (($flag==true) ? $response = true: $response = false);
148 - break;
415 + break;
149 416 }
150 417 return apply_filters( 'wppm_has_permission', $response, $task_id, $permission );
151 418 }
152 419
@@ -151,28 +418,44 @@
151 418 }
152 419
153 420 public function has_comment_permission($permission, $task_id,$comment_id){
154 421 global $current_user,$wppmfunction,$wpdb;
422 + $task_id = absint($task_id);
423 + $comment_id = absint($comment_id);
424 + $wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
155 425 if(empty($comment_id)){
156 426 $comment_id = 0;
157 427 }
158 428 $task_data = $wppmfunction->get_task($task_id);
159 429 $project_user = array();
160 - $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = $task_id AND id = $comment_id");
430 + $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d AND id = %d", $task_id, $comment_id));
161 431
162 432 if(isset($task_data['project'])){
163 433 $project_id = $task_data['project'];
164 - $project_user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = $project_id AND user_id = $current_user->ID");
434 + $project_id = absint($project_id);
435 + $cu_id = absint($current_user->ID);
436 + $project_data = $wppmfunction->get_project($project_id);
437 + $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_id));
438 + $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
439 + $project_users_arr = explode(',',(string)$project_users);
165 440 }
166 441 $response = false;
167 442 $flag = false;
168 443 if(!empty($task_data)){
169 444 $co_worker = $task_data['users'];
170 - $co_worker_array = explode(",",$co_worker);
445 + $co_worker_array = explode(",",(string)$co_worker);
171 446 }
172 - if((!empty($project_user)) && ($project_user->role_id == 1)){
447 + if((!empty($project_user)) && ($project_user->role_id == 1) && in_array($current_user->ID,$project_users_arr)){
173 448 $flag= true;
174 449 }
450 + if($wppm_current_user_capability=='wppm_admin'){
451 + $flag = true;
452 + }
453 +
454 + if(!empty($project_data) && $project_data['created_by']==$current_user->ID && $wppm_current_user_capability=='wppm_manager'){
455 + $flag = true;
456 + }
457 +
175 458 switch ($permission) {
176 459 case 'delete_task_thread':
177 460 case 'edit_task_comment':
178 461 (($flag==true) || ($current_user->ID == $task_comment->created_by)) ? $response = true: $response = false;
@@ -180,21 +463,69 @@
180 463 }
181 464 return apply_filters( 'wppm_has_comment_permission', $response, $task_id, $comment_id, $permission );
182 465 }
183 466
467 + public function has_proj_comment_permission($permission, $proj_id,$comment_id){
468 + global $current_user,$wppmfunction,$wpdb;
469 + $wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
470 + $proj_id = absint($proj_id);
471 + $comment_id = absint($comment_id);
472 + $cu_id = absint($current_user->ID);
473 + if(empty($comment_id)){
474 + $comment_id = 0;
475 + }
476 + $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $proj_id, $cu_id));
477 + $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $proj_id));
478 + $project_users_arr = explode(',',(string)$project_users);
479 + $proj_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE proj_id = %d AND id = %d", $proj_id, $comment_id));
480 + $response = false;
481 + $flag = false;
482 + $project_data = $wppmfunction->get_project($proj_id);
483 + if((!empty($project_user)) && ($project_user->role_id == 1) && in_array($current_user->ID,$project_users_arr)){
484 + $flag= true;
485 + }
486 + if($wppm_current_user_capability=='wppm_admin'){
487 + $flag = true;
488 + }
489 + if(!empty($project_data) && $project_data['created_by']==$current_user->ID && $wppm_current_user_capability=='wppm_manager'){
490 + $flag = true;
491 + }
492 + switch ($permission) {
493 + case 'delete_proj_thread':
494 + case 'edit_proj_comment':
495 + (($flag==true) || ($current_user->ID == $proj_comment->created_by)) ? $response = true: $response = false;
496 + break;
497 + }
498 + return apply_filters( 'wppm_has_proj_comment_permission', $response, $proj_id, $comment_id, $permission );
499 + }
500 +
184 501 public function has_project_permission($permission,$project_id){
185 502 global $current_user,$wppmfunction,$wpdb ;
186 503 $project_data = $wppmfunction->get_project($project_id);
187 - $project_user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = $project_id AND user_id = $current_user->ID");
504 + $project_id = absint($project_id);
505 + $cu_id = absint($current_user->ID);
506 + $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_id));
507 + $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
508 + $project_users_arr = explode(',',(string)$project_users);
188 509 $user = wp_get_current_user();
510 + $wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
189 511 if(!empty($project_data)){
190 512 $co_worker = $project_data['users'];
191 - $co_worker_array = explode(",",$co_worker);
513 + $co_worker_array = explode(",",(string)$co_worker);
192 514 }
515 + if(!empty($project_id)){
516 + $public_proj_meta = $wpdb->get_var( $wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta where project_id= %d AND meta_key='public_project'", $project_id));
517 + }else{
518 + $public_proj_meta ="";
519 + }
520 +
193 521 switch ($permission) {
194 522 case 'view_project':
195 523 ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) )? $response = true: $response = false;
196 524 break;
525 + case 'add_proj_comment':
526 + ( ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) ) || ( $public_proj_meta == '1') || $current_user->has_cap('manage_options')|| $wppm_current_user_capability == 'wppm_admin' || $wppm_current_user_capability == 'wppm_manager')? $response = true: $response = false;
527 + break;
197 528 case 'change_project_status':
198 529 case 'assign_project_users':
199 530 case 'change_project_raised_by':
200 531 case 'change_project_details':
@@ -199,12 +530,13 @@
199 530 case 'change_project_raised_by':
200 531 case 'change_project_details':
201 532 case 'delete_project':
202 533 $flag = false;
203 - if( (!empty($project_user)) && ($project_user->role_id == 1)){
534 + if( (!empty($project_user)) && ($project_user->role_id == 1) && in_array($current_user->ID,$project_users_arr)){
204 535 $flag = true;
205 536 }
206 - ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array) && $flag==true)) ? $response = true: $response = false;
537 +
538 + (((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array) && $flag==true) || $wppm_current_user_capability == 'wppm_admin')) ? $response = true: $response = false;
207 539 break;
208 540 }
209 541 return apply_filters( 'wppm_has_project_permission', $response, $project_id, $permission );
210 542 }
@@ -213,11 +545,11 @@
213 545 global $wpdb,$wppmfunction;
214 546 $task_data = $wppmfunction->get_task($task_id);
215 547 $prev_status = $task_data['status'];
216 548 $values=array(
217 - 'status'=>$status_id
549 + 'status'=>esc_sql($status_id)
218 550 );
219 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
551 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
220 552 $old_task_status_meta = $wppmfunction->get_task_meta($task_id,'old_task_status',true);
221 553 if(!empty($old_task_status_meta)){
222 554 $wppmfunction->delete_task_meta($task_id,'old_task_status');
223 555 }
@@ -228,11 +560,11 @@
228 560
229 561 public function change_raised_by($task_id, $user_id){
230 562 global $wpdb;
231 563 $values=array(
232 - 'created_by'=>$user_id
564 + 'created_by'=>absint($user_id)
233 565 );
234 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
566 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
235 567 }
236 568
237 569 public function change_task_label($task_id, $task_label){
238 570 global $wpdb;
@@ -238,17 +570,17 @@
238 570 global $wpdb;
239 571 $values=array(
240 572 'task_name'=>stripslashes($task_label)
241 573 );
242 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
574 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
243 575 }
244 576
245 577 public function change_task_project_label($task_id, $project_label){
246 578 global $wpdb;
247 579 $values=array(
248 - 'project'=>$project_label
580 + 'project'=>absint($project_label)
249 581 );
250 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
582 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
251 583 }
252 584
253 585 public function change_start_date($task_id, $task_start_date){
254 586 global $wpdb;
@@ -254,9 +586,9 @@
254 586 global $wpdb;
255 587 $values=array(
256 588 'start_date'=>$task_start_date
257 589 );
258 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
590 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
259 591 }
260 592
261 593 public function change_end_date($task_id, $task_end_date){
262 594 global $wpdb;
@@ -262,62 +594,139 @@
262 594 global $wpdb;
263 595 $values=array(
264 596 'end_date'=>$task_end_date
265 597 );
266 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
598 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
267 599 }
268 600
269 601 public function change_priority($task_id, $task_priority){
270 602 global $wpdb;
271 603 $values=array(
272 - 'priority'=>$task_priority
604 + 'priority'=>absint($task_priority)
273 605 );
274 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
606 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
275 607 }
276 608
277 609 public function change_description($task_id, $task_description){
278 610 global $wpdb;
611 + $task_description = !empty($task_description) ? wp_kses_post($task_description) : '';
279 612 $values=array(
280 613 'description'=>$task_description
281 614 );
282 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
615 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
283 616 }
284 617
618 + public function change_project($task_id,$proj_id){
619 + global $wpdb,$wppmfunction;
620 + $task_data = $wppmfunction->get_task($task_id);
621 + $old_proj = $task_data['project'];
622 + $old_proj = absint( $old_proj);
623 + $proj_id = absint( $proj_id);
624 + $project_data = $wppmfunction->get_project($proj_id);
625 + $task_assign_users = $task_data['users'];
626 + $tusers_array = array();
627 + if(!empty($task_data['users'])){
628 + $task_users_array = explode(",",(string)$task_assign_users);
629 + }
630 + if(!empty($project_data['users'])){
631 + $project_users = explode(",",(string)$project_data['users']);
632 + }
633 + if(!empty($project_users)){
634 + if(!empty($task_users_array)){
635 + foreach($task_users_array as $tuser){
636 + if(!in_array($tuser,$project_users)){
637 + $wpdb->delete( $wpdb->prefix.'wppm_project_users', array( 'proj_id' => "$proj_id",'user_id'=>"$tuser") );
638 + }
639 + elseif(in_array($tuser,$project_users)){
640 + $tusers_array[] = $tuser;
641 + $tuser = absint($tuser);
642 + $sql = $wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $old_proj, $tuser);
643 + $old_proj_user_role = $wpdb->get_var( $sql );
644 + $sql = $wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $proj_id, $tuser);
645 + $proj_users_role = $wpdb->get_var( $sql );
646 + if(!empty( $old_proj_user_role) && $old_proj_user_role!=$proj_users_role){
647 + $value=array(
648 + 'role_id'=>absint($proj_users_role)
649 + );
650 + $wpdb->update($wpdb->prefix.'wppm_project_users', $value, array('proj_id'=>"$proj_id", 'user_id'=>"$tuser"));
651 + }
652 + }
653 + }
654 + }
655 + }
656 + $tusers = implode(",",$tusers_array);
657 + $values=array(
658 + 'project'=>absint($proj_id),
659 + 'users'=>absint($tusers)
660 + );
661 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
662 + }
663 +
285 664 public function get_task_comment($comment_id){
286 665 global $wpdb;
287 666 $task_comment_data = array();
288 - $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE id=$comment_id ");
667 + $comment_id = absint($comment_id);
668 + $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE id=%d", $comment_id));
289 669 if( $task_comment ){
290 - $task_comment_data = json_decode(json_encode($task_comment), true);
670 + $task_comment_data = json_decode(wp_json_encode($task_comment), true);
291 671 }
292 672 return $task_comment_data;
293 673 }
294 674
675 + public function get_proj_comment($comment_id){
676 + global $wpdb;
677 + $project_comment_data = array();
678 + $comment_id = absint($comment_id);
679 + $project_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE id=%d", $comment_id));
680 + if( $project_comment ){
681 + $project_comment_data = json_decode(wp_json_encode($project_comment), true);
682 + }
683 + return $project_comment_data;
684 + }
685 +
295 686 public function change_task_comment($comment_id,$comment_body){
296 687 global $wpdb;
688 + $comment_id = absint($comment_id);
689 + $comment_body = !empty($comment_body) ? wp_kses_post($comment_body) : '';
297 690 $values=array(
298 691 'body'=>$comment_body
299 692 );
300 - $wpdb->update($wpdb->prefix.'wppm_task_comment', $values, array('id'=>$comment_id));
693 + $wpdb->update($wpdb->prefix.'wppm_task_comment', $values, array('id'=>"$comment_id"));
301 694 }
695 +
696 + public function change_proj_comment($comment_id,$comment_body){
697 + global $wpdb;
698 + $comment_id = absint($comment_id);
699 + $comment_body = !empty($comment_body) ? wp_kses_post($comment_body) : '';
700 + $values=array(
701 + 'body'=>$comment_body
702 + );
703 + $wpdb->update($wpdb->prefix.'wppm_project_comment', $values, array('id'=>"$comment_id"));
704 + }
705 +
302 706 public function change_project_label($project_id,$project_label){
303 707 global $wpdb;
708 + $project_id = absint($project_id);
304 709 $values=array(
305 - 'project_name'=>$project_label
710 + 'project_name'=>esc_sql($project_label)
306 711 );
307 - $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
712 + $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
308 713 }
309 714
310 715 public function change_project_start_date($project_id, $project_start_date){
311 716 global $wpdb;
717 + $project_id = absint($project_id);
718 + $project_start_date = esc_sql($project_start_date);
312 719 $values=array(
313 720 'start_date'=>$project_start_date
314 721 );
315 - $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
722 + $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
316 723 }
317 724
318 725 public function change_project_end_date($project_id, $project_end_date){
319 726 global $wpdb;
727 + $project_id = absint($project_id);
728 + $project_end_date = esc_sql($project_end_date);
320 729 $values=array(
321 730 'end_date'=>$project_end_date
322 731 );
323 732 $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
@@ -324,34 +733,48 @@
324 733 }
325 734
326 735 public function change_category($project_id, $project_category){
327 736 global $wpdb;
737 + $project_id = absint($project_id);
738 + $project_category = absint($project_category);
328 739 $values=array(
329 740 'cat_id'=>$project_category
330 741 );
331 - $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
742 + $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
332 743 }
333 744
334 745 public function change_project_description($project_id, $project_description){
335 746 global $wpdb;
336 - $values=array(
337 - 'description'=>$project_description
747 + $project_id = absint($project_id);
748 + $project_description = (string) ( $project_description ?? '' );
749 + $values = array(
750 + 'description' => wp_kses_post( $project_description )
338 751 );
339 - $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
752 + $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
340 753 }
341 754
342 755 public function change_project_status($project_id,$status_id){
343 - global $wpdb,$wppmfunction;
756 + global $wpdb,$wppmfunction,$current_user;
757 + $change_status_value= array();
344 758 $proj_data = $wppmfunction->get_project($project_id);
345 759 $prev_status = $proj_data['status'];
760 + $cu_id = absint($current_user->ID);
346 761 $values=array(
347 - 'status'=>$status_id
762 + 'status'=>absint($status_id)
348 763 );
764 + $project_id = absint($project_id);
349 765 $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
350 766 $old_project_status_meta = $wppmfunction->get_project_meta($project_id,'old_project_status',true);
351 767 if(!empty($old_project_status_meta)){
352 768 $wppmfunction->delete_project_meta($project_id,'old_project_status');
353 769 }
770 + $change_status_value = array('prev_status'=>"$prev_status",'new_status'=>"$status_id");
771 + $change_status_obj = serialize($change_status_value);
772 + $log_values = array('proj_id'=>"$project_id",'body'=>$change_status_obj,'attachment_ids'=>"",'create_time'=>wp_date("Y-m-d h:i:sa"),'created_by'=>"$cu_id" );
773 + $wpdb->insert($wpdb->prefix . 'wppm_project_comment',$log_values);
774 + $log_id = absint($wpdb->insert_id);
775 + $proj_log_values = array('proj_id'=>"$project_id",'comment_id'=>"$log_id",'comment_type'=>'change_proj_status');
776 + $wpdb->insert($wpdb->prefix . 'wppm_project_comment_meta',$proj_log_values);
354 777 $wppmfunction->add_project_meta($project_id,'old_project_status',$prev_status);
355 778 do_action('wppm_set_change_project_status', $project_id, $status_id, $prev_status);
356 779 }
357 780
@@ -357,23 +780,24 @@
357 780
358 781 public function change_project_raised_by($project_id, $user_id){
359 782 global $wpdb;
360 783 $values=array(
361 - 'created_by'=>$user_id
784 + 'created_by'=>absint($user_id)
362 785 );
363 - $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
786 + $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
364 787 }
365 788
366 789 // Email Notification types
367 790 public function get_email_notification_types(){
368 791 $notification_types = array(
369 - 'new_project'=>__('New Project','taskbuilder'),
370 - 'new_task'=>__('New Task','taskbuilder'),
371 - 'change_project_status' => __('Change Project Status','taskbuilder'),
372 - 'change_task_status' => __('Change Task Status','taskbuilder'),
373 - 'change_project_assign_users' => __('Change Project Assign Users','taskbuilder'),
374 - 'change_task_assign_users' => __('Change Task Assign Users','taskbuilder'),
375 - 'new_discussion' => __('New Comment','taskbuilder'),
792 + 'new_project'=>esc_html__('New Project','taskbuilder'),
793 + 'new_task'=>esc_html__('New Task','taskbuilder'),
794 + 'change_project_status' => esc_html__('Change Project Status','taskbuilder'),
795 + 'change_task_status' => esc_html__('Change Task Status','taskbuilder'),
796 + 'change_project_assign_users' => esc_html__('Change Project Assign Users','taskbuilder'),
797 + 'change_task_assign_users' => esc_html__('Change Task Assign Users','taskbuilder'),
798 + 'new_discussion' => esc_html__('New Comment','taskbuilder'),
799 + 'new_proj_discussion' =>esc_html__('New Project Comment','taskbuilder')
376 800 );
377 801 return apply_filters('wppm_en_types',$notification_types);
378 802 }
379 803
@@ -390,9 +814,9 @@
390 814 global $wpdb;
391 815 $wpdb->insert(
392 816 $wpdb->prefix . 'wppm_project_meta',
393 817 array(
394 - 'project_id' => $proj_id,
818 + 'project_id' =>$proj_id,
395 819 'meta_key' => $meta_key,
396 820 'meta_value' =>$meta_value
397 821 ));
398 822 }
@@ -409,15 +833,17 @@
409 833 }
410 834
411 835 public function get_project_meta($project_id,$meta_key,$flag = false){
412 836 global $wpdb,$wppmfunction;
837 + $project_id = absint($project_id);
838 + $meta_key = esc_sql($meta_key);
413 839 if($flag){
414 - $get_meta = $wpdb->get_var("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = '$meta_key' ");
415 - $project_meta = stripslashes($get_meta) ? stripslashes($get_meta) : '';
840 + $get_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
841 + $project_meta = isset($get_meta) ? stripslashes($get_meta) : '';
416 842
417 843 } else {
418 844 $project_meta = array();
419 - $results = $wpdb->get_results("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = '$meta_key'");
845 + $results = $wpdb->get_results($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
420 846 if( (!empty($results)) ){
421 847 foreach ($results as $result) {
422 848 if(!empty($result)){
423 849 $project_meta[]= stripslashes($result->meta_value);
@@ -429,15 +855,17 @@
429 855 }
430 856
431 857 public function get_task_meta($task_id,$meta_key,$flag = false){
432 858 global $wpdb,$wppmfunction;
859 + $task_id = absint($task_id);
860 + $meta_key = esc_sql($meta_key);
433 861 if($flag){
434 - $get_meta = $wpdb->get_var("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = '$meta_key' ");
435 - $task_meta = stripslashes($get_meta) ? stripslashes($get_meta) : '';
862 + $get_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
863 + $task_meta = isset($get_meta) ? stripslashes($get_meta) : '';
436 864
437 865 } else {
438 866 $task_meta = array();
439 - $results = $wpdb->get_results("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = '$meta_key'");
867 + $results = $wpdb->get_results($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
440 868 if( (!empty($results)) ){
441 869 foreach ($results as $result) {
442 870 if(!empty($result)){
443 871 $task_meta[]= stripslashes($result->meta_value);
@@ -461,8 +889,28 @@
461 889 }
462 890 return apply_filters( 'wppm_get_prev_assigned_users_emails', $user_emails ,$project_id);
463 891 }
464 892
893 + public function get_project_creator_email($project_id){
894 + global $wpdb,$wppmfunction;
895 + $project_data = $wppmfunction->get_project($project_id,'created_by');
896 + $userdata = get_userdata($project_data['created_by']);
897 + if(!empty( $userdata)){
898 + $proj_creator_email[] = $userdata->user_email;
899 + }
900 + return apply_filters( 'wppm_get_project_creator_email', $proj_creator_email ,$project_id);
901 + }
902 +
903 + public function get_task_creator_email($task_id){
904 + global $wpdb,$wppmfunction;
905 + $task_data = $wppmfunction->get_task($task_id,'created_by');
906 + $userdata = get_userdata($task_data['created_by']);
907 + if(!empty( $userdata)){
908 + $task_creator_email[] = $userdata->user_email;
909 + }
910 + return apply_filters( 'wppm_get_task_creator_email', $task_creator_email ,$task_id);
911 + }
912 +
465 913 public function get_previously_assigned_task_users($task_id){
466 914 global $wpdb,$wppmfunction;
467 915 $prev_assigned_task_users = $wppmfunction->get_task_meta($task_id,'prev_assigned_task_users');
468 916 $user_emails = array();
@@ -467,10 +915,12 @@
467 915 $prev_assigned_task_users = $wppmfunction->get_task_meta($task_id,'prev_assigned_task_users');
468 916 $user_emails = array();
469 917 if(!empty($prev_assigned_task_users)){
470 918 foreach ($prev_assigned_task_users as $user) {
471 - $userdata = get_userdata($user);
472 - $user_emails[] = $userdata->user_email;
919 + if(!empty($user)){
920 + $userdata = get_userdata($user);
921 + $user_emails[] = $userdata->user_email;
922 + }
473 923 }
474 924 }
475 925 return apply_filters( 'wppm_get_prev_assigned_task_users_emails', $user_emails ,$task_id);
476 926 }
@@ -478,10 +928,12 @@
478 928 * Update project meta for project
479 929 */
480 930 function update_project_meta($project_id ,$meta_key ,$meta_value){
481 931 global $wpdb;
482 - $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = $meta_key");
483 - $wpdb->update($wpdb->prefix.'wppm_project_meta', $meta_value, array('project_id'=>$project_id,'meta_key' => $meta_key));
932 + $project_id = absint($project_id);
933 + $meta_key = esc_sql($meta_key);
934 + $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
935 + $wpdb->update($wpdb->prefix.'wppm_project_meta', $meta_value, array('project_id'=>$project_id,'meta_key' => "$meta_key"));
484 936 }
485 937
486 938 /**
487 939 * Update task meta for task
@@ -487,20 +939,26 @@
487 939 * Update task meta for task
488 940 */
489 941 function update_task_meta($task_id ,$meta_key ,$meta_value){
490 942 global $wpdb;
491 - $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = $meta_key");
492 - $wpdb->update($wpdb->prefix.'wppm_task_meta', $meta_value, array('task_id'=>$task_id,'meta_key' => $meta_key));
943 + $task_id = absint($task_id);
944 + $meta_key = esc_sql($meta_key);
945 + $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
946 + $wpdb->update($wpdb->prefix.'wppm_task_meta', $meta_value, array('task_id'=>$task_id,'meta_key' => "$meta_key"));
493 947 }
494 948
495 949 function delete_project_meta($project_id ,$meta_key){
496 950 global $wpdb;
497 - $wpdb->delete( $wpdb->prefix.'wppm_project_meta', array( 'project_id' => $project_id,'meta_key'=>$meta_key) );
951 + $project_id = absint($project_id);
952 + $meta_key = ($meta_key);
953 + $wpdb->delete( $wpdb->prefix.'wppm_project_meta', array( 'project_id' => "$project_id",'meta_key'=>"$meta_key") );
498 954 }
499 955
500 956 function delete_task_meta($task_id ,$meta_key){
501 957 global $wpdb;
502 - $wpdb->delete( $wpdb->prefix.'wppm_task_meta', array( 'task_id' => $task_id,'meta_key'=>$meta_key) );
958 + $task_id = absint($task_id);
959 + $meta_key = ($meta_key);
960 + $wpdb->delete( $wpdb->prefix.'wppm_task_meta', array( 'task_id' => "$task_id",'meta_key'=>"$meta_key") );
503 961 }
504 962
505 963 public function replace_macro($str,$project_id){
506 964 include WPPM_ABSPATH . 'includes/replace_macro.php';
@@ -514,15 +972,17 @@
514 972
515 973 public function get_old_project_status_name($id){
516 974 global $wppmfunction, $wpdb;
517 975 $old_project_status = $wppmfunction->get_project_meta($id,'old_project_status',true);
518 - $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id ='$old_project_status'");
976 + $old_project_status = absint($old_project_status);
977 + $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id = %d",$old_project_status));
519 978 return $status_name;
520 979 }
521 980
522 981 public function get_new_project_status_name($status_id){
523 982 global $wpdb;
524 - $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id ='$status_id'");
983 + $status_id = absint($status_id);
984 + $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id = %d",$status_id));
525 985 return $status_name;
526 986 }
527 987
528 988 public function get_old_task_status_name($task_id){
@@ -527,21 +987,28 @@
527 987
528 988 public function get_old_task_status_name($task_id){
529 989 global $wppmfunction, $wpdb;
530 990 $old_task_status = $wppmfunction->get_task_meta($task_id,'old_task_status',true);
531 - $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id ='$old_task_status'");
991 + $old_task_status = absint($old_task_status);
992 + $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id = %d",$old_task_status));
532 993 return $status_name;
533 994 }
534 995
535 996 public function get_new_task_status_name($status_id){
536 997 global $wpdb;
537 - $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id ='$status_id'");
998 + $status_id = absint($status_id);
999 + $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id = %d",$status_id));
538 1000 return $status_name;
539 1001 }
540 1002
541 1003 public function get_project_category_name($cat_id){
542 1004 global $wpdb;
543 - $cat_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_categories WHERE id ='$cat_id'");
1005 + $cat_id = absint($cat_id);
1006 + if(!empty($cat_id)){
1007 + $cat_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_categories WHERE id = %d",$cat_id));
1008 + }else{
1009 + $cat_name = "";
1010 + }
544 1011 return $cat_name;
545 1012 }
546 1013
547 1014 public function get_project_assigned_users_names($project_id){
@@ -568,9 +1035,9 @@
568 1035
569 1036 public function get_task_assigned_users_names($task_id){
570 1037 global $wppmfunction;
571 1038 $wppm_task_data = $wppmfunction->get_task($task_id);
572 - $wppm_task_assign_users_array = explode(",", $wppm_task_data['users']);
1039 + $wppm_task_assign_users_array = explode(",", (string)$wppm_task_data['users']);
573 1040 $users_names = array();
574 1041 if(!empty($wppm_task_assign_users_array)){
575 1042 foreach ($wppm_task_assign_users_array as $user_id) {
576 1043 if(!empty($user_id)){
@@ -615,15 +1082,17 @@
615 1082 }
616 1083
617 1084 public function get_task_priority_name($priority){
618 1085 global $wpdb;
619 - $priority_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_priorities WHERE id ='$priority'");
1086 + $priority = absint($priority);
1087 + $priority_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_priorities WHERE id = %d",$priority));
620 1088 return $priority_name;
621 1089 }
622 1090
623 1091 public function get_last_comment_user_name($task_id){
624 1092 global $wpdb;
625 - $task_comment_creator = $wpdb->get_var("SELECT created_by FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = $task_id)");
1093 + $task_id = absint($task_id);
1094 + $task_comment_creator = $wpdb->get_var($wpdb->prepare("SELECT created_by FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = %d)",$task_id));
626 1095 if(!empty($task_comment_creator)){
627 1096 $user = get_userdata( $task_comment_creator );
628 1097 return $user->display_name;
629 1098 }
@@ -630,12 +1099,294 @@
630 1099 }
631 1100
632 1101 public function get_last_comment_body($task_id){
633 1102 global $wpdb;
634 - $task_comment = $wpdb->get_var("SELECT body FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = $task_id)");
1103 + $task_id = absint($task_id);
1104 + $task_comment = $wpdb->get_var($wpdb->prepare("SELECT body FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = %d)",$task_id));
635 1105 return $task_comment;
636 1106 }
637 - }
1107 +
1108 + public function create_duplicate_task($ptask_id, $project_id,$internal_code_flag=false){
1109 + include WPPM_ABSPATH . 'includes/admin/tasks/open_task/wppm_set_clone_task.php';
1110 + }
638 1111
1112 + public function get_last_comment_proj_user_name($project_id){
1113 + global $wpdb;
1114 + $project_id = absint($project_id);
1115 + $proj_comment_creator = $wpdb->get_var($wpdb->prepare("SELECT created_by FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = %d)",$project_id));
1116 + if(!empty($proj_comment_creator)){
1117 + $user = get_userdata( $proj_comment_creator );
1118 + return $user->display_name;
1119 + }
1120 + }
639 1121
1122 + public function get_proj_comment_body($project_id){
1123 + global $wpdb;
1124 + $project_id = absint($project_id);
1125 + $proj_comment = $wpdb->get_var($wpdb->prepare("SELECT body FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = %d)",$project_id));
1126 + return $proj_comment;
1127 + }
1128 +
1129 + public function get_project_url($project_id, $view){
1130 + global $wpdb,$wppmfunction;
1131 + $project_id = absint($project_id);
1132 + $page_settings = get_option( 'wppm-page-settings' );
1133 + if ( $view == '0' ) {
1134 + $url = admin_url( 'admin.php?page=wppm-projects&section=project-list&id=' . $project_id );
1135 + } else {
1136 + $url = get_permalink( $page_settings['project-url-page'] );
1137 + $auth_id = $wppmfunction->get_project_meta($project_id,'project_auth_code',true);
1138 +
1139 + $url = add_query_arg(
1140 + array(
1141 + 'project-id' => $project_id,
1142 + 'auth-code' => $auth_id,
1143 +
1144 + ),
1145 + $url
1146 + );
1147 + }
1148 +
1149 + return $url;
1150 + }
1151 +
1152 + public function get_task_url($task_id, $view){
1153 + global $wpdb,$wppmfunction;
1154 + $task_id = absint($task_id);
1155 + $page_settings = get_option( 'wppm-page-settings' );
1156 + if ( $view == '0' ) {
1157 + $url = admin_url( 'admin.php?page=wppm-tasks&section=task-list&id=' . $task_id );
1158 + } else{
1159 + $url = get_permalink( $page_settings['task-url-page'] );
1160 + $auth_id = $this->wppm_get_auth_code($task_id);
1161 + $url = add_query_arg(
1162 + array(
1163 + 'task-id' => $task_id,
1164 + 'auth-code' => $auth_id,
1165 + ),
1166 + $url
1167 + );
1168 +
1169 + }
1170 +
1171 + return $url;
1172 + }
1173 +
1174 + public function wppm_user_role(){
1175 + $user_role = array(
1176 + 'wppm_admin' => array(
1177 + 'label' => esc_html__('WPPM Administrator','taskbuilder'),
1178 + ),
1179 + 'wppm_manager' => array(
1180 + 'label' => esc_html__('WPPM Manager','taskbuilder'),
1181 + )
1182 + );
1183 + return $user_role;
1184 + }
1185 +
1186 + public static function wppm_toolbar_options_setting() {
1187 + $toolbar = array(
1188 + array(
1189 + 'name' => esc_attr__( 'Bold', 'taskbuilder' ),
1190 + 'value' => 'bold',
1191 + ),
1192 + array(
1193 + 'name' => esc_attr__( 'Italic', 'taskbuilder' ),
1194 + 'value' => 'italic',
1195 + ),
1196 + array(
1197 + 'name' => esc_attr__( 'Underline', 'taskbuilder' ),
1198 + 'value' => 'underline',
1199 + ),
1200 + array(
1201 + 'name' => esc_attr__( 'Blockquote', 'taskbuilder' ),
1202 + 'value' => 'blockquote',
1203 + ),
1204 + array(
1205 + 'name' => esc_attr__( 'Align', 'taskbuilder' ),
1206 + 'value' => 'align',
1207 + ),
1208 + array(
1209 + 'name' => esc_attr__( 'Bulleted list', 'taskbuilder' ),
1210 + 'value' => 'bullist',
1211 + ),
1212 + array(
1213 + 'name' => esc_attr__( 'Numbered list', 'taskbuilder' ),
1214 + 'value' => 'numlist',
1215 + ),
1216 + array(
1217 + 'name' => esc_attr__( 'Right to left', 'taskbuilder' ),
1218 + 'value' => 'rtl',
1219 + ),
1220 + array(
1221 + 'name' => esc_attr__( 'Link', 'taskbuilder' ),
1222 + 'value' => 'link',
1223 + ),
1224 + array(
1225 + 'name' => esc_attr__( 'Image', 'taskbuilder' ),
1226 + 'value' => 'wppm_insert_editor_img',
1227 + ),
1228 + array(
1229 + 'name' => esc_attr__( 'Text Color', 'taskbuilder' ),
1230 + 'value' => 'forecolor',
1231 + ),
1232 + array(
1233 + 'name' => esc_attr__( 'Text Background Color', 'taskbuilder' ),
1234 + 'value' => 'backcolor',
1235 + ),
1236 + array(
1237 + 'name' => esc_attr__( 'Strikethrough', 'taskbuilder' ),
1238 + 'value' => 'strikethrough',
1239 + ),
1240 + );
1241 + return $toolbar;
1242 + }
1243 +
1244 + public static function wppm_load_setting_header_html() {
1245 + ?>
1246 + <div class="wppm-header" style="padding-left:20px;margin:10px 0 10px 0;display: flex; justify-content: space-between; align-items: center; position: sticky;top: 0;background: #fff !important;z-index: 9999;width:99%; left: 0; ">
1247 + <div class="wppm-header-title" style="display: flex; align-items: center; gap: 3px;">
1248 + <img src="<?php echo esc_url( WPPM_PLUGIN_URL . 'asset/images/taskbuilder_logo.png'); ?>" class="wppm-header-icon" alt="taskbuilder Icon" style="width: 33px; height: 33px;margin-right:10px !important;"/>
1249 + <h2 style="font-size: 30px; font-weight: 600; color: #333; margin: 0; font: 22px OpenSans-Light, Helvetica, Arial, sans-serif;"><?php esc_html_e( 'Taskbuilder', 'taskbuilder' )?></h2>
1250 + </div>
1251 + <div class="wppm-header-button" style="display: flex; justify-content: flex-end; gap: 3px;">
1252 + <div class="wppm-btn
1253 + " style="background-color: #0052CC; color: #fff; padding: 8px 10px;margin: 35px 0px 14px 0px;text-decoration: none;border-radius: 5px;transition: background 0.3s ease;box-shadow: 0 2px 5px rgba(0, 0, 0, 0.1);">
1254 + <img src="<?php echo esc_url( WPPM_PLUGIN_URL . 'asset/images/help.svg'); ?>" class="wppm-header-icon" alt="taskbuilder Icon" style="width: 20px; height: 19px;margin-bottom: -5px;"/>
1255 + <a href="https://taskbuilder.net/help/" target="__blank" style="color:#fff"><?php esc_html_e( 'Help', 'taskbuilder' )?></a>
1256 + </div>
1257 + <div class="wppm-btn" style="background-color: #0052CC; color: #fff; padding: 8px 10px;margin: 35px 0px 14px 0px;text-decoration: none;border-radius: 5px;transition: background 0.3s ease;box-shadow: 0 2px 5px rgba(0, 0, 0, 0.1);">
1258 + <img src="<?php echo esc_url( WPPM_PLUGIN_URL . 'asset/images/support.svg'); ?>" class="wppm-header-icon" alt="taskbuilder Icon" style="width: 15px; height: 19px;margin-bottom: -5px;"/>
1259 + <a href="https://taskbuilder.net/support/?wpsc-section=ticket-list" target="__blank" style="color:#fff"><?php esc_html_e( 'Support', 'taskbuilder' )?></a>
1260 + </div>
1261 + <div class="wppm-btn" style="background-color: #0052CC; color: #fff; padding: 8px 10px;margin: 35px 10px 14px 0px;text-decoration: none;border-radius: 5px;transition: background 0.3s ease;box-shadow: 0 2px 5px rgba(0, 0, 0, 0.1);">
1262 + <img src="<?php echo esc_url( WPPM_PLUGIN_URL . 'asset/images/pro_features.svg'); ?>" class="wppm-header-icon" alt="taskbuilder Icon" style="width: 15px; height: 19px;margin-bottom: -5px;"/>
1263 + <a href="https://taskbuilder.net/pricing/" target="__blank" style="color:#fff"><?php esc_html_e( 'Get pro', 'taskbuilder' )?></a>
1264 + </div>
1265 + </div>
1266 + </div>
1267 + <?php
1268 + }
1269 +
1270 + public function wppm_get_duration($start_date, $end_date){
1271 + if ( empty($start_date) || empty($end_date) || $start_date=='0000-00-00 00:00:00' || $end_date =='0000-00-00 00:00:00') {
1272 + return '';
1273 + }
1274 +
1275 + $start_ts = strtotime($start_date);
1276 + $end_ts = strtotime($end_date);
1277 +
1278 + if ( $end_ts <= $start_ts ) {
1279 + return '0 min';
1280 + }
1281 +
1282 + $diff = $end_ts - $start_ts;
1283 +
1284 + $days = floor($diff / 86400);
1285 + $hours = floor(($diff % 86400) / 3600);
1286 + $minutes = floor(($diff % 3600) / 60);
1287 +
1288 + $duration = [];
1289 +
1290 + if ($days > 0) $duration[] = $days . 'd';
1291 + if ($hours > 0) $duration[] = $hours . 'h';
1292 + if ($minutes > 0 || empty($duration)) $duration[] = $minutes . 'm';
1293 +
1294 + return implode(' ', $duration);
1295 +
1296 + }
1297 +
1298 + public function wppm_highlight_user_mentions($content, $current_user_id) {
1299 +
1300 + return preg_replace_callback(
1301 + '/<span[^>]*class="wppm-mention"[^>]*data-user-id="(\d+)"[^>]*>(.*?)<\/span>/is',
1302 + function($matches) use ($current_user_id) {
1303 +
1304 + $user_id = intval($matches[1]);
1305 + $text = $matches[2];
1306 +
1307 + // already processed → skip
1308 + if (strpos($matches[0], 'wppm-mention-me') !== false) {
1309 + return $matches[0];
1310 + }
1311 +
1312 + if ($user_id === $current_user_id) {
1313 + return '<span class="wppm-mention wppm-mention-me" data-user-id="' . esc_attr($user_id) . '">' . $text . '</span>';
1314 + }
1315 +
1316 + return '<span class="wppm-mention" data-user-id="' . esc_attr($user_id) . '">' . $text . '</span>';
1317 + },
1318 + $content
1319 + );
1320 + }
1321 + function wppm_clean_mentions_html($content) {
1322 + // Remove dropdown items
1323 + $content = preg_replace('/<div[^>]*class="mention-item"[^>]*>.*?<\/div>/is', '', $content);
1324 +
1325 + // Remove mention dropdown container
1326 + $content = preg_replace('/<div[^>]*id="wppm_mention_list"[^>]*>.*?<\/div>/is', '', $content);
1327 +
1328 + return $content;
1329 + }
1330 +
1331 + function wppm_extract_mentions($comment) {
1332 + preg_match_all('/data-user-id="(\d+)"/', $comment, $matches);
1333 + return $matches[1];
1334 + }
1335 +
1336 + function wppm_get_users_from_mentions($user_ids) {
1337 + $users = [];
1338 + foreach ($user_ids as $user_id) {
1339 + $user = get_user_by('id', intval($user_id));
1340 + if ($user) {
1341 + $users[] = $user;
1342 + }
1343 + }
1344 + return $users;
1345 + }
1346 +
1347 + function wppm_send_mention_email($email_addresses, $comment, $task_id) {
1348 + $page_setting = get_option('wppm-page-settings');
1349 + $from_name = get_option('wppm_en_from_name');
1350 + $from_email = get_option('wppm_en_from_email');
1351 + $view = $page_setting['task-url-page'];
1352 + $subject = esc_html__("You were mentioned in a comment", "taskbuilder");
1353 + $to = isset($email_addresses[0]) ? $email_addresses[0] : '';
1354 + if (!$to) {
1355 + return;
1356 + }
1357 + unset($email_addresses[0]);
1358 + $headers = "From: {$from_name} <{$from_email}>\r\n";
1359 + foreach ($email_addresses as $email_address) {
1360 + $headers .= "BCC: {$email_address}\r\n";
1361 + }
1362 + $headers .= "Content-Type: text/html; charset=UTF-8\r\n";
1363 + $task_url = $this->get_task_url($task_id, $view);
1364 + $message = esc_html__("Hello,", "taskbuilder");
1365 + $message .= "<br><br>";
1366 + $message .= esc_html__("You were mentioned in a comment:", "taskbuilder");
1367 + $message .= "<br><br>";
1368 + $message .= nl2br(esc_html(strip_tags($comment)));
1369 + $message .= "<br><br>";
1370 + $message .= esc_html__("View Task:", "taskbuilder") . " ";
1371 + $message .= '<a class="wppm_link" href="' . esc_url($task_url) . '" target="_blank">' . esc_html__("View Task", "taskbuilder") . '</a>';
1372 + wp_mail($to, $subject, $message, $headers);
1373 + do_action('wppm_after_sent_mention_mail', $email_addresses, $comment, $task_id);
1374 + }
1375 +
1376 + function wppm_insert_notification($user_id, $message, $link,$is_read,$type) {
1377 + global $wpdb;
1378 + $wpdb->insert(
1379 + $wpdb->prefix . 'wppm_notifications',
1380 + [
1381 + 'user_id' => $user_id,
1382 + 'message' => $message,
1383 + 'link' => $link,
1384 + 'is_read' => $is_read,
1385 + 'notification_type'=>$type,
1386 + 'created_at' => current_time('mysql')
1387 + ]
1388 + );
1389 + }
1390 + }
640 1391 endif;
641 1392 $GLOBALS['wppmfunction'] = new WPPM_Functions();