PluginProbe
Taskbuilder – Project Management & Task Management Tool With Kanban Board / 6.0.6
Taskbuilder – Project Management & Task Management Tool With Kanban Board v6.0.6
6.0.6 6.0.5 6.0.2 6.0.3 6.0.4 6.0.1 6.0.0 5.0.8 5.0.9 4.0.9 5.0.0 5.0.1 5.0.2 5.0.3 5.0.4 5.0.5 5.0.6 5.0.7 trunk 1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5 All 58 releases
← All changes | includes/admin/projects/open_project/wppm_get_project_tasks.php +31 -28 5.0.2 → 6.0.6 View file →
@@ -2,23 +2,26 @@
2 2 if ( ! defined( 'ABSPATH' ) ) {
3 3 exit; // Exit if accessed directly
4 4 }
5 5 global $current_user,$wpdb,$wppmfunction;
6 -$project_id = isset($_POST['id']) ? intval(sanitize_text_field($_POST['id'])) : 0 ;
7 -$project_id = esc_sql($project_id);
8 -$cu_id = esc_sql($current_user->ID);
6 +$project_id = isset($_POST['id']) ? intval(sanitize_text_field(wp_unslash($_POST['id']))) : 0 ;
7 +$project_id = (int)($project_id);
8 +$cu_id = (int)($current_user->ID);
9 9 $appearance_settings = get_option("wppm-ap-task-list");
10 10 $wppm_task_time = get_option('wppm_task_time');
11 11 $wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
12 12 if($current_user->has_cap('manage_options') || $wppm_current_user_capability=='wppm_admin'){
13 - $query = ( "SELECT * FROM {$wpdb->prefix}wppm_task where project='$project_id'");
13 + $query = $wpdb->prepare(
14 + "SELECT * FROM {$wpdb->prefix}wppm_task WHERE project = %d AND (parent_task_id = 0 OR parent_task_id IS NULL)",
15 + $project_id
16 + );
14 17 } else{
15 -$query = ( "SELECT Task.*
16 - FROM {$wpdb->prefix}wppm_task AS Task
17 - Left join {$wpdb->prefix}wppm_project proj ON Task.project = proj.id
18 - Left join {$wpdb->prefix}wppm_project_users proj_users ON Task.project = proj_users.proj_id
19 - Left join {$wpdb->prefix}wppm_project_meta proj_meta ON Task.project = proj_meta.project_id
20 - where Task.project = '$project_id' AND ((FIND_IN_SET('$cu_id',Task.users)>0) OR (Task.created_by= '$cu_id') OR (proj_users.user_id = '$cu_id' AND proj_users.role_id = 1 AND (FIND_IN_SET('$cu_id',proj.users)>0)) OR (Task.project = proj_meta.project_id AND proj_meta.meta_key='public_project' AND proj_meta.meta_value=1) OR (Task.project = proj.id AND proj.created_by='$cu_id')) Group by Task.id");
18 + $query = $wpdb->prepare( "SELECT Task.* FROM {$wpdb->prefix}wppm_task AS Task
19 + LEFT JOIN {$wpdb->prefix}wppm_project proj ON Task.project = proj.id
20 + LEFT JOIN {$wpdb->prefix}wppm_project_users proj_users ON Task.project = proj_users.proj_id
21 + LEFT JOIN {$wpdb->prefix}wppm_project_meta proj_meta ON Task.project = proj_meta.project_id
22 + WHERE Task.project = %d AND (Task.parent_task_id = 0 OR Task.parent_task_id IS NULL) AND (FIND_IN_SET(%d, Task.users) > 0 OR Task.created_by = %d OR ( proj_users.user_id = %d AND proj_users.role_id = 1 AND FIND_IN_SET(%d, proj.users) > 0 ) OR ( proj_meta.meta_key = 'public_project' AND proj_meta.meta_value = 1 ) OR proj.created_by = %d ) GROUP BY Task.id",
23 + $project_id,$cu_id, $cu_id,$cu_id,$cu_id, $cu_id );
21 24 }
22 25 $query = apply_filters('wppm_get_project_tasks_query',$query,$project_id);
23 26 $tasks = $wpdb->get_results($query);
24 27 ob_start();
@@ -40,21 +43,18 @@
40 43 <tbody>
41 44 <?php
42 45 if(!empty($tasks)){
43 46 foreach ($tasks as $task) {
44 - $tstatus = esc_sql($task->status);
45 - $status = $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}wppm_task_statuses where id = '$tstatus'" );
47 + $status = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}wppm_task_statuses WHERE id = %d", (int) $task->status ) );
46 48 $users = array();
47 49 if($task->users != null){
48 50 $users = explode(",",$task->users);
49 51 }
50 52 if(!empty($task->priority)){
51 - $tpriority = esc_sql($task->priority);
52 - $priority = $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}wppm_task_priorities where id = '$tpriority'" );
53 + $priority = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}wppm_task_priorities WHERE id = %d", (int) $task->priority));
53 54 }
54 55 if(!empty($task->project)){
55 - $tproject = esc_sql($task->project);
56 - $project = $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}wppm_project where id = '$tproject'" );
56 + $project = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}wppm_project WHERE id = %d",(int) $task->project));
57 57 }
58 58 if($wppm_task_time == 1){
59 59 $task_start_date = $task->start_date;
60 60 $task_end_date = $task->end_date;
@@ -66,18 +66,18 @@
66 66 }
67 67 ?>
68 68 <tr onclick= "wppm_open_project_tasks(<?php echo esc_attr($task->id) ?>,<?php echo esc_attr($task->project) ?>)" >
69 69 <td>
70 - <?php echo esc_html_e($task->id,'taskbuilder') ?>
70 + <?php echo esc_html($task->id); ?>
71 71 </td>
72 72 <td>
73 - <?php echo esc_html_e($task->task_name,'taskbuilder') ?>
73 + <?php echo esc_html($task->task_name); ?>
74 74 </td>
75 75 <td>
76 - <span class="wppm_td_task_status" style="background-color:<?php echo (isset($status->bg_color))? esc_attr($status->bg_color):"";?>; color: <?php echo (isset($status->color))? esc_attr($status->color):""; ?>"><?php echo (isset($status->name))? esc_html_e($status->name,'taskbuilder'):"" ?></span>
76 + <span class="wppm_td_task_status" style="background-color:<?php echo (isset($status->bg_color))? esc_attr($status->bg_color):"";?>; color: <?php echo (isset($status->color))? esc_attr($status->color):""; ?>"><?php echo (isset($status->name))? esc_html($status->name):"" ?></span>
77 77 </td>
78 78 <td>
79 - <span class ="wppm_td_task_priority" style="background-color:<?php echo (isset($priority->bg_color))? esc_attr($priority->bg_color):"";?>; color: <?php echo (isset($priority->color))? esc_attr($priority->color):""; ?>"><?php echo (isset($priority->name))? esc_html_e($priority->name,'taskbuilder'):"" ?></span>
79 + <span class ="wppm_td_task_priority" style="background-color:<?php echo (isset($priority->bg_color))? esc_attr($priority->bg_color):"";?>; color: <?php echo (isset($priority->color))? esc_attr($priority->color):""; ?>"><?php echo (isset($priority->name))? esc_html($priority->name):"" ?></span>
80 80 </td>
81 81 <td>
82 82 <?php
83 83 $i=0;
@@ -84,16 +84,19 @@
84 84 if(!empty($users)){
85 85 foreach($users as $user){
86 86 $i++;
87 87 if( $i <= 4 ){
88 - $userdata = get_userdata( $user ); ?>
89 - <a href="#" title="<?php echo esc_attr($userdata->display_name) ?>">
90 - <?php echo (get_avatar($userdata->ID, 25, "mysteryman"))?>
91 - </a> <?php
88 + $userdata = get_userdata( $user );
89 + if($userdata){
90 + ?>
91 + <a href="#" title="<?php echo esc_attr($userdata->display_name) ?>">
92 + <?php echo (get_avatar($userdata->ID, 25, "mysteryman"))?>
93 + </a> <?php
94 + }
92 95 }
93 96 }
94 97 } else {
95 - _e('None','taskbuilder');
98 + esc_html_e('None','taskbuilder');
96 99 }
97 100 if($i > 4){
98 101 ?>
99 102 <a href="#" class="wppm_avatar">
@@ -101,12 +104,12 @@
101 104 </a>
102 105 <?php } ?>
103 106 </td>
104 107 <td>
105 - <?php echo (isset($task_start_date))? esc_html_e($task_start_date,'taskbuilder'):""?>
108 + <?php echo (isset($task_start_date))? esc_html($task_start_date):""?>
106 109 </td>
107 110 <td>
108 - <?php echo (isset($task_end_date))? esc_html_e($task_end_date,'taskbuilder'):""?>
111 + <?php echo (isset($task_end_date))? esc_html($task_end_date):""?>
109 112 </td>
110 113 </tr>
111 114 <?php }
112 115 }
@@ -156,5 +159,5 @@
156 159 'body' => $body,
157 160 'footer' => $footer
158 161 );
159 162
160 -echo json_encode($response);
163 +echo wp_json_encode($response);