← All changes
|
includes/admin/projects/open_project/wppm_get_project_tasks.php
+31
-28
5.0.0
→
6.0.6
View file →
| @@ -2,23 +2,26 @@ | ||
| 2 | 2 | if ( ! defined( 'ABSPATH' ) ) { |
| 3 | 3 | exit; // Exit if accessed directly |
| 4 | 4 | } |
| 5 | 5 | global $current_user,$wpdb,$wppmfunction; |
| 6 | -$project_id = isset($_POST['id']) ? intval(sanitize_text_field($_POST['id'])) : 0 ; | |
| 7 | -$project_id = esc_sql($project_id); | |
| 8 | -$cu_id = esc_sql($current_user->ID); | |
| 6 | +$project_id = isset($_POST['id']) ? intval(sanitize_text_field(wp_unslash($_POST['id']))) : 0 ; | |
| 7 | +$project_id = (int)($project_id); | |
| 8 | +$cu_id = (int)($current_user->ID); | |
| 9 | 9 | $appearance_settings = get_option("wppm-ap-task-list"); |
| 10 | 10 | $wppm_task_time = get_option('wppm_task_time'); |
| 11 | 11 | $wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true ); |
| 12 | 12 | if($current_user->has_cap('manage_options') || $wppm_current_user_capability=='wppm_admin'){ |
| 13 | - $query = ( "SELECT * FROM {$wpdb->prefix}wppm_task where project='$project_id'"); | |
| 13 | + $query = $wpdb->prepare( | |
| 14 | + "SELECT * FROM {$wpdb->prefix}wppm_task WHERE project = %d AND (parent_task_id = 0 OR parent_task_id IS NULL)", | |
| 15 | + $project_id | |
| 16 | + ); | |
| 14 | 17 | } else{ |
| 15 | -$query = ( "SELECT Task.* | |
| 16 | - FROM {$wpdb->prefix}wppm_task AS Task | |
| 17 | - Left join {$wpdb->prefix}wppm_project proj ON Task.project = proj.id | |
| 18 | - Left join {$wpdb->prefix}wppm_project_users proj_users ON Task.project = proj_users.proj_id | |
| 19 | - Left join {$wpdb->prefix}wppm_project_meta proj_meta ON Task.project = proj_meta.project_id | |
| 20 | - where Task.project = '$project_id' AND ((FIND_IN_SET('$cu_id',Task.users)>0) OR (Task.created_by= '$cu_id') OR (proj_users.user_id = '$cu_id' AND proj_users.role_id = 1 AND (FIND_IN_SET('$cu_id',proj.users)>0)) OR (Task.project = proj_meta.project_id AND proj_meta.meta_key='public_project' AND proj_meta.meta_value=1) OR (Task.project = proj.id AND proj.created_by='$cu_id')) Group by Task.id"); | |
| 18 | + $query = $wpdb->prepare( "SELECT Task.* FROM {$wpdb->prefix}wppm_task AS Task | |
| 19 | + LEFT JOIN {$wpdb->prefix}wppm_project proj ON Task.project = proj.id | |
| 20 | + LEFT JOIN {$wpdb->prefix}wppm_project_users proj_users ON Task.project = proj_users.proj_id | |
| 21 | + LEFT JOIN {$wpdb->prefix}wppm_project_meta proj_meta ON Task.project = proj_meta.project_id | |
| 22 | + WHERE Task.project = %d AND (Task.parent_task_id = 0 OR Task.parent_task_id IS NULL) AND (FIND_IN_SET(%d, Task.users) > 0 OR Task.created_by = %d OR ( proj_users.user_id = %d AND proj_users.role_id = 1 AND FIND_IN_SET(%d, proj.users) > 0 ) OR ( proj_meta.meta_key = 'public_project' AND proj_meta.meta_value = 1 ) OR proj.created_by = %d ) GROUP BY Task.id", | |
| 23 | + $project_id,$cu_id, $cu_id,$cu_id,$cu_id, $cu_id ); | |
| 21 | 24 | } |
| 22 | 25 | $query = apply_filters('wppm_get_project_tasks_query',$query,$project_id); |
| 23 | 26 | $tasks = $wpdb->get_results($query); |
| 24 | 27 | ob_start(); |
| @@ -40,21 +43,18 @@ | ||
| 40 | 43 | <tbody> |
| 41 | 44 | <?php |
| 42 | 45 | if(!empty($tasks)){ |
| 43 | 46 | foreach ($tasks as $task) { |
| 44 | - $tstatus = esc_sql($task->status); | |
| 45 | - $status = $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}wppm_task_statuses where id = '$tstatus'" ); | |
| 47 | + $status = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}wppm_task_statuses WHERE id = %d", (int) $task->status ) ); | |
| 46 | 48 | $users = array(); |
| 47 | 49 | if($task->users != null){ |
| 48 | 50 | $users = explode(",",$task->users); |
| 49 | 51 | } |
| 50 | 52 | if(!empty($task->priority)){ |
| 51 | - $tpriority = esc_sql($task->priority); | |
| 52 | - $priority = $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}wppm_task_priorities where id = '$tpriority'" ); | |
| 53 | + $priority = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}wppm_task_priorities WHERE id = %d", (int) $task->priority)); | |
| 53 | 54 | } |
| 54 | 55 | if(!empty($task->project)){ |
| 55 | - $tproject = esc_sql($task->project); | |
| 56 | - $project = $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}wppm_project where id = '$tproject'" ); | |
| 56 | + $project = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}wppm_project WHERE id = %d",(int) $task->project)); | |
| 57 | 57 | } |
| 58 | 58 | if($wppm_task_time == 1){ |
| 59 | 59 | $task_start_date = $task->start_date; |
| 60 | 60 | $task_end_date = $task->end_date; |
| @@ -66,18 +66,18 @@ | ||
| 66 | 66 | } |
| 67 | 67 | ?> |
| 68 | 68 | <tr onclick= "wppm_open_project_tasks(<?php echo esc_attr($task->id) ?>,<?php echo esc_attr($task->project) ?>)" > |
| 69 | 69 | <td> |
| 70 | - <?php echo esc_html_e($task->id,'taskbuilder') ?> | |
| 70 | + <?php echo esc_html($task->id); ?> | |
| 71 | 71 | </td> |
| 72 | 72 | <td> |
| 73 | - <?php echo esc_html_e($task->task_name,'taskbuilder') ?> | |
| 73 | + <?php echo esc_html($task->task_name); ?> | |
| 74 | 74 | </td> |
| 75 | 75 | <td> |
| 76 | - <span class="wppm_td_task_status" style="background-color:<?php echo (isset($status->bg_color))? esc_attr($status->bg_color):"";?>; color: <?php echo (isset($status->color))? esc_attr($status->color):""; ?>"><?php echo (isset($status->name))? esc_html_e($status->name,'taskbuilder'):"" ?></span> | |
| 76 | + <span class="wppm_td_task_status" style="background-color:<?php echo (isset($status->bg_color))? esc_attr($status->bg_color):"";?>; color: <?php echo (isset($status->color))? esc_attr($status->color):""; ?>"><?php echo (isset($status->name))? esc_html($status->name):"" ?></span> | |
| 77 | 77 | </td> |
| 78 | 78 | <td> |
| 79 | - <span class ="wppm_td_task_priority" style="background-color:<?php echo (isset($priority->bg_color))? esc_attr($priority->bg_color):"";?>; color: <?php echo (isset($priority->color))? esc_attr($priority->color):""; ?>"><?php echo (isset($priority->name))? esc_html_e($priority->name,'taskbuilder'):"" ?></span> | |
| 79 | + <span class ="wppm_td_task_priority" style="background-color:<?php echo (isset($priority->bg_color))? esc_attr($priority->bg_color):"";?>; color: <?php echo (isset($priority->color))? esc_attr($priority->color):""; ?>"><?php echo (isset($priority->name))? esc_html($priority->name):"" ?></span> | |
| 80 | 80 | </td> |
| 81 | 81 | <td> |
| 82 | 82 | <?php |
| 83 | 83 | $i=0; |
| @@ -84,16 +84,19 @@ | ||
| 84 | 84 | if(!empty($users)){ |
| 85 | 85 | foreach($users as $user){ |
| 86 | 86 | $i++; |
| 87 | 87 | if( $i <= 4 ){ |
| 88 | - $userdata = get_userdata( $user ); ?> | |
| 89 | - <a href="#" title="<?php echo esc_attr($userdata->display_name) ?>"> | |
| 90 | - <?php echo (get_avatar($userdata->ID, 25, "mysteryman"))?> | |
| 91 | - </a> <?php | |
| 88 | + $userdata = get_userdata( $user ); | |
| 89 | + if($userdata){ | |
| 90 | + ?> | |
| 91 | + <a href="#" title="<?php echo esc_attr($userdata->display_name) ?>"> | |
| 92 | + <?php echo (get_avatar($userdata->ID, 25, "mysteryman"))?> | |
| 93 | + </a> <?php | |
| 94 | + } | |
| 92 | 95 | } |
| 93 | 96 | } |
| 94 | 97 | } else { |
| 95 | - _e('None','taskbuilder'); | |
| 98 | + esc_html_e('None','taskbuilder'); | |
| 96 | 99 | } |
| 97 | 100 | if($i > 4){ |
| 98 | 101 | ?> |
| 99 | 102 | <a href="#" class="wppm_avatar"> |
| @@ -101,12 +104,12 @@ | ||
| 101 | 104 | </a> |
| 102 | 105 | <?php } ?> |
| 103 | 106 | </td> |
| 104 | 107 | <td> |
| 105 | - <?php echo (isset($task_start_date))? esc_html_e($task_start_date,'taskbuilder'):""?> | |
| 108 | + <?php echo (isset($task_start_date))? esc_html($task_start_date):""?> | |
| 106 | 109 | </td> |
| 107 | 110 | <td> |
| 108 | - <?php echo (isset($task_end_date))? esc_html_e($task_end_date,'taskbuilder'):""?> | |
| 111 | + <?php echo (isset($task_end_date))? esc_html($task_end_date):""?> | |
| 109 | 112 | </td> |
| 110 | 113 | </tr> |
| 111 | 114 | <?php } |
| 112 | 115 | } |
| @@ -156,5 +159,5 @@ | ||
| 156 | 159 | 'body' => $body, |
| 157 | 160 | 'footer' => $footer |
| 158 | 161 | ); |
| 159 | 162 | |
| 160 | -echo json_encode($response); | |
| 163 | +echo wp_json_encode($response); | |