← All changes | includes/class-wppm-functions.php +410 -150 5.0.0 → 6.0.6 View file →

		@@ -11,9 +11,9 @@
11	11	if ( is_array( $value ) ) {
12	12	$value = $this->sanitize_array($value);
13	13	}
14	14	else {
15		- $value = sanitize_text_field( $value );
	15	+ $value = sanitize_text_field( wp_unslash( $value ) );
16	16	}
17	17	}
18	18	}
19	19	return $array;
		@@ -30,9 +30,11 @@
30	30	'end_date'=>isset($args['wppm_end_date'])? $args['wppm_end_date']:"",
31	31	'status'=>isset($args['status'])? $args['status']:$default_proj_status,
32	32	'cat_id'=>isset($args['wppm_create_project_category']) ? $args['wppm_create_project_category']:"",
33	33	'users'=>isset($args['user_names']) ? implode(",",$args['user_names']):"",
34		- 'date_created'=>isset($args['date_created'])? $args['date_created']:date("Y-m-d h:i:sa"),
	34	+ 'date_created'=>isset($args['date_created'])? $args['date_created']:wp_date("Y-m-d h:i:sa"),
	35	+ 'project_auth_code'=> self::getRandomString(10)
	36	+
35	37	);
36	38	$wpdb->insert($wpdb->prefix .'wppm_project', $values);
37	39	$project_id = $wpdb->insert_id;
38	40	return $project_id;
		@@ -38,9 +40,9 @@
38	40	return $project_id;
39	41	}
40	42
41	43	public static function create_task($args){
42		- global $wpdb,$current_user,$wppmfunction;
	44	+ global $wpdb,$current_user;
43	45	$default_task_status = get_option('wppm_default_task_status');
44	46	$values = array(
45	47	'created_by'=>(isset($args['created_by'])) ? $args['created_by']: $current_user->ID,
46	48	'task_name'=>$args['name'],
		@@ -50,11 +52,12 @@
50	52	'end_date'=>(isset($args['wppm_task_end_date']))?$args['wppm_task_end_date']:"",
51	53	'status'=>(isset($args['status']))?$args['status']:$default_task_status,
52	54	'priority'=>(isset($args['wppm_create_task_priority']))?$args['wppm_create_task_priority']:"",
53	55	'users'=>(!empty($args['user_names']))?implode(",",$args['user_names']):"",
54		- 'date_created'=>isset($args['date_created'])? $args['date_created']:date("Y-m-d h:i:sa"),
55		- 'task_auth_code'=> $wppmfunction->getRandomString(10),
56		- 'active'=>1
	56	+ 'date_created'=>isset($args['date_created'])? $args['date_created']:wp_date("Y-m-d h:i:sa"),
	57	+ 'task_auth_code'=> self::getRandomString(10),
	58	+ 'active'=>1,
	59	+ 'parent_task_id'=>(isset($args['parent_task_id']))?absint($args['parent_task_id']):0
57	60	);
58	61	$wpdb->insert($wpdb->prefix .'wppm_task', $values);
59	62	$task_id = $wpdb->insert_id;
60	63	return $task_id;
		@@ -118,9 +121,9 @@
118	121	public static function getRandomString($length = 8) {
119	122	$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
120	123	$string = '';
121	124	for ($i = 0; $i < $length; $i++) {
122		- $string .= $characters[mt_rand(0, strlen($characters) - 1)];
	125	+ $string .= $characters[wp_rand(0, strlen($characters) - 1)];
123	126	}
124	127	return $string;
125	128	}
126	129
		@@ -125,20 +128,61 @@
125	128	}
126	129
127	130	public static function wppm_get_auth_code($id){
128	131	global $wpdb;
129		- $id = esc_sql($id);
130		- $auth_code = $wpdb->get_var( "SELECT task_auth_code FROM {$wpdb->prefix}wppm_task where id='$id'" );
	132	+ $id = absint($id);
	133	+ $auth_code = $wpdb->get_var(
	134	+ $wpdb->prepare(
	135	+ "SELECT task_auth_code
	136	+ FROM {$wpdb->prefix}wppm_task
	137	+ WHERE id = %d",
	138	+ ($id)
	139	+ )
	140	+ );
131	141	$auth_code = isset($auth_code) ? $auth_code : "";
132	142	return $auth_code;
133	143	}
134	144
	145	+ public static function wppm_get_proj_auth_code($id){
	146	+ global $wpdb;
	147	+ $id = absint($id);
	148	+ $auth_code = $wpdb->get_var(
	149	+ $wpdb->prepare(
	150	+ "SELECT project_auth_code
	151	+ FROM {$wpdb->prefix}wppm_project
	152	+ WHERE id = %d",
	153	+ ($id)
	154	+ )
	155	+ );
	156	+ $auth_code = isset($auth_code) ? $auth_code : "";
	157	+ return $auth_code;
	158	+ }
	159	+
135	160	public static function get_task_fields($task_id,$select_field){
136	161	global $wpdb;
137		- $task_id = esc_sql($task_id);
	162	+ $task_id = absint($task_id);
138	163	$task_field_value = '';
	164	+ $allowed_fields = array(
	165	+ 'id',
	166	+ 'created_by',
	167	+ 'task_name',
	168	+ 'description',
	169	+ 'project',
	170	+ 'start_date',
	171	+ 'end_date',
	172	+ 'status',
	173	+ 'priority',
	174	+ 'users',
	175	+ 'date_created',
	176	+ 'task_auth_code'
	177	+ );
	178	+
	179	+ // Validate column name
	180	+ if ( ! in_array( $select_field, $allowed_fields, true ) ) {
	181	+ return '';
	182	+ }
139	183	if (apply_filters('wppm_get_select_field',true,$task_id,$select_field)) {
140		- $get_task_field_value = $wpdb->get_var(" SELECT $select_field FROM {$wpdb->prefix}wppm_task WHERE id='$task_id' ");
	184	+ $get_task_field_value = $wpdb->get_var($wpdb->prepare("SELECT $select_field FROM {$wpdb->prefix}wppm_task WHERE id = %d", $task_id));
141	185	$task_field_value = $get_task_field_value ? $get_task_field_value : '';
142	186	}
143	187	return stripslashes($task_field_value);
144	188	}
		@@ -144,12 +188,30 @@
144	188	}
145	189
146	190	public static function get_project_fields($proj_id,$select_field){
147	191	global $wpdb;
148		- $proj_id = esc_sql($proj_id);
	192	+ $proj_id = absint($proj_id);
149	193	$project_field_value = '';
	194	+ $allowed_fields = array(
	195	+ 'id',
	196	+ 'created_by',
	197	+ 'project_name',
	198	+ 'description',
	199	+ 'start_date',
	200	+ 'end_date',
	201	+ 'status',
	202	+ 'cat_id',
	203	+ 'users',
	204	+ 'date_created',
	205	+ 'project_auth_code'
	206	+ );
	207	+
	208	+ // Validate column name
	209	+ if ( ! in_array( $select_field, $allowed_fields, true ) ) {
	210	+ return '';
	211	+ }
150	212	if (apply_filters('wppm_get_select_proj_field',true,$proj_id,$select_field)) {
151		- $get_project_field_value = $wpdb->get_var(" SELECT $select_field FROM {$wpdb->prefix}wppm_project WHERE id='$proj_id' ");
	213	+ $get_project_field_value = $wpdb->get_var($wpdb->prepare("SELECT $select_field FROM {$wpdb->prefix}wppm_project WHERE id = %d", $proj_id));
152	214	$project_field_value = $get_project_field_value ? $get_project_field_value : '';
153	215	}
154	216	return stripslashes($project_field_value);
155	217	}
		@@ -156,12 +218,12 @@
156	218
157	219	public function get_task($task_id){
158	220	global $wpdb;
159	221	$task_data = array();
160		- $task_id = esc_sql($task_id);
161		- $task = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task WHERE id='$task_id' ");
	222	+ $task_id = absint($task_id);
	223	+ $task = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task WHERE id = %d", $task_id));
162	224	if( $task ){
163		- $task_data = json_decode(json_encode($task), true);
	225	+ $task_data = json_decode(wp_json_encode($task), true);
164	226	}
165	227	return $task_data;
166	228	}
167	229
		@@ -166,13 +228,13 @@
166	228	}
167	229
168	230	public function get_checklist($task_id){
169	231	global $wpdb;
170		- $task_id = esc_sql($task_id);
	232	+ $task_id = absint($task_id);
171	233	$checklist_data = array();
172		- $checklist = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_checklist WHERE task_id='$task_id' ");
	234	+ $checklist = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_checklist WHERE task_id = %d", $task_id));
173	235	if( $checklist ){
174		- $checklist_data = json_decode(json_encode($checklist), true);
	236	+ $checklist_data = json_decode(wp_json_encode($checklist), true);
175	237	}
176	238	return $checklist_data;
177	239	}
178	240
		@@ -178,23 +240,86 @@
178	240
179	241	public function get_checklist_items($checklist_id){
180	242	global $wpdb;
181	243	$checklist_items_data = array();
182		- $checklist_id = esc_sql($checklist_id);
183		- $checklist_items = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_checklist_items WHERE checklist_id='$checklist_id' ");
	244	+ $checklist_id = absint($checklist_id);
	245	+ $checklist_items = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_checklist_items WHERE checklist_id = %d", $checklist_id));
184	246	if( $checklist_items ){
185		- $checklist_items_data = json_decode(json_encode($checklist_items), true);
	247	+ $checklist_items_data = json_decode(wp_json_encode($checklist_items), true);
186	248	}
187	249	return $checklist_items_data;
188	250	}
189	251
	252	+ public function get_subtasks($task_id){
	253	+ global $wpdb;
	254	+ $task_id = absint($task_id);
	255	+ $subtasks_data = array();
	256	+ $subtasks = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d ORDER BY id ASC", $task_id));
	257	+ if( $subtasks ){
	258	+ $subtasks_data = json_decode(wp_json_encode($subtasks), true);
	259	+ }
	260	+ return $subtasks_data;
	261	+ }
	262	+
	263	+ public function get_subtask_progress($task_id){
	264	+ global $wpdb;
	265	+ $task_id = absint($task_id);
	266	+ $completed_status_id = 4;
	267	+ $total = (int) $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d", $task_id));
	268	+ $completed = (int) $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d AND status = %d", $task_id, $completed_status_id));
	269	+ return array('total'=>$total,'completed'=>$completed);
	270	+ }
	271	+
	272	+ // Deletes a task along with its subtasks (and each one's checklists/comments/attachments).
	273	+ public static function delete_task_and_children($task_id){
	274	+ global $wpdb;
	275	+ $task_id = absint($task_id);
	276	+ $child_ids = $wpdb->get_col($wpdb->prepare("SELECT id FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d", $task_id));
	277	+ foreach($child_ids as $child_id){
	278	+ self::delete_task_and_children($child_id);
	279	+ }
	280	+ $thread_attachment_ids = $wpdb->get_results($wpdb->prepare("SELECT attachment_ids FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d", $task_id));
	281	+ if(!empty($thread_attachment_ids)){
	282	+ foreach ($thread_attachment_ids as $thread_attachment_id){
	283	+ $attachment_ids_temp = array();
	284	+ if($thread_attachment_id->attachment_ids){
	285	+ $attachment_ids_temp = explode(',', $thread_attachment_id->attachment_ids);
	286	+ }
	287	+ foreach ($attachment_ids_temp as $attachment_id){
	288	+ $attachment_id = absint($attachment_id);
	289	+ $result = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id = %d", $attachment_id));
	290	+ if(!empty($result)){
	291	+ $attach_result = $wpdb->get_results($wpdb->prepare("SELECT file_path FROM {$wpdb->prefix}wppm_attachments WHERE file_path = %s", $result->file_path));
	292	+ if(file_exists($result->file_path) && count($attach_result) < 2){
	293	+ wp_delete_file($result->file_path);
	294	+ }
	295	+ $wpdb->delete($wpdb->prefix.'wppm_attachments', array('id' => $attachment_id));
	296	+ }
	297	+ }
	298	+ }
	299	+ }
	300	+ $checklists = $wpdb->get_results($wpdb->prepare("SELECT id FROM {$wpdb->prefix}wppm_checklist WHERE task_id = %d", $task_id));
	301	+ if(!empty($checklists)){
	302	+ foreach($checklists as $checklist){
	303	+ $checklist_id = absint($checklist->id);
	304	+ $wpdb->delete($wpdb->prefix.'wppm_checklist_items', array('checklist_id'=>$checklist_id));
	305	+ $wpdb->delete($wpdb->prefix.'wppm_checklist', array('id'=>$checklist_id));
	306	+ }
	307	+ }
	308	+ $wpdb->delete($wpdb->prefix.'wppm_task', array('id'=>$task_id));
	309	+ $wpdb->delete($wpdb->prefix.'wppm_task_meta', array('task_id'=>$task_id));
	310	+ $wpdb->delete($wpdb->prefix.'wppm_task_comment', array('task_id'=>$task_id));
	311	+ $wpdb->delete($wpdb->prefix.'wppm_task_comment_meta', array('task_id'=>$task_id));
	312	+ do_action('wppm_after_delete_task', $task_id);
	313	+ }
	314	+
190	315	public function get_project($project_id){
191	316	global $wpdb;
192	317	$project_data = array();
193		- $project_id = esc_sql($project_id);
194		- $project = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project WHERE id='$project_id' ");
	318	+ $project_id = absint($project_id);
	319	+ $project = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
195	320	if( $project ){
196		- $project_data = json_decode(json_encode($project), true);
	321	+ $project_data = json_decode(wp_json_encode($project), true);
197	322	}
198	323	return $project_data;
199	324	}
200	325
		@@ -200,12 +325,12 @@
200	325
201	326	public function get_attachment($attachment_id){
202	327	global $wpdb;
203	328	$attachment_data = array();
204		- $attachment_id = esc_sql($attachment_id);
205		- $attachment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id='$attachment_id' ");
	329	+ $attachment_id = absint($attachment_id);
	330	+ $attachment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id = %d", $attachment_id));
206	331	if( $attachment ){
207		- $attachment_data = json_decode(json_encode($attachment), true);
	332	+ $attachment_data = json_decode(wp_json_encode($attachment), true);
208	333	}
209	334	return $attachment_data;
210	335	}
211	336
		@@ -210,9 +335,9 @@
210	335	}
211	336
212	337	public function has_permission($permission, $task_id){
213	338	global $current_user,$wppmfunction,$wpdb;
214		- $task_id = esc_sql($task_id);
	339	+ $task_id = absint($task_id);
215	340	$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
216	341	$wppm_edit_tasks_permission = get_option('wppm_default_edit_tasks_permission');
217	342	$wppm_allow_coworkers_add_checklist = get_option('wppm_allow_coworkers_add_checklist');
218	343	$wppm_allow_coworkers_create_task = get_option('wppm_allow_coworkers_create_task');
		@@ -220,19 +345,19 @@
220	345	$wppm_allow_coworkers_assign_users = get_option('wppm_allow_coworkers_assign_users');
221	346	if(empty($comment_id)){
222	347	$comment_id = 0;
223	348	}
224		- $comment_id = esc_sql($comment_id);
	349	+ $comment_id = absint($comment_id);
225	350	$task_data = $wppmfunction->get_task($task_id);
226		- $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = '$task_id' AND id = '$comment_id'");
	351	+ $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d AND id = %d", $task_id, $comment_id));
227	352
228	353	if(!empty($task_data['project'])){
229	354	$project_id = $task_data['project'];
230		- $project_id = esc_sql($project_id);
	355	+ $project_id = absint($project_id);
231	356	$project_data = $wppmfunction->get_project($project_id);
232		- $cu_user_id = esc_sql($current_user->ID);
233		- $project_user_role = $wpdb->get_var("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = '$project_id' AND user_id = ' $cu_user_id'");
234		- $project_users = $wpdb->get_var("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = '$project_id'");
	357	+ $cu_user_id = absint($current_user->ID);
	358	+ $project_user_role = $wpdb->get_var($wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_user_id));
	359	+ $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
235	360	$project_users_arr = explode(',',(string)$project_users);
236	361	}
237	362	$response = false;
238	363	$flag = false;
		@@ -248,11 +373,14 @@
248	373	}
249	374	if(!empty($project_data) && $project_data['created_by']==$current_user->ID && $wppm_current_user_capability=='wppm_manager'){
250	375	$flag = true;
251	376	}
	377	+ if($current_user->has_cap('manage_options')){
	378	+ $flag = true;
	379	+ }
252	380	if(!empty($project_id)){
253		- $project_id = esc_sql($project_id);
254		- $public_proj_meta = $wpdb->get_var( "SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta where project_id= '$project_id' AND meta_key='public_project'");
	381	+ $project_id = absint($project_id);
	382	+ $public_proj_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta where project_id= %d AND meta_key='public_project'", $project_id));
255	383	}else{
256	384	$public_proj_meta ="";
257	385	}
258	386	switch ($permission) {
		@@ -257,9 +385,10 @@
257	385	}
258	386	switch ($permission) {
259	387	case 'change_status':
260	388	case 'view_task':
261		- ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) )|| ($current_user->ID == $task_data['created_by']) || $public_proj_meta==1 || ($flag==true) ? $response = true: $response = false;
	389	+ case 'add_task_comment':
	390	+ ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) )|| ($current_user->ID == $task_data['created_by']) || $public_proj_meta==1 || ($flag==true) || $current_user->has_cap('manage_options') ? $response = true: $response = false;
262	391	break;
263	392	case 'change_task_details':
264	393	(($flag==true) || ($current_user->ID == $task_data['created_by']) || $wppm_edit_tasks_permission == 1) ? $response = true: $response = false;
265	394	break;
		@@ -289,10 +418,10 @@
289	418	}
290	419
291	420	public function has_comment_permission($permission, $task_id,$comment_id){
292	421	global $current_user,$wppmfunction,$wpdb;
293		- $task_id = esc_sql($task_id);
294		- $comment_id = esc_sql( $comment_id );
	422	+ $task_id = absint($task_id);
	423	+ $comment_id = absint($comment_id);
295	424	$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
296	425	if(empty($comment_id)){
297	426	$comment_id = 0;
298	427	}
		@@ -297,17 +426,17 @@
297	426	$comment_id = 0;
298	427	}
299	428	$task_data = $wppmfunction->get_task($task_id);
300	429	$project_user = array();
301		- $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = '$task_id' AND id = '$comment_id'");
	430	+ $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d AND id = %d", $task_id, $comment_id));
302	431
303	432	if(isset($task_data['project'])){
304	433	$project_id = $task_data['project'];
305		- $project_id = esc_sql($project_id);
306		- $cu_id = esc_sql($current_user->ID);
	434	+ $project_id = absint($project_id);
	435	+ $cu_id = absint($current_user->ID);
307	436	$project_data = $wppmfunction->get_project($project_id);
308		- $project_user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = '$project_id' AND user_id = '$cu_id'");
309		- $project_users = $wpdb->get_var("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = '$project_id'");
	437	+ $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_id));
	438	+ $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
310	439	$project_users_arr = explode(',',(string)$project_users);
311	440	}
312	441	$response = false;
313	442	$flag = false;
		@@ -337,18 +466,18 @@
337	466
338	467	public function has_proj_comment_permission($permission, $proj_id,$comment_id){
339	468	global $current_user,$wppmfunction,$wpdb;
340	469	$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
341		- $proj_id = esc_sql($proj_id);
342		- $comment_id = esc_sql($comment_id);
343		- $cu_id = esc_sql($current_user->ID);
	470	+ $proj_id = absint($proj_id);
	471	+ $comment_id = absint($comment_id);
	472	+ $cu_id = absint($current_user->ID);
344	473	if(empty($comment_id)){
345	474	$comment_id = 0;
346	475	}
347		- $project_user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = '$proj_id' AND user_id = ' $cu_id '");
348		- $project_users = $wpdb->get_var("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = '$proj_id'");
	476	+ $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $proj_id, $cu_id));
	477	+ $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $proj_id));
349	478	$project_users_arr = explode(',',(string)$project_users);
350		- $proj_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE proj_id = '$proj_id' AND id = '$comment_id'");
	479	+ $proj_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE proj_id = %d AND id = %d", $proj_id, $comment_id));
351	480	$response = false;
352	481	$flag = false;
353	482	$project_data = $wppmfunction->get_project($proj_id);
354	483	if((!empty($project_user)) && ($project_user->role_id == 1) && in_array($current_user->ID,$project_users_arr)){
		@@ -371,12 +500,12 @@
371	500
372	501	public function has_project_permission($permission,$project_id){
373	502	global $current_user,$wppmfunction,$wpdb ;
374	503	$project_data = $wppmfunction->get_project($project_id);
375		- $project_id = esc_sql($project_id);
376		- $cu_id = esc_sql($current_user->ID);
377		- $project_user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = ".esc_sql($project_id)." AND user_id = ".esc_sql($cu_id)."");
378		- $project_users = $wpdb->get_var("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = '$project_id'");
	504	+ $project_id = absint($project_id);
	505	+ $cu_id = absint($current_user->ID);
	506	+ $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_id));
	507	+ $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
379	508	$project_users_arr = explode(',',(string)$project_users);
380	509	$user = wp_get_current_user();
381	510	$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
382	511	if(!empty($project_data)){
		@@ -382,12 +511,21 @@
382	511	if(!empty($project_data)){
383	512	$co_worker = $project_data['users'];
384	513	$co_worker_array = explode(",",(string)$co_worker);
385	514	}
	515	+ if(!empty($project_id)){
	516	+ $public_proj_meta = $wpdb->get_var( $wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta where project_id= %d AND meta_key='public_project'", $project_id));
	517	+ }else{
	518	+ $public_proj_meta ="";
	519	+ }
	520	+
386	521	switch ($permission) {
387	522	case 'view_project':
388	523	((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) )? $response = true: $response = false;
389	524	break;
	525	+ case 'add_proj_comment':
	526	+ ( ((!empty($co_worker_array)) && (in_array($current_user->ID,$co_worker_array )) ) || ( $public_proj_meta == '1') || $current_user->has_cap('manage_options')|| $wppm_current_user_capability == 'wppm_admin' || $wppm_current_user_capability == 'wppm_manager')? $response = true: $response = false;
	527	+ break;
390	528	case 'change_project_status':
391	529	case 'assign_project_users':
392	530	case 'change_project_raised_by':
393	531	case 'change_project_details':
		@@ -422,11 +560,11 @@
422	560
423	561	public function change_raised_by($task_id, $user_id){
424	562	global $wpdb;
425	563	$values=array(
426		- 'created_by'=>esc_sql($user_id)
	564	+ 'created_by'=>absint($user_id)
427	565	);
428		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	566	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
429	567	}
430	568
431	569	public function change_task_label($task_id, $task_label){
432	570	global $wpdb;
		@@ -432,50 +570,50 @@
432	570	global $wpdb;
433	571	$values=array(
434	572	'task_name'=>stripslashes($task_label)
435	573	);
436		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	574	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
437	575	}
438	576
439	577	public function change_task_project_label($task_id, $project_label){
440	578	global $wpdb;
441	579	$values=array(
442		- 'project'=>esc_sql($project_label)
	580	+ 'project'=>absint($project_label)
443	581	);
444		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	582	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
445	583	}
446	584
447	585	public function change_start_date($task_id, $task_start_date){
448	586	global $wpdb;
449	587	$values=array(
450		- 'start_date'=>esc_sql($task_start_date)
	588	+ 'start_date'=>$task_start_date
451	589	);
452		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	590	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
453	591	}
454	592
455	593	public function change_end_date($task_id, $task_end_date){
456	594	global $wpdb;
457	595	$values=array(
458		- 'end_date'=>esc_sql($task_end_date)
	596	+ 'end_date'=>$task_end_date
459	597	);
460		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	598	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
461	599	}
462	600
463	601	public function change_priority($task_id, $task_priority){
464	602	global $wpdb;
465	603	$values=array(
466		- 'priority'=>esc_sql($task_priority)
	604	+ 'priority'=>absint($task_priority)
467	605	);
468		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	606	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
469	607	}
470	608
471	609	public function change_description($task_id, $task_description){
472	610	global $wpdb;
473		- $task_description = wp_kses_post($task_description);
	611	+ $task_description = !empty($task_description) ? wp_kses_post($task_description) : '';
474	612	$values=array(
475	613	'description'=>$task_description
476	614	);
477		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	615	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
478	616	}
479	617
480	618	public function change_project($task_id,$proj_id){
481	619	global $wpdb,$wppmfunction;
		@@ -480,10 +618,10 @@
480	618	public function change_project($task_id,$proj_id){
481	619	global $wpdb,$wppmfunction;
482	620	$task_data = $wppmfunction->get_task($task_id);
483	621	$old_proj = $task_data['project'];
484		- $old_proj = esc_sql( $old_proj);
485		- $proj_id = esc_sql( $proj_id);
	622	+ $old_proj = absint( $old_proj);
	623	+ $proj_id = absint( $proj_id);
486	624	$project_data = $wppmfunction->get_project($proj_id);
487	625	$task_assign_users = $task_data['users'];
488	626	$tusers_array = array();
489	627	if(!empty($task_data['users'])){
		@@ -499,16 +637,16 @@
499	637	$wpdb->delete( $wpdb->prefix.'wppm_project_users', array( 'proj_id' => "$proj_id",'user_id'=>"$tuser") );
500	638	}
501	639	elseif(in_array($tuser,$project_users)){
502	640	$tusers_array[] = $tuser;
503		- $tuser = esc_sql($tuser);
504		- $sql = 'SELECT role_id FROM ' . $wpdb->prefix . 'wppm_project_users WHERE proj_id = ' . $old_proj .' AND user_id = '."$tuser";
	641	+ $tuser = absint($tuser);
	642	+ $sql = $wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $old_proj, $tuser);
505	643	$old_proj_user_role = $wpdb->get_var( $sql );
506		- $sql = 'SELECT role_id FROM ' . $wpdb->prefix . 'wppm_project_users WHERE proj_id = ' . $proj_id .' AND user_id = '."$tuser";
	644	+ $sql = $wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $proj_id, $tuser);
507	645	$proj_users_role = $wpdb->get_var( $sql );
508	646	if(!empty( $old_proj_user_role) && $old_proj_user_role!=$proj_users_role){
509	647	$value=array(
510		- 'role_id'=>esc_sql($proj_users_role)
	648	+ 'role_id'=>absint($proj_users_role)
511	649	);
512	650	$wpdb->update($wpdb->prefix.'wppm_project_users', $value, array('proj_id'=>"$proj_id", 'user_id'=>"$tuser"));
513	651	}
514	652	}
		@@ -516,21 +654,21 @@
516	654	}
517	655	}
518	656	$tusers = implode(",",$tusers_array);
519	657	$values=array(
520		- 'project'=>esc_sql($proj_id),
521		- 'users'=>esc_sql($tusers)
	658	+ 'project'=>absint($proj_id),
	659	+ 'users'=>absint($tusers)
522	660	);
523		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	661	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
524	662	}
525	663
526	664	public function get_task_comment($comment_id){
527	665	global $wpdb;
528	666	$task_comment_data = array();
529		- $comment_id = esc_sql($comment_id);
530		- $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE id='$comment_id' ");
	667	+ $comment_id = absint($comment_id);
	668	+ $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE id=%d", $comment_id));
531	669	if( $task_comment ){
532		- $task_comment_data = json_decode(json_encode($task_comment), true);
	670	+ $task_comment_data = json_decode(wp_json_encode($task_comment), true);
533	671	}
534	672	return $task_comment_data;
535	673	}
536	674
		@@ -536,12 +674,12 @@
536	674
537	675	public function get_proj_comment($comment_id){
538	676	global $wpdb;
539	677	$project_comment_data = array();
540		- $comment_id = esc_sql($comment_id);
541		- $project_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE id='$comment_id' ");
	678	+ $comment_id = absint($comment_id);
	679	+ $project_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE id=%d", $comment_id));
542	680	if( $project_comment ){
543		- $project_comment_data = json_decode(json_encode($project_comment), true);
	681	+ $project_comment_data = json_decode(wp_json_encode($project_comment), true);
544	682	}
545	683	return $project_comment_data;
546	684	}
547	685
		@@ -546,10 +684,10 @@
546	684	}
547	685
548	686	public function change_task_comment($comment_id,$comment_body){
549	687	global $wpdb;
550		- $comment_id = esc_sql($comment_id);
551		- $comment_body = wp_kses_post($comment_body);
	688	+ $comment_id = absint($comment_id);
	689	+ $comment_body = !empty($comment_body) ? wp_kses_post($comment_body) : '';
552	690	$values=array(
553	691	'body'=>$comment_body
554	692	);
555	693	$wpdb->update($wpdb->prefix.'wppm_task_comment', $values, array('id'=>"$comment_id"));
		@@ -556,10 +694,10 @@
556	694	}
557	695
558	696	public function change_proj_comment($comment_id,$comment_body){
559	697	global $wpdb;
560		- $comment_id = esc_sql($comment_id);
561		- $comment_body = wp_kses_post($comment_body);
	698	+ $comment_id = absint($comment_id);
	699	+ $comment_body = !empty($comment_body) ? wp_kses_post($comment_body) : '';
562	700	$values=array(
563	701	'body'=>$comment_body
564	702	);
565	703	$wpdb->update($wpdb->prefix.'wppm_project_comment', $values, array('id'=>"$comment_id"));
		@@ -566,9 +704,9 @@
566	704	}
567	705
568	706	public function change_project_label($project_id,$project_label){
569	707	global $wpdb;
570		- $project_id = esc_sql($project_id);
	708	+ $project_id = absint($project_id);
571	709	$values=array(
572	710	'project_name'=>esc_sql($project_label)
573	711	);
574	712	$wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
		@@ -575,9 +713,9 @@
575	713	}
576	714
577	715	public function change_project_start_date($project_id, $project_start_date){
578	716	global $wpdb;
579		- $project_id = esc_sql($project_id);
	717	+ $project_id = absint($project_id);
580	718	$project_start_date = esc_sql($project_start_date);
581	719	$values=array(
582	720	'start_date'=>$project_start_date
583	721	);
		@@ -585,9 +723,9 @@
585	723	}
586	724
587	725	public function change_project_end_date($project_id, $project_end_date){
588	726	global $wpdb;
589		- $project_id = esc_sql($project_id);
	727	+ $project_id = absint($project_id);
590	728	$project_end_date = esc_sql($project_end_date);
591	729	$values=array(
592	730	'end_date'=>$project_end_date
593	731	);
		@@ -595,10 +733,10 @@
595	733	}
596	734
597	735	public function change_category($project_id, $project_category){
598	736	global $wpdb;
599		- $project_id = esc_sql($project_id);
600		- $project_category = esc_sql($project_category);
	737	+ $project_id = absint($project_id);
	738	+ $project_category = absint($project_category);
601	739	$values=array(
602	740	'cat_id'=>$project_category
603	741	);
604	742	$wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
		@@ -605,11 +743,12 @@
605	743	}
606	744
607	745	public function change_project_description($project_id, $project_description){
608	746	global $wpdb;
609		- $project_id = esc_sql($project_id);
610		- $values=array(
611		- 'description'=>wp_kses_post($project_description)
	747	+ $project_id = absint($project_id);
	748	+ $project_description = (string) ( $project_description ?? '' );
	749	+ $values = array(
	750	+ 'description' => wp_kses_post( $project_description )
612	751	);
613	752	$wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
614	753	}
615	754
		@@ -617,14 +756,14 @@
617	756	global $wpdb,$wppmfunction,$current_user;
618	757	$change_status_value= array();
619	758	$proj_data = $wppmfunction->get_project($project_id);
620	759	$prev_status = $proj_data['status'];
621		- $cu_id = esc_sql($current_user->ID);
	760	+ $cu_id = absint($current_user->ID);
622	761	$values=array(
623		- 'status'=>esc_sql($status_id)
	762	+ 'status'=>absint($status_id)
624	763	);
625		- $project_id = esc_sql($project_id);
626		- $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
	764	+ $project_id = absint($project_id);
	765	+ $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
627	766	$old_project_status_meta = $wppmfunction->get_project_meta($project_id,'old_project_status',true);
628	767	if(!empty($old_project_status_meta)){
629	768	$wppmfunction->delete_project_meta($project_id,'old_project_status');
630	769	}
		@@ -629,11 +768,11 @@
629	768	$wppmfunction->delete_project_meta($project_id,'old_project_status');
630	769	}
631	770	$change_status_value = array('prev_status'=>"$prev_status",'new_status'=>"$status_id");
632	771	$change_status_obj = serialize($change_status_value);
633		- $log_values = array('proj_id'=>"$project_id",'body'=>$change_status_obj,'attachment_ids'=>"",'create_time'=>date("Y-m-d h:i:sa"),'created_by'=>"$cu_id" );
	772	+ $log_values = array('proj_id'=>"$project_id",'body'=>$change_status_obj,'attachment_ids'=>"",'create_time'=>wp_date("Y-m-d h:i:sa"),'created_by'=>"$cu_id" );
634	773	$wpdb->insert($wpdb->prefix . 'wppm_project_comment',$log_values);
635		- $log_id = esc_sql($wpdb->insert_id);
	774	+ $log_id = absint($wpdb->insert_id);
636	775	$proj_log_values = array('proj_id'=>"$project_id",'comment_id'=>"$log_id",'comment_type'=>'change_proj_status');
637	776	$wpdb->insert($wpdb->prefix . 'wppm_project_comment_meta',$proj_log_values);
638	777	$wppmfunction->add_project_meta($project_id,'old_project_status',$prev_status);
639	778	do_action('wppm_set_change_project_status', $project_id, $status_id, $prev_status);
		@@ -641,9 +780,9 @@
641	780
642	781	public function change_project_raised_by($project_id, $user_id){
643	782	global $wpdb;
644	783	$values=array(
645		- 'created_by'=>esc_sql($user_id)
	784	+ 'created_by'=>absint($user_id)
646	785	);
647	786	$wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
648	787	}
649	788
		@@ -649,16 +788,16 @@
649	788
650	789	// Email Notification types
651	790	public function get_email_notification_types(){
652	791	$notification_types = array(
653		- 'new_project'=>__('New Project','taskbuilder'),
654		- 'new_task'=>__('New Task','taskbuilder'),
655		- 'change_project_status' => __('Change Project Status','taskbuilder'),
656		- 'change_task_status' => __('Change Task Status','taskbuilder'),
657		- 'change_project_assign_users' => __('Change Project Assign Users','taskbuilder'),
658		- 'change_task_assign_users' => __('Change Task Assign Users','taskbuilder'),
659		- 'new_discussion' => __('New Comment','taskbuilder'),
660		- 'new_proj_discussion' =>__('New Project Comment','taskbuilder')
	792	+ 'new_project'=>esc_html__('New Project','taskbuilder'),
	793	+ 'new_task'=>esc_html__('New Task','taskbuilder'),
	794	+ 'change_project_status' => esc_html__('Change Project Status','taskbuilder'),
	795	+ 'change_task_status' => esc_html__('Change Task Status','taskbuilder'),
	796	+ 'change_project_assign_users' => esc_html__('Change Project Assign Users','taskbuilder'),
	797	+ 'change_task_assign_users' => esc_html__('Change Task Assign Users','taskbuilder'),
	798	+ 'new_discussion' => esc_html__('New Comment','taskbuilder'),
	799	+ 'new_proj_discussion' =>esc_html__('New Project Comment','taskbuilder')
661	800	);
662	801	return apply_filters('wppm_en_types',$notification_types);
663	802	}
664	803
		@@ -694,17 +833,17 @@
694	833	}
695	834
696	835	public function get_project_meta($project_id,$meta_key,$flag = false){
697	836	global $wpdb,$wppmfunction;
698		- $project_id = esc_sql($project_id);
	837	+ $project_id = absint($project_id);
699	838	$meta_key = esc_sql($meta_key);
700	839	if($flag){
701		- $get_meta = $wpdb->get_var("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = '$meta_key' ");
	840	+ $get_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
702	841	$project_meta = isset($get_meta) ? stripslashes($get_meta) : '';
703	842
704	843	} else {
705	844	$project_meta = array();
706		- $results = $wpdb->get_results("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = '$meta_key'");
	845	+ $results = $wpdb->get_results($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
707	846	if( (!empty($results)) ){
708	847	foreach ($results as $result) {
709	848	if(!empty($result)){
710	849	$project_meta[]= stripslashes($result->meta_value);
		@@ -716,17 +855,17 @@
716	855	}
717	856
718	857	public function get_task_meta($task_id,$meta_key,$flag = false){
719	858	global $wpdb,$wppmfunction;
720		- $task_id = esc_sql($task_id);
	859	+ $task_id = absint($task_id);
721	860	$meta_key = esc_sql($meta_key);
722	861	if($flag){
723		- $get_meta = $wpdb->get_var("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = '$meta_key' ");
	862	+ $get_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
724	863	$task_meta = isset($get_meta) ? stripslashes($get_meta) : '';
725	864
726	865	} else {
727	866	$task_meta = array();
728		- $results = $wpdb->get_results("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = '$meta_key'");
	867	+ $results = $wpdb->get_results($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
729	868	if( (!empty($results)) ){
730	869	foreach ($results as $result) {
731	870	if(!empty($result)){
732	871	$task_meta[]= stripslashes($result->meta_value);
		@@ -789,11 +928,11 @@
789	928	* Update project meta for project
790	929	*/
791	930	function update_project_meta($project_id ,$meta_key ,$meta_value){
792	931	global $wpdb;
793		- $project_id = esc_sql($project_id);
	932	+ $project_id = absint($project_id);
794	933	$meta_key = esc_sql($meta_key);
795		- $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = '$meta_key'");
	934	+ $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
796	935	$wpdb->update($wpdb->prefix.'wppm_project_meta', $meta_value, array('project_id'=>$project_id,'meta_key' => "$meta_key"));
797	936	}
798	937
799	938	/**
		@@ -800,25 +939,25 @@
800	939	* Update task meta for task
801	940	*/
802	941	function update_task_meta($task_id ,$meta_key ,$meta_value){
803	942	global $wpdb;
804		- $task_id = esc_sql($task_id);
	943	+ $task_id = absint($task_id);
805	944	$meta_key = esc_sql($meta_key);
806		- $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = '$meta_key'");
807		- $wpdb->update($wpdb->prefix.'wppm_task_meta', $meta_value, array('task_id'=>"$task_id",'meta_key' => "$meta_key"));
	945	+ $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
	946	+ $wpdb->update($wpdb->prefix.'wppm_task_meta', $meta_value, array('task_id'=>$task_id,'meta_key' => "$meta_key"));
808	947	}
809	948
810	949	function delete_project_meta($project_id ,$meta_key){
811	950	global $wpdb;
812		- $project_id = esc_sql($project_id);
813		- $meta_key = esc_sql($meta_key);
	951	+ $project_id = absint($project_id);
	952	+ $meta_key = ($meta_key);
814	953	$wpdb->delete( $wpdb->prefix.'wppm_project_meta', array( 'project_id' => "$project_id",'meta_key'=>"$meta_key") );
815	954	}
816	955
817	956	function delete_task_meta($task_id ,$meta_key){
818	957	global $wpdb;
819		- $task_id = esc_sql($task_id);
820		- $meta_key = esc_sql($meta_key);
	958	+ $task_id = absint($task_id);
	959	+ $meta_key = ($meta_key);
821	960	$wpdb->delete( $wpdb->prefix.'wppm_task_meta', array( 'task_id' => "$task_id",'meta_key'=>"$meta_key") );
822	961	}
823	962
824	963	public function replace_macro($str,$project_id){
		@@ -833,17 +972,17 @@
833	972
834	973	public function get_old_project_status_name($id){
835	974	global $wppmfunction, $wpdb;
836	975	$old_project_status = $wppmfunction->get_project_meta($id,'old_project_status',true);
837		- $old_project_status = esc_sql($old_project_status);
838		- $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id ='$old_project_status'");
	976	+ $old_project_status = absint($old_project_status);
	977	+ $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id = %d",$old_project_status));
839	978	return $status_name;
840	979	}
841	980
842	981	public function get_new_project_status_name($status_id){
843	982	global $wpdb;
844		- $status_id = esc_sql($status_id);
845		- $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id ='$status_id'");
	983	+ $status_id = absint($status_id);
	984	+ $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id = %d",$status_id));
846	985	return $status_name;
847	986	}
848	987
849	988	public function get_old_task_status_name($task_id){
		@@ -848,25 +987,25 @@
848	987
849	988	public function get_old_task_status_name($task_id){
850	989	global $wppmfunction, $wpdb;
851	990	$old_task_status = $wppmfunction->get_task_meta($task_id,'old_task_status',true);
852		- $old_task_status = esc_sql($old_task_status);
853		- $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id ='$old_task_status'");
	991	+ $old_task_status = absint($old_task_status);
	992	+ $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id = %d",$old_task_status));
854	993	return $status_name;
855	994	}
856	995
857	996	public function get_new_task_status_name($status_id){
858	997	global $wpdb;
859		- $status_id = esc_sql($status_id);
860		- $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id ='$status_id'");
	998	+ $status_id = absint($status_id);
	999	+ $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id = %d",$status_id));
861	1000	return $status_name;
862	1001	}
863	1002
864	1003	public function get_project_category_name($cat_id){
865	1004	global $wpdb;
866		- $cat_id = esc_sql($cat_id);
	1005	+ $cat_id = absint($cat_id);
867	1006	if(!empty($cat_id)){
868		- $cat_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_categories WHERE id ='$cat_id'");
	1007	+ $cat_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_categories WHERE id = %d",$cat_id));
869	1008	}else{
870	1009	$cat_name = "";
871	1010	}
872	1011	return $cat_name;
		@@ -943,17 +1082,17 @@
943	1082	}
944	1083
945	1084	public function get_task_priority_name($priority){
946	1085	global $wpdb;
947		- $priority = esc_sql($priority);
948		- $priority_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_priorities WHERE id ='$priority'");
	1086	+ $priority = absint($priority);
	1087	+ $priority_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_priorities WHERE id = %d",$priority));
949	1088	return $priority_name;
950	1089	}
951	1090
952	1091	public function get_last_comment_user_name($task_id){
953	1092	global $wpdb;
954		- $task_id = esc_sql($task_id);
955		- $task_comment_creator = $wpdb->get_var("SELECT created_by FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = '$task_id')");
	1093	+ $task_id = absint($task_id);
	1094	+ $task_comment_creator = $wpdb->get_var($wpdb->prepare("SELECT created_by FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = %d)",$task_id));
956	1095	if(!empty($task_comment_creator)){
957	1096	$user = get_userdata( $task_comment_creator );
958	1097	return $user->display_name;
959	1098	}
		@@ -960,21 +1099,21 @@
960	1099	}
961	1100
962	1101	public function get_last_comment_body($task_id){
963	1102	global $wpdb;
964		- $task_id = esc_sql($task_id);
965		- $task_comment = $wpdb->get_var("SELECT body FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = '$task_id')");
	1103	+ $task_id = absint($task_id);
	1104	+ $task_comment = $wpdb->get_var($wpdb->prepare("SELECT body FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = %d)",$task_id));
966	1105	return $task_comment;
967	1106	}
968	1107
969		- public function create_duplicate_task($ptask_id, $project_id,$ajax_nonce){
	1108	+ public function create_duplicate_task($ptask_id, $project_id,$internal_code_flag=false){
970	1109	include WPPM_ABSPATH . 'includes/admin/tasks/open_task/wppm_set_clone_task.php';
971	1110	}
972	1111
973	1112	public function get_last_comment_proj_user_name($project_id){
974	1113	global $wpdb;
975		- $project_id = esc_sql($project_id);
976		- $proj_comment_creator = $wpdb->get_var("SELECT created_by FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = '$project_id')");
	1114	+ $project_id = absint($project_id);
	1115	+ $proj_comment_creator = $wpdb->get_var($wpdb->prepare("SELECT created_by FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = %d)",$project_id));
977	1116	if(!empty($proj_comment_creator)){
978	1117	$user = get_userdata( $proj_comment_creator );
979	1118	return $user->display_name;
980	1119	}
		@@ -981,16 +1120,16 @@
981	1120	}
982	1121
983	1122	public function get_proj_comment_body($project_id){
984	1123	global $wpdb;
985		- $project_id = esc_sql($project_id);
986		- $proj_comment = $wpdb->get_var("SELECT body FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = '$project_id')");
	1124	+ $project_id = absint($project_id);
	1125	+ $proj_comment = $wpdb->get_var($wpdb->prepare("SELECT body FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = %d)",$project_id));
987	1126	return $proj_comment;
988	1127	}
989	1128
990	1129	public function get_project_url($project_id, $view){
991	1130	global $wpdb,$wppmfunction;
992		- $project_id = esc_sql($project_id);
	1131	+ $project_id = absint($project_id);
993	1132	$page_settings = get_option( 'wppm-page-settings' );
994	1133	if ( $view == '0' ) {
995	1134	$url = admin_url( 'admin.php?page=wppm-projects&section=project-list&id=' . $project_id );
996	1135	} else {
		@@ -1011,9 +1150,9 @@
1011	1150	}
1012	1151
1013	1152	public function get_task_url($task_id, $view){
1014	1153	global $wpdb,$wppmfunction;
1015		- $task_id = esc_sql($task_id);
	1154	+ $task_id = absint($task_id);
1016	1155	$page_settings = get_option( 'wppm-page-settings' );
1017	1156	if ( $view == '0' ) {
1018	1157	$url = admin_url( 'admin.php?page=wppm-tasks&section=task-list&id=' . $task_id );
1019	1158	} else{
		@@ -1034,12 +1173,12 @@
1034	1173
1035	1174	public function wppm_user_role(){
1036	1175	$user_role = array(
1037	1176	'wppm_admin' => array(
1038		- 'label' => __('WPPM Administrator','taskbuilder'),
	1177	+ 'label' => esc_html__('WPPM Administrator','taskbuilder'),
1039	1178	),
1040	1179	'wppm_manager' => array(
1041		- 'label' => __('WPPM Manager','taskbuilder'),
	1180	+ 'label' => esc_html__('WPPM Manager','taskbuilder'),
1042	1181	)
1043	1182	);
1044	1183	return $user_role;
1045	1184	}
		@@ -1126,7 +1265,128 @@
1126	1265	</div>
1127	1266	</div>
1128	1267	<?php
1129	1268	}
	1269	+
	1270	+ public function wppm_get_duration($start_date, $end_date){
	1271	+ if ( empty($start_date) || empty($end_date) || $start_date=='0000-00-00 00:00:00' || $end_date =='0000-00-00 00:00:00') {
	1272	+ return '';
	1273	+ }
	1274	+
	1275	+ $start_ts = strtotime($start_date);
	1276	+ $end_ts = strtotime($end_date);
	1277	+
	1278	+ if ( $end_ts <= $start_ts ) {
	1279	+ return '0 min';
	1280	+ }
	1281	+
	1282	+ $diff = $end_ts - $start_ts;
	1283	+
	1284	+ $days = floor($diff / 86400);
	1285	+ $hours = floor(($diff % 86400) / 3600);
	1286	+ $minutes = floor(($diff % 3600) / 60);
	1287	+
	1288	+ $duration = [];
	1289	+
	1290	+ if ($days > 0) $duration[] = $days . 'd';
	1291	+ if ($hours > 0) $duration[] = $hours . 'h';
	1292	+ if ($minutes > 0 || empty($duration)) $duration[] = $minutes . 'm';
	1293	+
	1294	+ return implode(' ', $duration);
	1295	+
	1296	+ }
	1297	+
	1298	+ public function wppm_highlight_user_mentions($content, $current_user_id) {
	1299	+
	1300	+ return preg_replace_callback(
	1301	+ '/<span[^>]*class="wppm-mention"[^>]*data-user-id="(\d+)"[^>]*>(.*?)<\/span>/is',
	1302	+ function($matches) use ($current_user_id) {
	1303	+
	1304	+ $user_id = intval($matches[1]);
	1305	+ $text = $matches[2];
	1306	+
	1307	+ // already processed → skip
	1308	+ if (strpos($matches[0], 'wppm-mention-me') !== false) {
	1309	+ return $matches[0];
	1310	+ }
	1311	+
	1312	+ if ($user_id === $current_user_id) {
	1313	+ return '<span class="wppm-mention wppm-mention-me" data-user-id="' . esc_attr($user_id) . '">' . $text . '</span>';
	1314	+ }
	1315	+
	1316	+ return '<span class="wppm-mention" data-user-id="' . esc_attr($user_id) . '">' . $text . '</span>';
	1317	+ },
	1318	+ $content
	1319	+ );
	1320	+ }
	1321	+ function wppm_clean_mentions_html($content) {
	1322	+ // Remove dropdown items
	1323	+ $content = preg_replace('/<div[^>]*class="mention-item"[^>]*>.*?<\/div>/is', '', $content);
	1324	+
	1325	+ // Remove mention dropdown container
	1326	+ $content = preg_replace('/<div[^>]*id="wppm_mention_list"[^>]*>.*?<\/div>/is', '', $content);
	1327	+
	1328	+ return $content;
	1329	+ }
	1330	+
	1331	+ function wppm_extract_mentions($comment) {
	1332	+ preg_match_all('/data-user-id="(\d+)"/', $comment, $matches);
	1333	+ return $matches[1];
	1334	+ }
	1335	+
	1336	+ function wppm_get_users_from_mentions($user_ids) {
	1337	+ $users = [];
	1338	+ foreach ($user_ids as $user_id) {
	1339	+ $user = get_user_by('id', intval($user_id));
	1340	+ if ($user) {
	1341	+ $users[] = $user;
	1342	+ }
	1343	+ }
	1344	+ return $users;
	1345	+ }
	1346	+
	1347	+ function wppm_send_mention_email($email_addresses, $comment, $task_id) {
	1348	+ $page_setting = get_option('wppm-page-settings');
	1349	+ $from_name = get_option('wppm_en_from_name');
	1350	+ $from_email = get_option('wppm_en_from_email');
	1351	+ $view = $page_setting['task-url-page'];
	1352	+ $subject = esc_html__("You were mentioned in a comment", "taskbuilder");
	1353	+ $to = isset($email_addresses[0]) ? $email_addresses[0] : '';
	1354	+ if (!$to) {
	1355	+ return;
	1356	+ }
	1357	+ unset($email_addresses[0]);
	1358	+ $headers = "From: {$from_name} <{$from_email}>\r\n";
	1359	+ foreach ($email_addresses as $email_address) {
	1360	+ $headers .= "BCC: {$email_address}\r\n";
	1361	+ }
	1362	+ $headers .= "Content-Type: text/html; charset=UTF-8\r\n";
	1363	+ $task_url = $this->get_task_url($task_id, $view);
	1364	+ $message = esc_html__("Hello,", "taskbuilder");
	1365	+ $message .= "<br><br>";
	1366	+ $message .= esc_html__("You were mentioned in a comment:", "taskbuilder");
	1367	+ $message .= "<br><br>";
	1368	+ $message .= nl2br(esc_html(strip_tags($comment)));
	1369	+ $message .= "<br><br>";
	1370	+ $message .= esc_html__("View Task:", "taskbuilder") . " ";
	1371	+ $message .= '<a class="wppm_link" href="' . esc_url($task_url) . '" target="_blank">' . esc_html__("View Task", "taskbuilder") . '</a>';
	1372	+ wp_mail($to, $subject, $message, $headers);
	1373	+ do_action('wppm_after_sent_mention_mail', $email_addresses, $comment, $task_id);
	1374	+ }
	1375	+
	1376	+ function wppm_insert_notification($user_id, $message, $link,$is_read,$type) {
	1377	+ global $wpdb;
	1378	+ $wpdb->insert(
	1379	+ $wpdb->prefix . 'wppm_notifications',
	1380	+ [
	1381	+ 'user_id' => $user_id,
	1382	+ 'message' => $message,
	1383	+ 'link' => $link,
	1384	+ 'is_read' => $is_read,
	1385	+ 'notification_type'=>$type,
	1386	+ 'created_at' => current_time('mysql')
	1387	+ ]
	1388	+ );
	1389	+ }
1130	1390	}
1131	1391	endif;
1132	1392	$GLOBALS['wppmfunction'] = new WPPM_Functions();