PluginProbe
Taskbuilder – Project Management & Task Management Tool With Kanban Board / 6.0.6
Taskbuilder – Project Management & Task Management Tool With Kanban Board v6.0.6
6.0.6 6.0.5 6.0.2 6.0.3 6.0.4 6.0.1 6.0.0 5.0.8 5.0.9 4.0.9 5.0.0 5.0.1 5.0.2 5.0.3 5.0.4 5.0.5 5.0.6 5.0.7 trunk 1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5 All 58 releases
← All changes | includes/class-wppm-functions.php +788 -94 1.0.5 → 6.0.6 View file →
@@ -11,9 +11,9 @@
11 11 if ( is_array( $value ) ) {
12 12 $value = $this->sanitize_array($value);
13 13 }
14 14 else {
15 - $value = sanitize_text_field( $value );
15 + $value = sanitize_text_field( wp_unslash( $value ) );
16 16 }
17 17 }
18 18 }
19 19 return $array;
@@ -20,8 +20,9 @@
20 20 }
21 21
22 22 public static function create_project($args){
23 23 global $wpdb,$current_user;
24 + $default_proj_status = get_option('wppm_default_project_status');
24 25 $values = array(
25 26 'created_by'=>$current_user->ID,
26 27 'project_name'=>$args['name'],
27 28 'description'=>isset($args['wppm_proj_description']) ? $args['wppm_proj_description']:"",
@@ -26,12 +27,14 @@
26 27 'project_name'=>$args['name'],
27 28 'description'=>isset($args['wppm_proj_description']) ? $args['wppm_proj_description']:"",
28 29 'start_date'=>isset($args['wppm_start_date']) ?$args['wppm_start_date']:"",
29 30 'end_date'=>isset($args['wppm_end_date'])? $args['wppm_end_date']:"",
30 - 'status'=>'1',
31 + 'status'=>isset($args['status'])? $args['status']:$default_proj_status,
31 32 'cat_id'=>isset($args['wppm_create_project_category']) ? $args['wppm_create_project_category']:"",
32 33 'users'=>isset($args['user_names']) ? implode(",",$args['user_names']):"",
33 - 'date_created'=>date("Y-m-d h:i:sa"),
34 + 'date_created'=>isset($args['date_created'])? $args['date_created']:wp_date("Y-m-d h:i:sa"),
35 + 'project_auth_code'=> self::getRandomString(10)
36 +
34 37 );
35 38 $wpdb->insert($wpdb->prefix .'wppm_project', $values);
36 39 $project_id = $wpdb->insert_id;
37 40 return $project_id;
@@ -37,22 +40,24 @@
37 40 return $project_id;
38 41 }
39 42
40 43 public static function create_task($args){
41 - global $wpdb,$current_user,$wppmfunction;
44 + global $wpdb,$current_user;
45 + $default_task_status = get_option('wppm_default_task_status');
42 46 $values = array(
43 - 'created_by'=>$current_user->ID,
47 + 'created_by'=>(isset($args['created_by'])) ? $args['created_by']: $current_user->ID,
44 48 'task_name'=>$args['name'],
45 49 'description'=>(isset($args['wppm_task_description']))?$args['wppm_task_description']:"",
46 50 'project'=>(isset($args['wppm_task_project']))?$args['wppm_task_project']:"",
47 51 'start_date'=>(isset($args['wppm_task_start_date']))?$args['wppm_task_start_date']:"",
48 52 'end_date'=>(isset($args['wppm_task_end_date']))?$args['wppm_task_end_date']:"",
49 - 'status'=>(isset($args['status']))?$args['status']:"1",
53 + 'status'=>(isset($args['status']))?$args['status']:$default_task_status,
50 54 'priority'=>(isset($args['wppm_create_task_priority']))?$args['wppm_create_task_priority']:"",
51 55 'users'=>(!empty($args['user_names']))?implode(",",$args['user_names']):"",
52 - 'date_created'=>date("Y-m-d h:i:sa"),
53 - 'task_auth_code'=> $wppmfunction->getRandomString(10),
54 - 'active'=>1
56 + 'date_created'=>isset($args['date_created'])? $args['date_created']:wp_date("Y-m-d h:i:sa"),
57 + 'task_auth_code'=> self::getRandomString(10),
58 + 'active'=>1,
59 + 'parent_task_id'=>(isset($args['parent_task_id']))?absint($args['parent_task_id']):0
55 60 );
56 61 $wpdb->insert($wpdb->prefix .'wppm_task', $values);
57 62 $task_id = $wpdb->insert_id;
58 63 return $task_id;
@@ -90,14 +95,35 @@
90 95 $comment_id = $wpdb->insert_id;
91 96 return $comment_id;
92 97 }
93 98
99 + public static function wppm_submit_task_comment_meta($args){
100 + global $wpdb;
101 + $wpdb->insert($wpdb->prefix.'wppm_task_comment_meta',$args);
102 + $comment_meta_id = $wpdb->insert_id;
103 + return $comment_meta_id;
104 + }
105 +
106 + public static function wppm_submit_proj_comment($args){
107 + global $wpdb;
108 + $wpdb->insert($wpdb->prefix.'wppm_project_comment',$args);
109 + $comment_id = $wpdb->insert_id;
110 + return $comment_id;
111 + }
112 +
113 + public static function wppm_submit_proj_comment_meta($args){
114 + global $wpdb;
115 + $wpdb->insert($wpdb->prefix.'wppm_project_comment_meta',$args);
116 + $comment_meta_id = $wpdb->insert_id;
117 + return $comment_meta_id;
118 + }
119 +
94 120 // Random string
95 121 public static function getRandomString($length = 8) {
96 122 $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
97 123 $string = '';
98 124 for ($i = 0; $i < $length; $i++) {
99 - $string .= $characters[mt_rand(0, strlen($characters) - 1)];
125 + $string .= $characters[wp_rand(0, strlen($characters) - 1)];
100 126 }
101 127 return $string;
102 128 }
103 129
@@ -102,29 +128,102 @@
102 128 }
103 129
104 130 public static function wppm_get_auth_code($id){
105 131 global $wpdb;
106 - $auth_code = $wpdb->get_var( "SELECT task_auth_code FROM {$wpdb->prefix}wppm_task where id=$id" );
132 + $id = absint($id);
133 + $auth_code = $wpdb->get_var(
134 + $wpdb->prepare(
135 + "SELECT task_auth_code
136 + FROM {$wpdb->prefix}wppm_task
137 + WHERE id = %d",
138 + ($id)
139 + )
140 + );
107 141 $auth_code = isset($auth_code) ? $auth_code : "";
108 142 return $auth_code;
109 143 }
110 144
145 + public static function wppm_get_proj_auth_code($id){
146 + global $wpdb;
147 + $id = absint($id);
148 + $auth_code = $wpdb->get_var(
149 + $wpdb->prepare(
150 + "SELECT project_auth_code
151 + FROM {$wpdb->prefix}wppm_project
152 + WHERE id = %d",
153 + ($id)
154 + )
155 + );
156 + $auth_code = isset($auth_code) ? $auth_code : "";
157 + return $auth_code;
158 + }
159 +
111 160 public static function get_task_fields($task_id,$select_field){
112 161 global $wpdb;
162 + $task_id = absint($task_id);
113 163 $task_field_value = '';
164 + $allowed_fields = array(
165 + 'id',
166 + 'created_by',
167 + 'task_name',
168 + 'description',
169 + 'project',
170 + 'start_date',
171 + 'end_date',
172 + 'status',
173 + 'priority',
174 + 'users',
175 + 'date_created',
176 + 'task_auth_code'
177 + );
178 +
179 + // Validate column name
180 + if ( ! in_array( $select_field, $allowed_fields, true ) ) {
181 + return '';
182 + }
114 183 if (apply_filters('wppm_get_select_field',true,$task_id,$select_field)) {
115 - $get_task_field_value = $wpdb->get_var(" SELECT $select_field FROM {$wpdb->prefix}wppm_task WHERE id='$task_id' ");
184 + $get_task_field_value = $wpdb->get_var($wpdb->prepare("SELECT $select_field FROM {$wpdb->prefix}wppm_task WHERE id = %d", $task_id));
116 185 $task_field_value = $get_task_field_value ? $get_task_field_value : '';
117 186 }
118 187 return stripslashes($task_field_value);
119 188 }
120 189
190 + public static function get_project_fields($proj_id,$select_field){
191 + global $wpdb;
192 + $proj_id = absint($proj_id);
193 + $project_field_value = '';
194 + $allowed_fields = array(
195 + 'id',
196 + 'created_by',
197 + 'project_name',
198 + 'description',
199 + 'start_date',
200 + 'end_date',
201 + 'status',
202 + 'cat_id',
203 + 'users',
204 + 'date_created',
205 + 'project_auth_code'
206 + );
207 +
208 + // Validate column name
209 + if ( ! in_array( $select_field, $allowed_fields, true ) ) {
210 + return '';
211 + }
212 + if (apply_filters('wppm_get_select_proj_field',true,$proj_id,$select_field)) {
213 + $get_project_field_value = $wpdb->get_var($wpdb->prepare("SELECT $select_field FROM {$wpdb->prefix}wppm_project WHERE id = %d", $proj_id));
214 + $project_field_value = $get_project_field_value ? $get_project_field_value : '';
215 + }
216 + return stripslashes($project_field_value);
217 + }
218 +
121 219 public function get_task($task_id){
122 220 global $wpdb;
123 221 $task_data = array();
124 - $task = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task WHERE id='$task_id' ");
222 + $task_id = absint($task_id);
223 + $task = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task WHERE id = %d", $task_id));
125 224 if( $task ){
126 - $task_data = json_decode(json_encode($task), true);
225 + $task_data = json_decode(wp_json_encode($task), true);
127 226 }
128 227 return $task_data;
129 228 }
130 229
@@ -129,12 +228,13 @@
129 228 }
130 229
131 230 public function get_checklist($task_id){
132 231 global $wpdb;
232 + $task_id = absint($task_id);
133 233 $checklist_data = array();
134 - $checklist = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_checklist WHERE task_id='$task_id' ");
234 + $checklist = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_checklist WHERE task_id = %d", $task_id));
135 235 if( $checklist ){
136 - $checklist_data = json_decode(json_encode($checklist), true);
236 + $checklist_data = json_decode(wp_json_encode($checklist), true);
137 237 }
138 238 return $checklist_data;
139 239 }
140 240
@@ -140,21 +240,86 @@
140 240
141 241 public function get_checklist_items($checklist_id){
142 242 global $wpdb;
143 243 $checklist_items_data = array();
144 - $checklist_items = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_checklist_items WHERE checklist_id='$checklist_id' ");
244 + $checklist_id = absint($checklist_id);
245 + $checklist_items = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_checklist_items WHERE checklist_id = %d", $checklist_id));
145 246 if( $checklist_items ){
146 - $checklist_items_data = json_decode(json_encode($checklist_items), true);
247 + $checklist_items_data = json_decode(wp_json_encode($checklist_items), true);
147 248 }
148 249 return $checklist_items_data;
149 250 }
150 251
252 + public function get_subtasks($task_id){
253 + global $wpdb;
254 + $task_id = absint($task_id);
255 + $subtasks_data = array();
256 + $subtasks = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d ORDER BY id ASC", $task_id));
257 + if( $subtasks ){
258 + $subtasks_data = json_decode(wp_json_encode($subtasks), true);
259 + }
260 + return $subtasks_data;
261 + }
262 +
263 + public function get_subtask_progress($task_id){
264 + global $wpdb;
265 + $task_id = absint($task_id);
266 + $completed_status_id = 4;
267 + $total = (int) $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d", $task_id));
268 + $completed = (int) $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d AND status = %d", $task_id, $completed_status_id));
269 + return array('total'=>$total,'completed'=>$completed);
270 + }
271 +
272 + // Deletes a task along with its subtasks (and each one's checklists/comments/attachments).
273 + public static function delete_task_and_children($task_id){
274 + global $wpdb;
275 + $task_id = absint($task_id);
276 + $child_ids = $wpdb->get_col($wpdb->prepare("SELECT id FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d", $task_id));
277 + foreach($child_ids as $child_id){
278 + self::delete_task_and_children($child_id);
279 + }
280 + $thread_attachment_ids = $wpdb->get_results($wpdb->prepare("SELECT attachment_ids FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d", $task_id));
281 + if(!empty($thread_attachment_ids)){
282 + foreach ($thread_attachment_ids as $thread_attachment_id){
283 + $attachment_ids_temp = array();
284 + if($thread_attachment_id->attachment_ids){
285 + $attachment_ids_temp = explode(',', $thread_attachment_id->attachment_ids);
286 + }
287 + foreach ($attachment_ids_temp as $attachment_id){
288 + $attachment_id = absint($attachment_id);
289 + $result = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id = %d", $attachment_id));
290 + if(!empty($result)){
291 + $attach_result = $wpdb->get_results($wpdb->prepare("SELECT file_path FROM {$wpdb->prefix}wppm_attachments WHERE file_path = %s", $result->file_path));
292 + if(file_exists($result->file_path) && count($attach_result) < 2){
293 + wp_delete_file($result->file_path);
294 + }
295 + $wpdb->delete($wpdb->prefix.'wppm_attachments', array('id' => $attachment_id));
296 + }
297 + }
298 + }
299 + }
300 + $checklists = $wpdb->get_results($wpdb->prepare("SELECT id FROM {$wpdb->prefix}wppm_checklist WHERE task_id = %d", $task_id));
301 + if(!empty($checklists)){
302 + foreach($checklists as $checklist){
303 + $checklist_id = absint($checklist->id);
304 + $wpdb->delete($wpdb->prefix.'wppm_checklist_items', array('checklist_id'=>$checklist_id));
305 + $wpdb->delete($wpdb->prefix.'wppm_checklist', array('id'=>$checklist_id));
306 + }
307 + }
308 + $wpdb->delete($wpdb->prefix.'wppm_task', array('id'=>$task_id));
309 + $wpdb->delete($wpdb->prefix.'wppm_task_meta', array('task_id'=>$task_id));
310 + $wpdb->delete($wpdb->prefix.'wppm_task_comment', array('task_id'=>$task_id));
311 + $wpdb->delete($wpdb->prefix.'wppm_task_comment_meta', array('task_id'=>$task_id));
312 + do_action('wppm_after_delete_task', $task_id);
313 + }
314 +
151 315 public function get_project($project_id){
152 316 global $wpdb;
153 317 $project_data = array();
154 - $project = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project WHERE id='$project_id' ");
318 + $project_id = absint($project_id);
319 + $project = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
155 320 if( $project ){
156 - $project_data = json_decode(json_encode($project), true);
321 + $project_data = json_decode(wp_json_encode($project), true);
157 322 }
158 323 return $project_data;
159 324 }
160 325
@@ -160,11 +325,12 @@
160 325
161 326 public function get_attachment($attachment_id){
162 327 global $wpdb;
163 328 $attachment_data = array();
164 - $attachment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id='$attachment_id' ");
329 + $attachment_id = absint($attachment_id);
330 + $attachment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id = %d", $attachment_id));
165 331 if( $attachment ){
166 - $attachment_data = json_decode(json_encode($attachment), true);
332 + $attachment_data = json_decode(wp_json_encode($attachment), true);
167 333 }
168 334 return $attachment_data;
169 335 }
170 336
@@ -169,41 +335,85 @@
169 335 }
170 336
171 337 public function has_permission($permission, $task_id){
172 338 global $current_user,$wppmfunction,$wpdb;
339 + $task_id = absint($task_id);
340 + $wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
341 + $wppm_edit_tasks_permission = get_option('wppm_default_edit_tasks_permission');
342 + $wppm_allow_coworkers_add_checklist = get_option('wppm_allow_coworkers_add_checklist');
343 + $wppm_allow_coworkers_create_task = get_option('wppm_allow_coworkers_create_task');
344 + $wppm_allow_coworkers_change_status = get_option('wppm_allow_coworkers_change_status');
345 + $wppm_allow_coworkers_assign_users = get_option('wppm_allow_coworkers_assign_users');
173 346 if(empty($comment_id)){
174 347 $comment_id = 0;
175 348 }
349 + $comment_id = absint($comment_id);
176 350 $task_data = $wppmfunction->get_task($task_id);
177 - $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = $task_id AND id = $comment_id");
351 + $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d AND id = %d", $task_id, $comment_id));
178 352
179 353 if(!empty($task_data['project'])){
180 354 $project_id = $task_data['project'];
181 - $project_user_role = $wpdb->get_var("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = $project_id AND user_id = $current_user->ID");
355 + $project_id = absint($project_id);
356 + $project_data = $wppmfunction->get_project($project_id);
357 + $cu_user_id = absint($current_user->ID);
358 + $project_user_role = $wpdb->get_var($wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_user_id));
359 + $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
360 + $project_users_arr = explode(',',(string)$project_users);
182 361 }
183 362 $response = false;
184 363 $flag = false;
185 364 if(!empty($task_data)){
186 365 $co_worker = $task_data['users'];
187 - $co_worker_array = explode(",",$co_worker);
366 + $co_worker_array = explode(",",(string)$co_worker);
188 367 }
189 - if((!empty($project_user_role)) && ($project_user_role == 1)){
368 + if((!empty($project_user_role)) && ($project_user_role == 1) && in_array($current_user->ID,$project_users_arr)){
190 369 $flag= true;
191 370 }
371 + if($wppm_current_user_capability=='wppm_admin'){
372 + $flag = true;
373 + }
374 + if(!empty($project_data) && $project_data['created_by']==$current_user->ID && $wppm_current_user_capability=='wppm_manager'){
375 + $flag = true;
376 + }
377 + if($current_user->has_cap('manage_options')){
378 + $flag = true;
379 + }
380 + if(!empty($project_id)){
381 + $project_id = absint($project_id);
382 + $public_proj_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta where project_id= %d AND meta_key='public_project'", $project_id));
383 + }else{
384 + $public_proj_meta ="";
385 + }
192 386 switch ($permission) {
193 387 case 'change_status':
194 388 case 'view_task':
195 - ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) )|| ($current_user->ID == $task_data['created_by']) || ($flag==true) ? $response = true: $response = false;
389 + case 'add_task_comment':
390 + ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) )|| ($current_user->ID == $task_data['created_by']) || $public_proj_meta==1 || ($flag==true) || $current_user->has_cap('manage_options') ? $response = true: $response = false;
196 391 break;
197 392 case 'change_task_details':
393 + (($flag==true) || ($current_user->ID == $task_data['created_by']) || $wppm_edit_tasks_permission == 1) ? $response = true: $response = false;
394 + break;
395 + case 'add_new_task':
396 + (($flag==true) || $wppm_allow_coworkers_create_task == 1) ? $response = true: $response = false;
397 + break;
398 + case 'add_checklist':
399 + (($flag==true) || $wppm_allow_coworkers_add_checklist == 1) ? $response = true: $response = false;
400 + break;
401 + case 'change_task_status':
402 + (($flag==true) || $wppm_allow_coworkers_change_status == 1) ? $response = true: $response = false;
403 + break;
198 404 case 'delete_task':
199 405 case 'clone_task':
200 406 (($flag==true) || ($current_user->ID == $task_data['created_by'])) ? $response = true: $response = false;
201 407 break;
202 408 case 'assign_task_users':
409 + (($flag==true) || $wppm_allow_coworkers_assign_users == 1) ? $response = true: $response = false;
410 + break;
203 411 case 'change_raised_by':
412 + case 'edit_checklist':
413 + case 'delete_checklist':
204 414 (($flag==true) ? $response = true: $response = false);
205 - break;
415 + break;
206 416 }
207 417 return apply_filters( 'wppm_has_permission', $response, $task_id, $permission );
208 418 }
209 419
@@ -208,28 +418,44 @@
208 418 }
209 419
210 420 public function has_comment_permission($permission, $task_id,$comment_id){
211 421 global $current_user,$wppmfunction,$wpdb;
422 + $task_id = absint($task_id);
423 + $comment_id = absint($comment_id);
424 + $wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
212 425 if(empty($comment_id)){
213 426 $comment_id = 0;
214 427 }
215 428 $task_data = $wppmfunction->get_task($task_id);
216 429 $project_user = array();
217 - $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = $task_id AND id = $comment_id");
430 + $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d AND id = %d", $task_id, $comment_id));
218 431
219 432 if(isset($task_data['project'])){
220 433 $project_id = $task_data['project'];
221 - $project_user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = $project_id AND user_id = $current_user->ID");
434 + $project_id = absint($project_id);
435 + $cu_id = absint($current_user->ID);
436 + $project_data = $wppmfunction->get_project($project_id);
437 + $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_id));
438 + $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
439 + $project_users_arr = explode(',',(string)$project_users);
222 440 }
223 441 $response = false;
224 442 $flag = false;
225 443 if(!empty($task_data)){
226 444 $co_worker = $task_data['users'];
227 - $co_worker_array = explode(",",$co_worker);
445 + $co_worker_array = explode(",",(string)$co_worker);
228 446 }
229 - if((!empty($project_user)) && ($project_user->role_id == 1)){
447 + if((!empty($project_user)) && ($project_user->role_id == 1) && in_array($current_user->ID,$project_users_arr)){
230 448 $flag= true;
231 449 }
450 + if($wppm_current_user_capability=='wppm_admin'){
451 + $flag = true;
452 + }
453 +
454 + if(!empty($project_data) && $project_data['created_by']==$current_user->ID && $wppm_current_user_capability=='wppm_manager'){
455 + $flag = true;
456 + }
457 +
232 458 switch ($permission) {
233 459 case 'delete_task_thread':
234 460 case 'edit_task_comment':
235 461 (($flag==true) || ($current_user->ID == $task_comment->created_by)) ? $response = true: $response = false;
@@ -237,21 +463,69 @@
237 463 }
238 464 return apply_filters( 'wppm_has_comment_permission', $response, $task_id, $comment_id, $permission );
239 465 }
240 466
467 + public function has_proj_comment_permission($permission, $proj_id,$comment_id){
468 + global $current_user,$wppmfunction,$wpdb;
469 + $wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
470 + $proj_id = absint($proj_id);
471 + $comment_id = absint($comment_id);
472 + $cu_id = absint($current_user->ID);
473 + if(empty($comment_id)){
474 + $comment_id = 0;
475 + }
476 + $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $proj_id, $cu_id));
477 + $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $proj_id));
478 + $project_users_arr = explode(',',(string)$project_users);
479 + $proj_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE proj_id = %d AND id = %d", $proj_id, $comment_id));
480 + $response = false;
481 + $flag = false;
482 + $project_data = $wppmfunction->get_project($proj_id);
483 + if((!empty($project_user)) && ($project_user->role_id == 1) && in_array($current_user->ID,$project_users_arr)){
484 + $flag= true;
485 + }
486 + if($wppm_current_user_capability=='wppm_admin'){
487 + $flag = true;
488 + }
489 + if(!empty($project_data) && $project_data['created_by']==$current_user->ID && $wppm_current_user_capability=='wppm_manager'){
490 + $flag = true;
491 + }
492 + switch ($permission) {
493 + case 'delete_proj_thread':
494 + case 'edit_proj_comment':
495 + (($flag==true) || ($current_user->ID == $proj_comment->created_by)) ? $response = true: $response = false;
496 + break;
497 + }
498 + return apply_filters( 'wppm_has_proj_comment_permission', $response, $proj_id, $comment_id, $permission );
499 + }
500 +
241 501 public function has_project_permission($permission,$project_id){
242 502 global $current_user,$wppmfunction,$wpdb ;
243 503 $project_data = $wppmfunction->get_project($project_id);
244 - $project_user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = $project_id AND user_id = $current_user->ID");
504 + $project_id = absint($project_id);
505 + $cu_id = absint($current_user->ID);
506 + $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_id));
507 + $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
508 + $project_users_arr = explode(',',(string)$project_users);
245 509 $user = wp_get_current_user();
510 + $wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
246 511 if(!empty($project_data)){
247 512 $co_worker = $project_data['users'];
248 - $co_worker_array = explode(",",$co_worker);
513 + $co_worker_array = explode(",",(string)$co_worker);
249 514 }
515 + if(!empty($project_id)){
516 + $public_proj_meta = $wpdb->get_var( $wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta where project_id= %d AND meta_key='public_project'", $project_id));
517 + }else{
518 + $public_proj_meta ="";
519 + }
520 +
250 521 switch ($permission) {
251 522 case 'view_project':
252 523 ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) )? $response = true: $response = false;
253 524 break;
525 + case 'add_proj_comment':
526 + ( ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) ) || ( $public_proj_meta == '1') || $current_user->has_cap('manage_options')|| $wppm_current_user_capability == 'wppm_admin' || $wppm_current_user_capability == 'wppm_manager')? $response = true: $response = false;
527 + break;
254 528 case 'change_project_status':
255 529 case 'assign_project_users':
256 530 case 'change_project_raised_by':
257 531 case 'change_project_details':
@@ -256,12 +530,13 @@
256 530 case 'change_project_raised_by':
257 531 case 'change_project_details':
258 532 case 'delete_project':
259 533 $flag = false;
260 - if( (!empty($project_user)) && ($project_user->role_id == 1)){
534 + if( (!empty($project_user)) && ($project_user->role_id == 1) && in_array($current_user->ID,$project_users_arr)){
261 535 $flag = true;
262 536 }
263 - ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array) && $flag==true)) ? $response = true: $response = false;
537 +
538 + (((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array) && $flag==true) || $wppm_current_user_capability == 'wppm_admin')) ? $response = true: $response = false;
264 539 break;
265 540 }
266 541 return apply_filters( 'wppm_has_project_permission', $response, $project_id, $permission );
267 542 }
@@ -270,11 +545,11 @@
270 545 global $wpdb,$wppmfunction;
271 546 $task_data = $wppmfunction->get_task($task_id);
272 547 $prev_status = $task_data['status'];
273 548 $values=array(
274 - 'status'=>$status_id
549 + 'status'=>esc_sql($status_id)
275 550 );
276 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
551 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
277 552 $old_task_status_meta = $wppmfunction->get_task_meta($task_id,'old_task_status',true);
278 553 if(!empty($old_task_status_meta)){
279 554 $wppmfunction->delete_task_meta($task_id,'old_task_status');
280 555 }
@@ -285,11 +560,11 @@
285 560
286 561 public function change_raised_by($task_id, $user_id){
287 562 global $wpdb;
288 563 $values=array(
289 - 'created_by'=>$user_id
564 + 'created_by'=>absint($user_id)
290 565 );
291 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
566 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
292 567 }
293 568
294 569 public function change_task_label($task_id, $task_label){
295 570 global $wpdb;
@@ -295,17 +570,17 @@
295 570 global $wpdb;
296 571 $values=array(
297 572 'task_name'=>stripslashes($task_label)
298 573 );
299 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
574 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
300 575 }
301 576
302 577 public function change_task_project_label($task_id, $project_label){
303 578 global $wpdb;
304 579 $values=array(
305 - 'project'=>$project_label
580 + 'project'=>absint($project_label)
306 581 );
307 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
582 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
308 583 }
309 584
310 585 public function change_start_date($task_id, $task_start_date){
311 586 global $wpdb;
@@ -311,9 +586,9 @@
311 586 global $wpdb;
312 587 $values=array(
313 588 'start_date'=>$task_start_date
314 589 );
315 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
590 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
316 591 }
317 592
318 593 public function change_end_date($task_id, $task_end_date){
319 594 global $wpdb;
@@ -319,62 +594,139 @@
319 594 global $wpdb;
320 595 $values=array(
321 596 'end_date'=>$task_end_date
322 597 );
323 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
598 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
324 599 }
325 600
326 601 public function change_priority($task_id, $task_priority){
327 602 global $wpdb;
328 603 $values=array(
329 - 'priority'=>$task_priority
604 + 'priority'=>absint($task_priority)
330 605 );
331 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
606 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
332 607 }
333 608
334 609 public function change_description($task_id, $task_description){
335 610 global $wpdb;
611 + $task_description = !empty($task_description) ? wp_kses_post($task_description) : '';
336 612 $values=array(
337 613 'description'=>$task_description
338 614 );
339 - $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>$task_id));
615 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
340 616 }
341 617
618 + public function change_project($task_id,$proj_id){
619 + global $wpdb,$wppmfunction;
620 + $task_data = $wppmfunction->get_task($task_id);
621 + $old_proj = $task_data['project'];
622 + $old_proj = absint( $old_proj);
623 + $proj_id = absint( $proj_id);
624 + $project_data = $wppmfunction->get_project($proj_id);
625 + $task_assign_users = $task_data['users'];
626 + $tusers_array = array();
627 + if(!empty($task_data['users'])){
628 + $task_users_array = explode(",",(string)$task_assign_users);
629 + }
630 + if(!empty($project_data['users'])){
631 + $project_users = explode(",",(string)$project_data['users']);
632 + }
633 + if(!empty($project_users)){
634 + if(!empty($task_users_array)){
635 + foreach($task_users_array as $tuser){
636 + if(!in_array($tuser,$project_users)){
637 + $wpdb->delete( $wpdb->prefix.'wppm_project_users', array( 'proj_id' => "$proj_id",'user_id'=>"$tuser") );
638 + }
639 + elseif(in_array($tuser,$project_users)){
640 + $tusers_array[] = $tuser;
641 + $tuser = absint($tuser);
642 + $sql = $wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $old_proj, $tuser);
643 + $old_proj_user_role = $wpdb->get_var( $sql );
644 + $sql = $wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $proj_id, $tuser);
645 + $proj_users_role = $wpdb->get_var( $sql );
646 + if(!empty( $old_proj_user_role) && $old_proj_user_role!=$proj_users_role){
647 + $value=array(
648 + 'role_id'=>absint($proj_users_role)
649 + );
650 + $wpdb->update($wpdb->prefix.'wppm_project_users', $value, array('proj_id'=>"$proj_id", 'user_id'=>"$tuser"));
651 + }
652 + }
653 + }
654 + }
655 + }
656 + $tusers = implode(",",$tusers_array);
657 + $values=array(
658 + 'project'=>absint($proj_id),
659 + 'users'=>absint($tusers)
660 + );
661 + $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
662 + }
663 +
342 664 public function get_task_comment($comment_id){
343 665 global $wpdb;
344 666 $task_comment_data = array();
345 - $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE id=$comment_id ");
667 + $comment_id = absint($comment_id);
668 + $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE id=%d", $comment_id));
346 669 if( $task_comment ){
347 - $task_comment_data = json_decode(json_encode($task_comment), true);
670 + $task_comment_data = json_decode(wp_json_encode($task_comment), true);
348 671 }
349 672 return $task_comment_data;
350 673 }
351 674
675 + public function get_proj_comment($comment_id){
676 + global $wpdb;
677 + $project_comment_data = array();
678 + $comment_id = absint($comment_id);
679 + $project_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE id=%d", $comment_id));
680 + if( $project_comment ){
681 + $project_comment_data = json_decode(wp_json_encode($project_comment), true);
682 + }
683 + return $project_comment_data;
684 + }
685 +
352 686 public function change_task_comment($comment_id,$comment_body){
353 687 global $wpdb;
688 + $comment_id = absint($comment_id);
689 + $comment_body = !empty($comment_body) ? wp_kses_post($comment_body) : '';
354 690 $values=array(
355 691 'body'=>$comment_body
356 692 );
357 - $wpdb->update($wpdb->prefix.'wppm_task_comment', $values, array('id'=>$comment_id));
693 + $wpdb->update($wpdb->prefix.'wppm_task_comment', $values, array('id'=>"$comment_id"));
358 694 }
695 +
696 + public function change_proj_comment($comment_id,$comment_body){
697 + global $wpdb;
698 + $comment_id = absint($comment_id);
699 + $comment_body = !empty($comment_body) ? wp_kses_post($comment_body) : '';
700 + $values=array(
701 + 'body'=>$comment_body
702 + );
703 + $wpdb->update($wpdb->prefix.'wppm_project_comment', $values, array('id'=>"$comment_id"));
704 + }
705 +
359 706 public function change_project_label($project_id,$project_label){
360 707 global $wpdb;
708 + $project_id = absint($project_id);
361 709 $values=array(
362 - 'project_name'=>$project_label
710 + 'project_name'=>esc_sql($project_label)
363 711 );
364 - $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
712 + $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
365 713 }
366 714
367 715 public function change_project_start_date($project_id, $project_start_date){
368 716 global $wpdb;
717 + $project_id = absint($project_id);
718 + $project_start_date = esc_sql($project_start_date);
369 719 $values=array(
370 720 'start_date'=>$project_start_date
371 721 );
372 - $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
722 + $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
373 723 }
374 724
375 725 public function change_project_end_date($project_id, $project_end_date){
376 726 global $wpdb;
727 + $project_id = absint($project_id);
728 + $project_end_date = esc_sql($project_end_date);
377 729 $values=array(
378 730 'end_date'=>$project_end_date
379 731 );
380 732 $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
@@ -381,34 +733,48 @@
381 733 }
382 734
383 735 public function change_category($project_id, $project_category){
384 736 global $wpdb;
737 + $project_id = absint($project_id);
738 + $project_category = absint($project_category);
385 739 $values=array(
386 740 'cat_id'=>$project_category
387 741 );
388 - $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
742 + $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
389 743 }
390 744
391 745 public function change_project_description($project_id, $project_description){
392 746 global $wpdb;
393 - $values=array(
394 - 'description'=>$project_description
747 + $project_id = absint($project_id);
748 + $project_description = (string) ( $project_description ?? '' );
749 + $values = array(
750 + 'description' => wp_kses_post( $project_description )
395 751 );
396 - $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
752 + $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
397 753 }
398 754
399 755 public function change_project_status($project_id,$status_id){
400 - global $wpdb,$wppmfunction;
756 + global $wpdb,$wppmfunction,$current_user;
757 + $change_status_value= array();
401 758 $proj_data = $wppmfunction->get_project($project_id);
402 759 $prev_status = $proj_data['status'];
760 + $cu_id = absint($current_user->ID);
403 761 $values=array(
404 - 'status'=>$status_id
762 + 'status'=>absint($status_id)
405 763 );
764 + $project_id = absint($project_id);
406 765 $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
407 766 $old_project_status_meta = $wppmfunction->get_project_meta($project_id,'old_project_status',true);
408 767 if(!empty($old_project_status_meta)){
409 768 $wppmfunction->delete_project_meta($project_id,'old_project_status');
410 769 }
770 + $change_status_value = array('prev_status'=>"$prev_status",'new_status'=>"$status_id");
771 + $change_status_obj = serialize($change_status_value);
772 + $log_values = array('proj_id'=>"$project_id",'body'=>$change_status_obj,'attachment_ids'=>"",'create_time'=>wp_date("Y-m-d h:i:sa"),'created_by'=>"$cu_id" );
773 + $wpdb->insert($wpdb->prefix . 'wppm_project_comment',$log_values);
774 + $log_id = absint($wpdb->insert_id);
775 + $proj_log_values = array('proj_id'=>"$project_id",'comment_id'=>"$log_id",'comment_type'=>'change_proj_status');
776 + $wpdb->insert($wpdb->prefix . 'wppm_project_comment_meta',$proj_log_values);
411 777 $wppmfunction->add_project_meta($project_id,'old_project_status',$prev_status);
412 778 do_action('wppm_set_change_project_status', $project_id, $status_id, $prev_status);
413 779 }
414 780
@@ -414,23 +780,24 @@
414 780
415 781 public function change_project_raised_by($project_id, $user_id){
416 782 global $wpdb;
417 783 $values=array(
418 - 'created_by'=>$user_id
784 + 'created_by'=>absint($user_id)
419 785 );
420 - $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
786 + $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
421 787 }
422 788
423 789 // Email Notification types
424 790 public function get_email_notification_types(){
425 791 $notification_types = array(
426 - 'new_project'=>__('New Project','taskbuilder'),
427 - 'new_task'=>__('New Task','taskbuilder'),
428 - 'change_project_status' => __('Change Project Status','taskbuilder'),
429 - 'change_task_status' => __('Change Task Status','taskbuilder'),
430 - 'change_project_assign_users' => __('Change Project Assign Users','taskbuilder'),
431 - 'change_task_assign_users' => __('Change Task Assign Users','taskbuilder'),
432 - 'new_discussion' => __('New Comment','taskbuilder'),
792 + 'new_project'=>esc_html__('New Project','taskbuilder'),
793 + 'new_task'=>esc_html__('New Task','taskbuilder'),
794 + 'change_project_status' => esc_html__('Change Project Status','taskbuilder'),
795 + 'change_task_status' => esc_html__('Change Task Status','taskbuilder'),
796 + 'change_project_assign_users' => esc_html__('Change Project Assign Users','taskbuilder'),
797 + 'change_task_assign_users' => esc_html__('Change Task Assign Users','taskbuilder'),
798 + 'new_discussion' => esc_html__('New Comment','taskbuilder'),
799 + 'new_proj_discussion' =>esc_html__('New Project Comment','taskbuilder')
433 800 );
434 801 return apply_filters('wppm_en_types',$notification_types);
435 802 }
436 803
@@ -447,9 +814,9 @@
447 814 global $wpdb;
448 815 $wpdb->insert(
449 816 $wpdb->prefix . 'wppm_project_meta',
450 817 array(
451 - 'project_id' => $proj_id,
818 + 'project_id' =>$proj_id,
452 819 'meta_key' => $meta_key,
453 820 'meta_value' =>$meta_value
454 821 ));
455 822 }
@@ -466,15 +833,17 @@
466 833 }
467 834
468 835 public function get_project_meta($project_id,$meta_key,$flag = false){
469 836 global $wpdb,$wppmfunction;
837 + $project_id = absint($project_id);
838 + $meta_key = esc_sql($meta_key);
470 839 if($flag){
471 - $get_meta = $wpdb->get_var("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = '$meta_key' ");
472 - $project_meta = stripslashes($get_meta) ? stripslashes($get_meta) : '';
840 + $get_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
841 + $project_meta = isset($get_meta) ? stripslashes($get_meta) : '';
473 842
474 843 } else {
475 844 $project_meta = array();
476 - $results = $wpdb->get_results("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = '$meta_key'");
845 + $results = $wpdb->get_results($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
477 846 if( (!empty($results)) ){
478 847 foreach ($results as $result) {
479 848 if(!empty($result)){
480 849 $project_meta[]= stripslashes($result->meta_value);
@@ -486,15 +855,17 @@
486 855 }
487 856
488 857 public function get_task_meta($task_id,$meta_key,$flag = false){
489 858 global $wpdb,$wppmfunction;
859 + $task_id = absint($task_id);
860 + $meta_key = esc_sql($meta_key);
490 861 if($flag){
491 - $get_meta = $wpdb->get_var("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = '$meta_key' ");
492 - $task_meta = stripslashes($get_meta) ? stripslashes($get_meta) : '';
862 + $get_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
863 + $task_meta = isset($get_meta) ? stripslashes($get_meta) : '';
493 864
494 865 } else {
495 866 $task_meta = array();
496 - $results = $wpdb->get_results("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = '$meta_key'");
867 + $results = $wpdb->get_results($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
497 868 if( (!empty($results)) ){
498 869 foreach ($results as $result) {
499 870 if(!empty($result)){
500 871 $task_meta[]= stripslashes($result->meta_value);
@@ -518,8 +889,28 @@
518 889 }
519 890 return apply_filters( 'wppm_get_prev_assigned_users_emails', $user_emails ,$project_id);
520 891 }
521 892
893 + public function get_project_creator_email($project_id){
894 + global $wpdb,$wppmfunction;
895 + $project_data = $wppmfunction->get_project($project_id,'created_by');
896 + $userdata = get_userdata($project_data['created_by']);
897 + if(!empty( $userdata)){
898 + $proj_creator_email[] = $userdata->user_email;
899 + }
900 + return apply_filters( 'wppm_get_project_creator_email', $proj_creator_email ,$project_id);
901 + }
902 +
903 + public function get_task_creator_email($task_id){
904 + global $wpdb,$wppmfunction;
905 + $task_data = $wppmfunction->get_task($task_id,'created_by');
906 + $userdata = get_userdata($task_data['created_by']);
907 + if(!empty( $userdata)){
908 + $task_creator_email[] = $userdata->user_email;
909 + }
910 + return apply_filters( 'wppm_get_task_creator_email', $task_creator_email ,$task_id);
911 + }
912 +
522 913 public function get_previously_assigned_task_users($task_id){
523 914 global $wpdb,$wppmfunction;
524 915 $prev_assigned_task_users = $wppmfunction->get_task_meta($task_id,'prev_assigned_task_users');
525 916 $user_emails = array();
@@ -524,10 +915,12 @@
524 915 $prev_assigned_task_users = $wppmfunction->get_task_meta($task_id,'prev_assigned_task_users');
525 916 $user_emails = array();
526 917 if(!empty($prev_assigned_task_users)){
527 918 foreach ($prev_assigned_task_users as $user) {
528 - $userdata = get_userdata($user);
529 - $user_emails[] = $userdata->user_email;
919 + if(!empty($user)){
920 + $userdata = get_userdata($user);
921 + $user_emails[] = $userdata->user_email;
922 + }
530 923 }
531 924 }
532 925 return apply_filters( 'wppm_get_prev_assigned_task_users_emails', $user_emails ,$task_id);
533 926 }
@@ -535,10 +928,12 @@
535 928 * Update project meta for project
536 929 */
537 930 function update_project_meta($project_id ,$meta_key ,$meta_value){
538 931 global $wpdb;
539 - $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = $meta_key");
540 - $wpdb->update($wpdb->prefix.'wppm_project_meta', $meta_value, array('project_id'=>$project_id,'meta_key' => $meta_key));
932 + $project_id = absint($project_id);
933 + $meta_key = esc_sql($meta_key);
934 + $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
935 + $wpdb->update($wpdb->prefix.'wppm_project_meta', $meta_value, array('project_id'=>$project_id,'meta_key' => "$meta_key"));
541 936 }
542 937
543 938 /**
544 939 * Update task meta for task
@@ -544,20 +939,26 @@
544 939 * Update task meta for task
545 940 */
546 941 function update_task_meta($task_id ,$meta_key ,$meta_value){
547 942 global $wpdb;
548 - $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = $meta_key");
549 - $wpdb->update($wpdb->prefix.'wppm_task_meta', $meta_value, array('task_id'=>$task_id,'meta_key' => $meta_key));
943 + $task_id = absint($task_id);
944 + $meta_key = esc_sql($meta_key);
945 + $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
946 + $wpdb->update($wpdb->prefix.'wppm_task_meta', $meta_value, array('task_id'=>$task_id,'meta_key' => "$meta_key"));
550 947 }
551 948
552 949 function delete_project_meta($project_id ,$meta_key){
553 950 global $wpdb;
554 - $wpdb->delete( $wpdb->prefix.'wppm_project_meta', array( 'project_id' => $project_id,'meta_key'=>$meta_key) );
951 + $project_id = absint($project_id);
952 + $meta_key = ($meta_key);
953 + $wpdb->delete( $wpdb->prefix.'wppm_project_meta', array( 'project_id' => "$project_id",'meta_key'=>"$meta_key") );
555 954 }
556 955
557 956 function delete_task_meta($task_id ,$meta_key){
558 957 global $wpdb;
559 - $wpdb->delete( $wpdb->prefix.'wppm_task_meta', array( 'task_id' => $task_id,'meta_key'=>$meta_key) );
958 + $task_id = absint($task_id);
959 + $meta_key = ($meta_key);
960 + $wpdb->delete( $wpdb->prefix.'wppm_task_meta', array( 'task_id' => "$task_id",'meta_key'=>"$meta_key") );
560 961 }
561 962
562 963 public function replace_macro($str,$project_id){
563 964 include WPPM_ABSPATH . 'includes/replace_macro.php';
@@ -571,15 +972,17 @@
571 972
572 973 public function get_old_project_status_name($id){
573 974 global $wppmfunction, $wpdb;
574 975 $old_project_status = $wppmfunction->get_project_meta($id,'old_project_status',true);
575 - $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id ='$old_project_status'");
976 + $old_project_status = absint($old_project_status);
977 + $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id = %d",$old_project_status));
576 978 return $status_name;
577 979 }
578 980
579 981 public function get_new_project_status_name($status_id){
580 982 global $wpdb;
581 - $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id ='$status_id'");
983 + $status_id = absint($status_id);
984 + $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id = %d",$status_id));
582 985 return $status_name;
583 986 }
584 987
585 988 public function get_old_task_status_name($task_id){
@@ -584,21 +987,28 @@
584 987
585 988 public function get_old_task_status_name($task_id){
586 989 global $wppmfunction, $wpdb;
587 990 $old_task_status = $wppmfunction->get_task_meta($task_id,'old_task_status',true);
588 - $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id ='$old_task_status'");
991 + $old_task_status = absint($old_task_status);
992 + $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id = %d",$old_task_status));
589 993 return $status_name;
590 994 }
591 995
592 996 public function get_new_task_status_name($status_id){
593 997 global $wpdb;
594 - $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id ='$status_id'");
998 + $status_id = absint($status_id);
999 + $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id = %d",$status_id));
595 1000 return $status_name;
596 1001 }
597 1002
598 1003 public function get_project_category_name($cat_id){
599 1004 global $wpdb;
600 - $cat_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_categories WHERE id ='$cat_id'");
1005 + $cat_id = absint($cat_id);
1006 + if(!empty($cat_id)){
1007 + $cat_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_categories WHERE id = %d",$cat_id));
1008 + }else{
1009 + $cat_name = "";
1010 + }
601 1011 return $cat_name;
602 1012 }
603 1013
604 1014 public function get_project_assigned_users_names($project_id){
@@ -625,9 +1035,9 @@
625 1035
626 1036 public function get_task_assigned_users_names($task_id){
627 1037 global $wppmfunction;
628 1038 $wppm_task_data = $wppmfunction->get_task($task_id);
629 - $wppm_task_assign_users_array = explode(",", $wppm_task_data['users']);
1039 + $wppm_task_assign_users_array = explode(",", (string)$wppm_task_data['users']);
630 1040 $users_names = array();
631 1041 if(!empty($wppm_task_assign_users_array)){
632 1042 foreach ($wppm_task_assign_users_array as $user_id) {
633 1043 if(!empty($user_id)){
@@ -672,15 +1082,17 @@
672 1082 }
673 1083
674 1084 public function get_task_priority_name($priority){
675 1085 global $wpdb;
676 - $priority_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_priorities WHERE id ='$priority'");
1086 + $priority = absint($priority);
1087 + $priority_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_priorities WHERE id = %d",$priority));
677 1088 return $priority_name;
678 1089 }
679 1090
680 1091 public function get_last_comment_user_name($task_id){
681 1092 global $wpdb;
682 - $task_comment_creator = $wpdb->get_var("SELECT created_by FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = $task_id)");
1093 + $task_id = absint($task_id);
1094 + $task_comment_creator = $wpdb->get_var($wpdb->prepare("SELECT created_by FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = %d)",$task_id));
683 1095 if(!empty($task_comment_creator)){
684 1096 $user = get_userdata( $task_comment_creator );
685 1097 return $user->display_name;
686 1098 }
@@ -687,12 +1099,294 @@
687 1099 }
688 1100
689 1101 public function get_last_comment_body($task_id){
690 1102 global $wpdb;
691 - $task_comment = $wpdb->get_var("SELECT body FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = $task_id)");
1103 + $task_id = absint($task_id);
1104 + $task_comment = $wpdb->get_var($wpdb->prepare("SELECT body FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = %d)",$task_id));
692 1105 return $task_comment;
693 1106 }
694 - }
1107 +
1108 + public function create_duplicate_task($ptask_id, $project_id,$internal_code_flag=false){
1109 + include WPPM_ABSPATH . 'includes/admin/tasks/open_task/wppm_set_clone_task.php';
1110 + }
695 1111
1112 + public function get_last_comment_proj_user_name($project_id){
1113 + global $wpdb;
1114 + $project_id = absint($project_id);
1115 + $proj_comment_creator = $wpdb->get_var($wpdb->prepare("SELECT created_by FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = %d)",$project_id));
1116 + if(!empty($proj_comment_creator)){
1117 + $user = get_userdata( $proj_comment_creator );
1118 + return $user->display_name;
1119 + }
1120 + }
696 1121
1122 + public function get_proj_comment_body($project_id){
1123 + global $wpdb;
1124 + $project_id = absint($project_id);
1125 + $proj_comment = $wpdb->get_var($wpdb->prepare("SELECT body FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = %d)",$project_id));
1126 + return $proj_comment;
1127 + }
1128 +
1129 + public function get_project_url($project_id, $view){
1130 + global $wpdb,$wppmfunction;
1131 + $project_id = absint($project_id);
1132 + $page_settings = get_option( 'wppm-page-settings' );
1133 + if ( $view == '0' ) {
1134 + $url = admin_url( 'admin.php?page=wppm-projects&section=project-list&id=' . $project_id );
1135 + } else {
1136 + $url = get_permalink( $page_settings['project-url-page'] );
1137 + $auth_id = $wppmfunction->get_project_meta($project_id,'project_auth_code',true);
1138 +
1139 + $url = add_query_arg(
1140 + array(
1141 + 'project-id' => $project_id,
1142 + 'auth-code' => $auth_id,
1143 +
1144 + ),
1145 + $url
1146 + );
1147 + }
1148 +
1149 + return $url;
1150 + }
1151 +
1152 + public function get_task_url($task_id, $view){
1153 + global $wpdb,$wppmfunction;
1154 + $task_id = absint($task_id);
1155 + $page_settings = get_option( 'wppm-page-settings' );
1156 + if ( $view == '0' ) {
1157 + $url = admin_url( 'admin.php?page=wppm-tasks&section=task-list&id=' . $task_id );
1158 + } else{
1159 + $url = get_permalink( $page_settings['task-url-page'] );
1160 + $auth_id = $this->wppm_get_auth_code($task_id);
1161 + $url = add_query_arg(
1162 + array(
1163 + 'task-id' => $task_id,
1164 + 'auth-code' => $auth_id,
1165 + ),
1166 + $url
1167 + );
1168 +
1169 + }
1170 +
1171 + return $url;
1172 + }
1173 +
1174 + public function wppm_user_role(){
1175 + $user_role = array(
1176 + 'wppm_admin' => array(
1177 + 'label' => esc_html__('WPPM Administrator','taskbuilder'),
1178 + ),
1179 + 'wppm_manager' => array(
1180 + 'label' => esc_html__('WPPM Manager','taskbuilder'),
1181 + )
1182 + );
1183 + return $user_role;
1184 + }
1185 +
1186 + public static function wppm_toolbar_options_setting() {
1187 + $toolbar = array(
1188 + array(
1189 + 'name' => esc_attr__( 'Bold', 'taskbuilder' ),
1190 + 'value' => 'bold',
1191 + ),
1192 + array(
1193 + 'name' => esc_attr__( 'Italic', 'taskbuilder' ),
1194 + 'value' => 'italic',
1195 + ),
1196 + array(
1197 + 'name' => esc_attr__( 'Underline', 'taskbuilder' ),
1198 + 'value' => 'underline',
1199 + ),
1200 + array(
1201 + 'name' => esc_attr__( 'Blockquote', 'taskbuilder' ),
1202 + 'value' => 'blockquote',
1203 + ),
1204 + array(
1205 + 'name' => esc_attr__( 'Align', 'taskbuilder' ),
1206 + 'value' => 'align',
1207 + ),
1208 + array(
1209 + 'name' => esc_attr__( 'Bulleted list', 'taskbuilder' ),
1210 + 'value' => 'bullist',
1211 + ),
1212 + array(
1213 + 'name' => esc_attr__( 'Numbered list', 'taskbuilder' ),
1214 + 'value' => 'numlist',
1215 + ),
1216 + array(
1217 + 'name' => esc_attr__( 'Right to left', 'taskbuilder' ),
1218 + 'value' => 'rtl',
1219 + ),
1220 + array(
1221 + 'name' => esc_attr__( 'Link', 'taskbuilder' ),
1222 + 'value' => 'link',
1223 + ),
1224 + array(
1225 + 'name' => esc_attr__( 'Image', 'taskbuilder' ),
1226 + 'value' => 'wppm_insert_editor_img',
1227 + ),
1228 + array(
1229 + 'name' => esc_attr__( 'Text Color', 'taskbuilder' ),
1230 + 'value' => 'forecolor',
1231 + ),
1232 + array(
1233 + 'name' => esc_attr__( 'Text Background Color', 'taskbuilder' ),
1234 + 'value' => 'backcolor',
1235 + ),
1236 + array(
1237 + 'name' => esc_attr__( 'Strikethrough', 'taskbuilder' ),
1238 + 'value' => 'strikethrough',
1239 + ),
1240 + );
1241 + return $toolbar;
1242 + }
1243 +
1244 + public static function wppm_load_setting_header_html() {
1245 + ?>
1246 + <div class="wppm-header" style="padding-left:20px;margin:10px 0 10px 0;display: flex; justify-content: space-between; align-items: center; position: sticky;top: 0;background: #fff !important;z-index: 9999;width:99%; left: 0; ">
1247 + <div class="wppm-header-title" style="display: flex; align-items: center; gap: 3px;">
1248 + <img src="<?php echo esc_url( WPPM_PLUGIN_URL . 'asset/images/taskbuilder_logo.png'); ?>" class="wppm-header-icon" alt="taskbuilder Icon" style="width: 33px; height: 33px;margin-right:10px !important;"/>
1249 + <h2 style="font-size: 30px; font-weight: 600; color: #333; margin: 0; font: 22px OpenSans-Light, Helvetica, Arial, sans-serif;"><?php esc_html_e( 'Taskbuilder', 'taskbuilder' )?></h2>
1250 + </div>
1251 + <div class="wppm-header-button" style="display: flex; justify-content: flex-end; gap: 3px;">
1252 + <div class="wppm-btn
1253 + " style="background-color: #0052CC; color: #fff; padding: 8px 10px;margin: 35px 0px 14px 0px;text-decoration: none;border-radius: 5px;transition: background 0.3s ease;box-shadow: 0 2px 5px rgba(0, 0, 0, 0.1);">
1254 + <img src="<?php echo esc_url( WPPM_PLUGIN_URL . 'asset/images/help.svg'); ?>" class="wppm-header-icon" alt="taskbuilder Icon" style="width: 20px; height: 19px;margin-bottom: -5px;"/>
1255 + <a href="https://taskbuilder.net/help/" target="__blank" style="color:#fff"><?php esc_html_e( 'Help', 'taskbuilder' )?></a>
1256 + </div>
1257 + <div class="wppm-btn" style="background-color: #0052CC; color: #fff; padding: 8px 10px;margin: 35px 0px 14px 0px;text-decoration: none;border-radius: 5px;transition: background 0.3s ease;box-shadow: 0 2px 5px rgba(0, 0, 0, 0.1);">
1258 + <img src="<?php echo esc_url( WPPM_PLUGIN_URL . 'asset/images/support.svg'); ?>" class="wppm-header-icon" alt="taskbuilder Icon" style="width: 15px; height: 19px;margin-bottom: -5px;"/>
1259 + <a href="https://taskbuilder.net/support/?wpsc-section=ticket-list" target="__blank" style="color:#fff"><?php esc_html_e( 'Support', 'taskbuilder' )?></a>
1260 + </div>
1261 + <div class="wppm-btn" style="background-color: #0052CC; color: #fff; padding: 8px 10px;margin: 35px 10px 14px 0px;text-decoration: none;border-radius: 5px;transition: background 0.3s ease;box-shadow: 0 2px 5px rgba(0, 0, 0, 0.1);">
1262 + <img src="<?php echo esc_url( WPPM_PLUGIN_URL . 'asset/images/pro_features.svg'); ?>" class="wppm-header-icon" alt="taskbuilder Icon" style="width: 15px; height: 19px;margin-bottom: -5px;"/>
1263 + <a href="https://taskbuilder.net/pricing/" target="__blank" style="color:#fff"><?php esc_html_e( 'Get pro', 'taskbuilder' )?></a>
1264 + </div>
1265 + </div>
1266 + </div>
1267 + <?php
1268 + }
1269 +
1270 + public function wppm_get_duration($start_date, $end_date){
1271 + if ( empty($start_date) || empty($end_date) || $start_date=='0000-00-00 00:00:00' || $end_date =='0000-00-00 00:00:00') {
1272 + return '';
1273 + }
1274 +
1275 + $start_ts = strtotime($start_date);
1276 + $end_ts = strtotime($end_date);
1277 +
1278 + if ( $end_ts <= $start_ts ) {
1279 + return '0 min';
1280 + }
1281 +
1282 + $diff = $end_ts - $start_ts;
1283 +
1284 + $days = floor($diff / 86400);
1285 + $hours = floor(($diff % 86400) / 3600);
1286 + $minutes = floor(($diff % 3600) / 60);
1287 +
1288 + $duration = [];
1289 +
1290 + if ($days > 0) $duration[] = $days . 'd';
1291 + if ($hours > 0) $duration[] = $hours . 'h';
1292 + if ($minutes > 0 || empty($duration)) $duration[] = $minutes . 'm';
1293 +
1294 + return implode(' ', $duration);
1295 +
1296 + }
1297 +
1298 + public function wppm_highlight_user_mentions($content, $current_user_id) {
1299 +
1300 + return preg_replace_callback(
1301 + '/<span[^>]*class="wppm-mention"[^>]*data-user-id="(\d+)"[^>]*>(.*?)<\/span>/is',
1302 + function($matches) use ($current_user_id) {
1303 +
1304 + $user_id = intval($matches[1]);
1305 + $text = $matches[2];
1306 +
1307 + // already processed → skip
1308 + if (strpos($matches[0], 'wppm-mention-me') !== false) {
1309 + return $matches[0];
1310 + }
1311 +
1312 + if ($user_id === $current_user_id) {
1313 + return '<span class="wppm-mention wppm-mention-me" data-user-id="' . esc_attr($user_id) . '">' . $text . '</span>';
1314 + }
1315 +
1316 + return '<span class="wppm-mention" data-user-id="' . esc_attr($user_id) . '">' . $text . '</span>';
1317 + },
1318 + $content
1319 + );
1320 + }
1321 + function wppm_clean_mentions_html($content) {
1322 + // Remove dropdown items
1323 + $content = preg_replace('/<div[^>]*class="mention-item"[^>]*>.*?<\/div>/is', '', $content);
1324 +
1325 + // Remove mention dropdown container
1326 + $content = preg_replace('/<div[^>]*id="wppm_mention_list"[^>]*>.*?<\/div>/is', '', $content);
1327 +
1328 + return $content;
1329 + }
1330 +
1331 + function wppm_extract_mentions($comment) {
1332 + preg_match_all('/data-user-id="(\d+)"/', $comment, $matches);
1333 + return $matches[1];
1334 + }
1335 +
1336 + function wppm_get_users_from_mentions($user_ids) {
1337 + $users = [];
1338 + foreach ($user_ids as $user_id) {
1339 + $user = get_user_by('id', intval($user_id));
1340 + if ($user) {
1341 + $users[] = $user;
1342 + }
1343 + }
1344 + return $users;
1345 + }
1346 +
1347 + function wppm_send_mention_email($email_addresses, $comment, $task_id) {
1348 + $page_setting = get_option('wppm-page-settings');
1349 + $from_name = get_option('wppm_en_from_name');
1350 + $from_email = get_option('wppm_en_from_email');
1351 + $view = $page_setting['task-url-page'];
1352 + $subject = esc_html__("You were mentioned in a comment", "taskbuilder");
1353 + $to = isset($email_addresses[0]) ? $email_addresses[0] : '';
1354 + if (!$to) {
1355 + return;
1356 + }
1357 + unset($email_addresses[0]);
1358 + $headers = "From: {$from_name} <{$from_email}>\r\n";
1359 + foreach ($email_addresses as $email_address) {
1360 + $headers .= "BCC: {$email_address}\r\n";
1361 + }
1362 + $headers .= "Content-Type: text/html; charset=UTF-8\r\n";
1363 + $task_url = $this->get_task_url($task_id, $view);
1364 + $message = esc_html__("Hello,", "taskbuilder");
1365 + $message .= "<br><br>";
1366 + $message .= esc_html__("You were mentioned in a comment:", "taskbuilder");
1367 + $message .= "<br><br>";
1368 + $message .= nl2br(esc_html(strip_tags($comment)));
1369 + $message .= "<br><br>";
1370 + $message .= esc_html__("View Task:", "taskbuilder") . " ";
1371 + $message .= '<a class="wppm_link" href="' . esc_url($task_url) . '" target="_blank">' . esc_html__("View Task", "taskbuilder") . '</a>';
1372 + wp_mail($to, $subject, $message, $headers);
1373 + do_action('wppm_after_sent_mention_mail', $email_addresses, $comment, $task_id);
1374 + }
1375 +
1376 + function wppm_insert_notification($user_id, $message, $link,$is_read,$type) {
1377 + global $wpdb;
1378 + $wpdb->insert(
1379 + $wpdb->prefix . 'wppm_notifications',
1380 + [
1381 + 'user_id' => $user_id,
1382 + 'message' => $message,
1383 + 'link' => $link,
1384 + 'is_read' => $is_read,
1385 + 'notification_type'=>$type,
1386 + 'created_at' => current_time('mysql')
1387 + ]
1388 + );
1389 + }
1390 + }
697 1391 endif;
698 1392 $GLOBALS['wppmfunction'] = new WPPM_Functions();