← All changes | includes/class-wppm-functions.php +372 -150 5.0.3 → 6.0.6 View file →

		@@ -11,9 +11,9 @@
11	11	if ( is_array( $value ) ) {
12	12	$value = $this->sanitize_array($value);
13	13	}
14	14	else {
15		- $value = sanitize_text_field( $value );
	15	+ $value = sanitize_text_field( wp_unslash( $value ) );
16	16	}
17	17	}
18	18	}
19	19	return $array;
		@@ -30,9 +30,11 @@
30	30	'end_date'=>isset($args['wppm_end_date'])? $args['wppm_end_date']:"",
31	31	'status'=>isset($args['status'])? $args['status']:$default_proj_status,
32	32	'cat_id'=>isset($args['wppm_create_project_category']) ? $args['wppm_create_project_category']:"",
33	33	'users'=>isset($args['user_names']) ? implode(",",$args['user_names']):"",
34		- 'date_created'=>isset($args['date_created'])? $args['date_created']:date("Y-m-d h:i:sa"),
	34	+ 'date_created'=>isset($args['date_created'])? $args['date_created']:wp_date("Y-m-d h:i:sa"),
	35	+ 'project_auth_code'=> self::getRandomString(10)
	36	+
35	37	);
36	38	$wpdb->insert($wpdb->prefix .'wppm_project', $values);
37	39	$project_id = $wpdb->insert_id;
38	40	return $project_id;
		@@ -38,9 +40,9 @@
38	40	return $project_id;
39	41	}
40	42
41	43	public static function create_task($args){
42		- global $wpdb,$current_user,$wppmfunction;
	44	+ global $wpdb,$current_user;
43	45	$default_task_status = get_option('wppm_default_task_status');
44	46	$values = array(
45	47	'created_by'=>(isset($args['created_by'])) ? $args['created_by']: $current_user->ID,
46	48	'task_name'=>$args['name'],
		@@ -50,11 +52,12 @@
50	52	'end_date'=>(isset($args['wppm_task_end_date']))?$args['wppm_task_end_date']:"",
51	53	'status'=>(isset($args['status']))?$args['status']:$default_task_status,
52	54	'priority'=>(isset($args['wppm_create_task_priority']))?$args['wppm_create_task_priority']:"",
53	55	'users'=>(!empty($args['user_names']))?implode(",",$args['user_names']):"",
54		- 'date_created'=>isset($args['date_created'])? $args['date_created']:date("Y-m-d h:i:sa"),
55		- 'task_auth_code'=> $wppmfunction->getRandomString(10),
56		- 'active'=>1
	56	+ 'date_created'=>isset($args['date_created'])? $args['date_created']:wp_date("Y-m-d h:i:sa"),
	57	+ 'task_auth_code'=> self::getRandomString(10),
	58	+ 'active'=>1,
	59	+ 'parent_task_id'=>(isset($args['parent_task_id']))?absint($args['parent_task_id']):0
57	60	);
58	61	$wpdb->insert($wpdb->prefix .'wppm_task', $values);
59	62	$task_id = $wpdb->insert_id;
60	63	return $task_id;
		@@ -118,9 +121,9 @@
118	121	public static function getRandomString($length = 8) {
119	122	$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
120	123	$string = '';
121	124	for ($i = 0; $i < $length; $i++) {
122		- $string .= $characters[mt_rand(0, strlen($characters) - 1)];
	125	+ $string .= $characters[wp_rand(0, strlen($characters) - 1)];
123	126	}
124	127	return $string;
125	128	}
126	129
		@@ -125,20 +128,61 @@
125	128	}
126	129
127	130	public static function wppm_get_auth_code($id){
128	131	global $wpdb;
129		- $id = esc_sql($id);
130		- $auth_code = $wpdb->get_var( "SELECT task_auth_code FROM {$wpdb->prefix}wppm_task where id='$id'" );
	132	+ $id = absint($id);
	133	+ $auth_code = $wpdb->get_var(
	134	+ $wpdb->prepare(
	135	+ "SELECT task_auth_code
	136	+ FROM {$wpdb->prefix}wppm_task
	137	+ WHERE id = %d",
	138	+ ($id)
	139	+ )
	140	+ );
131	141	$auth_code = isset($auth_code) ? $auth_code : "";
132	142	return $auth_code;
133	143	}
134	144
	145	+ public static function wppm_get_proj_auth_code($id){
	146	+ global $wpdb;
	147	+ $id = absint($id);
	148	+ $auth_code = $wpdb->get_var(
	149	+ $wpdb->prepare(
	150	+ "SELECT project_auth_code
	151	+ FROM {$wpdb->prefix}wppm_project
	152	+ WHERE id = %d",
	153	+ ($id)
	154	+ )
	155	+ );
	156	+ $auth_code = isset($auth_code) ? $auth_code : "";
	157	+ return $auth_code;
	158	+ }
	159	+
135	160	public static function get_task_fields($task_id,$select_field){
136	161	global $wpdb;
137		- $task_id = esc_sql($task_id);
	162	+ $task_id = absint($task_id);
138	163	$task_field_value = '';
	164	+ $allowed_fields = array(
	165	+ 'id',
	166	+ 'created_by',
	167	+ 'task_name',
	168	+ 'description',
	169	+ 'project',
	170	+ 'start_date',
	171	+ 'end_date',
	172	+ 'status',
	173	+ 'priority',
	174	+ 'users',
	175	+ 'date_created',
	176	+ 'task_auth_code'
	177	+ );
	178	+
	179	+ // Validate column name
	180	+ if ( ! in_array( $select_field, $allowed_fields, true ) ) {
	181	+ return '';
	182	+ }
139	183	if (apply_filters('wppm_get_select_field',true,$task_id,$select_field)) {
140		- $get_task_field_value = $wpdb->get_var(" SELECT $select_field FROM {$wpdb->prefix}wppm_task WHERE id='$task_id' ");
	184	+ $get_task_field_value = $wpdb->get_var($wpdb->prepare("SELECT $select_field FROM {$wpdb->prefix}wppm_task WHERE id = %d", $task_id));
141	185	$task_field_value = $get_task_field_value ? $get_task_field_value : '';
142	186	}
143	187	return stripslashes($task_field_value);
144	188	}
		@@ -144,12 +188,30 @@
144	188	}
145	189
146	190	public static function get_project_fields($proj_id,$select_field){
147	191	global $wpdb;
148		- $proj_id = esc_sql($proj_id);
	192	+ $proj_id = absint($proj_id);
149	193	$project_field_value = '';
	194	+ $allowed_fields = array(
	195	+ 'id',
	196	+ 'created_by',
	197	+ 'project_name',
	198	+ 'description',
	199	+ 'start_date',
	200	+ 'end_date',
	201	+ 'status',
	202	+ 'cat_id',
	203	+ 'users',
	204	+ 'date_created',
	205	+ 'project_auth_code'
	206	+ );
	207	+
	208	+ // Validate column name
	209	+ if ( ! in_array( $select_field, $allowed_fields, true ) ) {
	210	+ return '';
	211	+ }
150	212	if (apply_filters('wppm_get_select_proj_field',true,$proj_id,$select_field)) {
151		- $get_project_field_value = $wpdb->get_var(" SELECT $select_field FROM {$wpdb->prefix}wppm_project WHERE id='$proj_id' ");
	213	+ $get_project_field_value = $wpdb->get_var($wpdb->prepare("SELECT $select_field FROM {$wpdb->prefix}wppm_project WHERE id = %d", $proj_id));
152	214	$project_field_value = $get_project_field_value ? $get_project_field_value : '';
153	215	}
154	216	return stripslashes($project_field_value);
155	217	}
		@@ -156,12 +218,12 @@
156	218
157	219	public function get_task($task_id){
158	220	global $wpdb;
159	221	$task_data = array();
160		- $task_id = esc_sql($task_id);
161		- $task = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task WHERE id='$task_id' ");
	222	+ $task_id = absint($task_id);
	223	+ $task = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task WHERE id = %d", $task_id));
162	224	if( $task ){
163		- $task_data = json_decode(json_encode($task), true);
	225	+ $task_data = json_decode(wp_json_encode($task), true);
164	226	}
165	227	return $task_data;
166	228	}
167	229
		@@ -166,13 +228,13 @@
166	228	}
167	229
168	230	public function get_checklist($task_id){
169	231	global $wpdb;
170		- $task_id = esc_sql($task_id);
	232	+ $task_id = absint($task_id);
171	233	$checklist_data = array();
172		- $checklist = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_checklist WHERE task_id='$task_id' ");
	234	+ $checklist = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_checklist WHERE task_id = %d", $task_id));
173	235	if( $checklist ){
174		- $checklist_data = json_decode(json_encode($checklist), true);
	236	+ $checklist_data = json_decode(wp_json_encode($checklist), true);
175	237	}
176	238	return $checklist_data;
177	239	}
178	240
		@@ -178,23 +240,86 @@
178	240
179	241	public function get_checklist_items($checklist_id){
180	242	global $wpdb;
181	243	$checklist_items_data = array();
182		- $checklist_id = esc_sql($checklist_id);
183		- $checklist_items = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_checklist_items WHERE checklist_id='$checklist_id' ");
	244	+ $checklist_id = absint($checklist_id);
	245	+ $checklist_items = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_checklist_items WHERE checklist_id = %d", $checklist_id));
184	246	if( $checklist_items ){
185		- $checklist_items_data = json_decode(json_encode($checklist_items), true);
	247	+ $checklist_items_data = json_decode(wp_json_encode($checklist_items), true);
186	248	}
187	249	return $checklist_items_data;
188	250	}
189	251
	252	+ public function get_subtasks($task_id){
	253	+ global $wpdb;
	254	+ $task_id = absint($task_id);
	255	+ $subtasks_data = array();
	256	+ $subtasks = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d ORDER BY id ASC", $task_id));
	257	+ if( $subtasks ){
	258	+ $subtasks_data = json_decode(wp_json_encode($subtasks), true);
	259	+ }
	260	+ return $subtasks_data;
	261	+ }
	262	+
	263	+ public function get_subtask_progress($task_id){
	264	+ global $wpdb;
	265	+ $task_id = absint($task_id);
	266	+ $completed_status_id = 4;
	267	+ $total = (int) $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d", $task_id));
	268	+ $completed = (int) $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d AND status = %d", $task_id, $completed_status_id));
	269	+ return array('total'=>$total,'completed'=>$completed);
	270	+ }
	271	+
	272	+ // Deletes a task along with its subtasks (and each one's checklists/comments/attachments).
	273	+ public static function delete_task_and_children($task_id){
	274	+ global $wpdb;
	275	+ $task_id = absint($task_id);
	276	+ $child_ids = $wpdb->get_col($wpdb->prepare("SELECT id FROM {$wpdb->prefix}wppm_task WHERE parent_task_id = %d", $task_id));
	277	+ foreach($child_ids as $child_id){
	278	+ self::delete_task_and_children($child_id);
	279	+ }
	280	+ $thread_attachment_ids = $wpdb->get_results($wpdb->prepare("SELECT attachment_ids FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d", $task_id));
	281	+ if(!empty($thread_attachment_ids)){
	282	+ foreach ($thread_attachment_ids as $thread_attachment_id){
	283	+ $attachment_ids_temp = array();
	284	+ if($thread_attachment_id->attachment_ids){
	285	+ $attachment_ids_temp = explode(',', $thread_attachment_id->attachment_ids);
	286	+ }
	287	+ foreach ($attachment_ids_temp as $attachment_id){
	288	+ $attachment_id = absint($attachment_id);
	289	+ $result = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id = %d", $attachment_id));
	290	+ if(!empty($result)){
	291	+ $attach_result = $wpdb->get_results($wpdb->prepare("SELECT file_path FROM {$wpdb->prefix}wppm_attachments WHERE file_path = %s", $result->file_path));
	292	+ if(file_exists($result->file_path) && count($attach_result) < 2){
	293	+ wp_delete_file($result->file_path);
	294	+ }
	295	+ $wpdb->delete($wpdb->prefix.'wppm_attachments', array('id' => $attachment_id));
	296	+ }
	297	+ }
	298	+ }
	299	+ }
	300	+ $checklists = $wpdb->get_results($wpdb->prepare("SELECT id FROM {$wpdb->prefix}wppm_checklist WHERE task_id = %d", $task_id));
	301	+ if(!empty($checklists)){
	302	+ foreach($checklists as $checklist){
	303	+ $checklist_id = absint($checklist->id);
	304	+ $wpdb->delete($wpdb->prefix.'wppm_checklist_items', array('checklist_id'=>$checklist_id));
	305	+ $wpdb->delete($wpdb->prefix.'wppm_checklist', array('id'=>$checklist_id));
	306	+ }
	307	+ }
	308	+ $wpdb->delete($wpdb->prefix.'wppm_task', array('id'=>$task_id));
	309	+ $wpdb->delete($wpdb->prefix.'wppm_task_meta', array('task_id'=>$task_id));
	310	+ $wpdb->delete($wpdb->prefix.'wppm_task_comment', array('task_id'=>$task_id));
	311	+ $wpdb->delete($wpdb->prefix.'wppm_task_comment_meta', array('task_id'=>$task_id));
	312	+ do_action('wppm_after_delete_task', $task_id);
	313	+ }
	314	+
190	315	public function get_project($project_id){
191	316	global $wpdb;
192	317	$project_data = array();
193		- $project_id = esc_sql($project_id);
194		- $project = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project WHERE id='$project_id' ");
	318	+ $project_id = absint($project_id);
	319	+ $project = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
195	320	if( $project ){
196		- $project_data = json_decode(json_encode($project), true);
	321	+ $project_data = json_decode(wp_json_encode($project), true);
197	322	}
198	323	return $project_data;
199	324	}
200	325
		@@ -200,12 +325,12 @@
200	325
201	326	public function get_attachment($attachment_id){
202	327	global $wpdb;
203	328	$attachment_data = array();
204		- $attachment_id = esc_sql($attachment_id);
205		- $attachment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id='$attachment_id' ");
	329	+ $attachment_id = absint($attachment_id);
	330	+ $attachment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_attachments WHERE id = %d", $attachment_id));
206	331	if( $attachment ){
207		- $attachment_data = json_decode(json_encode($attachment), true);
	332	+ $attachment_data = json_decode(wp_json_encode($attachment), true);
208	333	}
209	334	return $attachment_data;
210	335	}
211	336
		@@ -210,9 +335,9 @@
210	335	}
211	336
212	337	public function has_permission($permission, $task_id){
213	338	global $current_user,$wppmfunction,$wpdb;
214		- $task_id = esc_sql($task_id);
	339	+ $task_id = absint($task_id);
215	340	$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
216	341	$wppm_edit_tasks_permission = get_option('wppm_default_edit_tasks_permission');
217	342	$wppm_allow_coworkers_add_checklist = get_option('wppm_allow_coworkers_add_checklist');
218	343	$wppm_allow_coworkers_create_task = get_option('wppm_allow_coworkers_create_task');
		@@ -220,19 +345,19 @@
220	345	$wppm_allow_coworkers_assign_users = get_option('wppm_allow_coworkers_assign_users');
221	346	if(empty($comment_id)){
222	347	$comment_id = 0;
223	348	}
224		- $comment_id = esc_sql($comment_id);
	349	+ $comment_id = absint($comment_id);
225	350	$task_data = $wppmfunction->get_task($task_id);
226		- $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = '$task_id' AND id = '$comment_id'");
	351	+ $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d AND id = %d", $task_id, $comment_id));
227	352
228	353	if(!empty($task_data['project'])){
229	354	$project_id = $task_data['project'];
230		- $project_id = esc_sql($project_id);
	355	+ $project_id = absint($project_id);
231	356	$project_data = $wppmfunction->get_project($project_id);
232		- $cu_user_id = esc_sql($current_user->ID);
233		- $project_user_role = $wpdb->get_var("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = '$project_id' AND user_id = ' $cu_user_id'");
234		- $project_users = $wpdb->get_var("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = '$project_id'");
	357	+ $cu_user_id = absint($current_user->ID);
	358	+ $project_user_role = $wpdb->get_var($wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_user_id));
	359	+ $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
235	360	$project_users_arr = explode(',',(string)$project_users);
236	361	}
237	362	$response = false;
238	363	$flag = false;
		@@ -248,11 +373,14 @@
248	373	}
249	374	if(!empty($project_data) && $project_data['created_by']==$current_user->ID && $wppm_current_user_capability=='wppm_manager'){
250	375	$flag = true;
251	376	}
	377	+ if($current_user->has_cap('manage_options')){
	378	+ $flag = true;
	379	+ }
252	380	if(!empty($project_id)){
253		- $project_id = esc_sql($project_id);
254		- $public_proj_meta = $wpdb->get_var( "SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta where project_id= '$project_id' AND meta_key='public_project'");
	381	+ $project_id = absint($project_id);
	382	+ $public_proj_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta where project_id= %d AND meta_key='public_project'", $project_id));
255	383	}else{
256	384	$public_proj_meta ="";
257	385	}
258	386	switch ($permission) {
		@@ -290,10 +418,10 @@
290	418	}
291	419
292	420	public function has_comment_permission($permission, $task_id,$comment_id){
293	421	global $current_user,$wppmfunction,$wpdb;
294		- $task_id = esc_sql($task_id);
295		- $comment_id = esc_sql( $comment_id );
	422	+ $task_id = absint($task_id);
	423	+ $comment_id = absint($comment_id);
296	424	$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
297	425	if(empty($comment_id)){
298	426	$comment_id = 0;
299	427	}
		@@ -298,17 +426,17 @@
298	426	$comment_id = 0;
299	427	}
300	428	$task_data = $wppmfunction->get_task($task_id);
301	429	$project_user = array();
302		- $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = '$task_id' AND id = '$comment_id'");
	430	+ $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE task_id = %d AND id = %d", $task_id, $comment_id));
303	431
304	432	if(isset($task_data['project'])){
305	433	$project_id = $task_data['project'];
306		- $project_id = esc_sql($project_id);
307		- $cu_id = esc_sql($current_user->ID);
	434	+ $project_id = absint($project_id);
	435	+ $cu_id = absint($current_user->ID);
308	436	$project_data = $wppmfunction->get_project($project_id);
309		- $project_user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = '$project_id' AND user_id = '$cu_id'");
310		- $project_users = $wpdb->get_var("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = '$project_id'");
	437	+ $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_id));
	438	+ $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
311	439	$project_users_arr = explode(',',(string)$project_users);
312	440	}
313	441	$response = false;
314	442	$flag = false;
		@@ -338,18 +466,18 @@
338	466
339	467	public function has_proj_comment_permission($permission, $proj_id,$comment_id){
340	468	global $current_user,$wppmfunction,$wpdb;
341	469	$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
342		- $proj_id = esc_sql($proj_id);
343		- $comment_id = esc_sql($comment_id);
344		- $cu_id = esc_sql($current_user->ID);
	470	+ $proj_id = absint($proj_id);
	471	+ $comment_id = absint($comment_id);
	472	+ $cu_id = absint($current_user->ID);
345	473	if(empty($comment_id)){
346	474	$comment_id = 0;
347	475	}
348		- $project_user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = '$proj_id' AND user_id = ' $cu_id '");
349		- $project_users = $wpdb->get_var("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = '$proj_id'");
	476	+ $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $proj_id, $cu_id));
	477	+ $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $proj_id));
350	478	$project_users_arr = explode(',',(string)$project_users);
351		- $proj_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE proj_id = '$proj_id' AND id = '$comment_id'");
	479	+ $proj_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE proj_id = %d AND id = %d", $proj_id, $comment_id));
352	480	$response = false;
353	481	$flag = false;
354	482	$project_data = $wppmfunction->get_project($proj_id);
355	483	if((!empty($project_user)) && ($project_user->role_id == 1) && in_array($current_user->ID,$project_users_arr)){
		@@ -372,12 +500,12 @@
372	500
373	501	public function has_project_permission($permission,$project_id){
374	502	global $current_user,$wppmfunction,$wpdb ;
375	503	$project_data = $wppmfunction->get_project($project_id);
376		- $project_id = esc_sql($project_id);
377		- $cu_id = esc_sql($current_user->ID);
378		- $project_user = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = ".esc_sql($project_id)." AND user_id = ".esc_sql($cu_id)."");
379		- $project_users = $wpdb->get_var("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = '$project_id'");
	504	+ $project_id = absint($project_id);
	505	+ $cu_id = absint($current_user->ID);
	506	+ $project_user = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $project_id, $cu_id));
	507	+ $project_users = $wpdb->get_var($wpdb->prepare("SELECT users FROM {$wpdb->prefix}wppm_project WHERE id = %d", $project_id));
380	508	$project_users_arr = explode(',',(string)$project_users);
381	509	$user = wp_get_current_user();
382	510	$wppm_current_user_capability = get_user_meta( $current_user->ID, 'wppm_capability', true );
383	511	if(!empty($project_data)){
		@@ -384,9 +512,9 @@
384	512	$co_worker = $project_data['users'];
385	513	$co_worker_array = explode(",",(string)$co_worker);
386	514	}
387	515	if(!empty($project_id)){
388		- $public_proj_meta = $wpdb->get_var( "SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta where project_id= '$project_id' AND meta_key='public_project'");
	516	+ $public_proj_meta = $wpdb->get_var( $wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta where project_id= %d AND meta_key='public_project'", $project_id));
389	517	}else{
390	518	$public_proj_meta ="";
391	519	}
392	520
		@@ -432,11 +560,11 @@
432	560
433	561	public function change_raised_by($task_id, $user_id){
434	562	global $wpdb;
435	563	$values=array(
436		- 'created_by'=>esc_sql($user_id)
	564	+ 'created_by'=>absint($user_id)
437	565	);
438		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	566	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
439	567	}
440	568
441	569	public function change_task_label($task_id, $task_label){
442	570	global $wpdb;
		@@ -442,50 +570,50 @@
442	570	global $wpdb;
443	571	$values=array(
444	572	'task_name'=>stripslashes($task_label)
445	573	);
446		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	574	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
447	575	}
448	576
449	577	public function change_task_project_label($task_id, $project_label){
450	578	global $wpdb;
451	579	$values=array(
452		- 'project'=>esc_sql($project_label)
	580	+ 'project'=>absint($project_label)
453	581	);
454		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	582	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
455	583	}
456	584
457	585	public function change_start_date($task_id, $task_start_date){
458	586	global $wpdb;
459	587	$values=array(
460		- 'start_date'=>esc_sql($task_start_date)
	588	+ 'start_date'=>$task_start_date
461	589	);
462		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	590	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
463	591	}
464	592
465	593	public function change_end_date($task_id, $task_end_date){
466	594	global $wpdb;
467	595	$values=array(
468		- 'end_date'=>esc_sql($task_end_date)
	596	+ 'end_date'=>$task_end_date
469	597	);
470		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	598	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
471	599	}
472	600
473	601	public function change_priority($task_id, $task_priority){
474	602	global $wpdb;
475	603	$values=array(
476		- 'priority'=>esc_sql($task_priority)
	604	+ 'priority'=>absint($task_priority)
477	605	);
478		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	606	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
479	607	}
480	608
481	609	public function change_description($task_id, $task_description){
482	610	global $wpdb;
483		- $task_description = wp_kses_post($task_description);
	611	+ $task_description = !empty($task_description) ? wp_kses_post($task_description) : '';
484	612	$values=array(
485	613	'description'=>$task_description
486	614	);
487		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	615	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
488	616	}
489	617
490	618	public function change_project($task_id,$proj_id){
491	619	global $wpdb,$wppmfunction;
		@@ -490,10 +618,10 @@
490	618	public function change_project($task_id,$proj_id){
491	619	global $wpdb,$wppmfunction;
492	620	$task_data = $wppmfunction->get_task($task_id);
493	621	$old_proj = $task_data['project'];
494		- $old_proj = esc_sql( $old_proj);
495		- $proj_id = esc_sql( $proj_id);
	622	+ $old_proj = absint( $old_proj);
	623	+ $proj_id = absint( $proj_id);
496	624	$project_data = $wppmfunction->get_project($proj_id);
497	625	$task_assign_users = $task_data['users'];
498	626	$tusers_array = array();
499	627	if(!empty($task_data['users'])){
		@@ -509,16 +637,16 @@
509	637	$wpdb->delete( $wpdb->prefix.'wppm_project_users', array( 'proj_id' => "$proj_id",'user_id'=>"$tuser") );
510	638	}
511	639	elseif(in_array($tuser,$project_users)){
512	640	$tusers_array[] = $tuser;
513		- $tuser = esc_sql($tuser);
514		- $sql = 'SELECT role_id FROM ' . $wpdb->prefix . 'wppm_project_users WHERE proj_id = ' . $old_proj .' AND user_id = '."$tuser";
	641	+ $tuser = absint($tuser);
	642	+ $sql = $wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $old_proj, $tuser);
515	643	$old_proj_user_role = $wpdb->get_var( $sql );
516		- $sql = 'SELECT role_id FROM ' . $wpdb->prefix . 'wppm_project_users WHERE proj_id = ' . $proj_id .' AND user_id = '."$tuser";
	644	+ $sql = $wpdb->prepare("SELECT role_id FROM {$wpdb->prefix}wppm_project_users WHERE proj_id = %d AND user_id = %d", $proj_id, $tuser);
517	645	$proj_users_role = $wpdb->get_var( $sql );
518	646	if(!empty( $old_proj_user_role) && $old_proj_user_role!=$proj_users_role){
519	647	$value=array(
520		- 'role_id'=>esc_sql($proj_users_role)
	648	+ 'role_id'=>absint($proj_users_role)
521	649	);
522	650	$wpdb->update($wpdb->prefix.'wppm_project_users', $value, array('proj_id'=>"$proj_id", 'user_id'=>"$tuser"));
523	651	}
524	652	}
		@@ -526,21 +654,21 @@
526	654	}
527	655	}
528	656	$tusers = implode(",",$tusers_array);
529	657	$values=array(
530		- 'project'=>esc_sql($proj_id),
531		- 'users'=>esc_sql($tusers)
	658	+ 'project'=>absint($proj_id),
	659	+ 'users'=>absint($tusers)
532	660	);
533		- $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>esc_sql($task_id)));
	661	+ $wpdb->update($wpdb->prefix.'wppm_task', $values, array('id'=>absint($task_id)));
534	662	}
535	663
536	664	public function get_task_comment($comment_id){
537	665	global $wpdb;
538	666	$task_comment_data = array();
539		- $comment_id = esc_sql($comment_id);
540		- $task_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE id='$comment_id' ");
	667	+ $comment_id = absint($comment_id);
	668	+ $task_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_comment WHERE id=%d", $comment_id));
541	669	if( $task_comment ){
542		- $task_comment_data = json_decode(json_encode($task_comment), true);
	670	+ $task_comment_data = json_decode(wp_json_encode($task_comment), true);
543	671	}
544	672	return $task_comment_data;
545	673	}
546	674
		@@ -546,12 +674,12 @@
546	674
547	675	public function get_proj_comment($comment_id){
548	676	global $wpdb;
549	677	$project_comment_data = array();
550		- $comment_id = esc_sql($comment_id);
551		- $project_comment = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE id='$comment_id' ");
	678	+ $comment_id = absint($comment_id);
	679	+ $project_comment = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_comment WHERE id=%d", $comment_id));
552	680	if( $project_comment ){
553		- $project_comment_data = json_decode(json_encode($project_comment), true);
	681	+ $project_comment_data = json_decode(wp_json_encode($project_comment), true);
554	682	}
555	683	return $project_comment_data;
556	684	}
557	685
		@@ -556,10 +684,10 @@
556	684	}
557	685
558	686	public function change_task_comment($comment_id,$comment_body){
559	687	global $wpdb;
560		- $comment_id = esc_sql($comment_id);
561		- $comment_body = wp_kses_post($comment_body);
	688	+ $comment_id = absint($comment_id);
	689	+ $comment_body = !empty($comment_body) ? wp_kses_post($comment_body) : '';
562	690	$values=array(
563	691	'body'=>$comment_body
564	692	);
565	693	$wpdb->update($wpdb->prefix.'wppm_task_comment', $values, array('id'=>"$comment_id"));
		@@ -566,10 +694,10 @@
566	694	}
567	695
568	696	public function change_proj_comment($comment_id,$comment_body){
569	697	global $wpdb;
570		- $comment_id = esc_sql($comment_id);
571		- $comment_body = wp_kses_post($comment_body);
	698	+ $comment_id = absint($comment_id);
	699	+ $comment_body = !empty($comment_body) ? wp_kses_post($comment_body) : '';
572	700	$values=array(
573	701	'body'=>$comment_body
574	702	);
575	703	$wpdb->update($wpdb->prefix.'wppm_project_comment', $values, array('id'=>"$comment_id"));
		@@ -576,9 +704,9 @@
576	704	}
577	705
578	706	public function change_project_label($project_id,$project_label){
579	707	global $wpdb;
580		- $project_id = esc_sql($project_id);
	708	+ $project_id = absint($project_id);
581	709	$values=array(
582	710	'project_name'=>esc_sql($project_label)
583	711	);
584	712	$wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
		@@ -585,9 +713,9 @@
585	713	}
586	714
587	715	public function change_project_start_date($project_id, $project_start_date){
588	716	global $wpdb;
589		- $project_id = esc_sql($project_id);
	717	+ $project_id = absint($project_id);
590	718	$project_start_date = esc_sql($project_start_date);
591	719	$values=array(
592	720	'start_date'=>$project_start_date
593	721	);
		@@ -595,9 +723,9 @@
595	723	}
596	724
597	725	public function change_project_end_date($project_id, $project_end_date){
598	726	global $wpdb;
599		- $project_id = esc_sql($project_id);
	727	+ $project_id = absint($project_id);
600	728	$project_end_date = esc_sql($project_end_date);
601	729	$values=array(
602	730	'end_date'=>$project_end_date
603	731	);
		@@ -605,10 +733,10 @@
605	733	}
606	734
607	735	public function change_category($project_id, $project_category){
608	736	global $wpdb;
609		- $project_id = esc_sql($project_id);
610		- $project_category = esc_sql($project_category);
	737	+ $project_id = absint($project_id);
	738	+ $project_category = absint($project_category);
611	739	$values=array(
612	740	'cat_id'=>$project_category
613	741	);
614	742	$wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
		@@ -615,11 +743,12 @@
615	743	}
616	744
617	745	public function change_project_description($project_id, $project_description){
618	746	global $wpdb;
619		- $project_id = esc_sql($project_id);
620		- $values=array(
621		- 'description'=>wp_kses_post($project_description)
	747	+ $project_id = absint($project_id);
	748	+ $project_description = (string) ( $project_description ?? '' );
	749	+ $values = array(
	750	+ 'description' => wp_kses_post( $project_description )
622	751	);
623	752	$wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
624	753	}
625	754
		@@ -627,14 +756,14 @@
627	756	global $wpdb,$wppmfunction,$current_user;
628	757	$change_status_value= array();
629	758	$proj_data = $wppmfunction->get_project($project_id);
630	759	$prev_status = $proj_data['status'];
631		- $cu_id = esc_sql($current_user->ID);
	760	+ $cu_id = absint($current_user->ID);
632	761	$values=array(
633		- 'status'=>esc_sql($status_id)
	762	+ 'status'=>absint($status_id)
634	763	);
635		- $project_id = esc_sql($project_id);
636		- $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
	764	+ $project_id = absint($project_id);
	765	+ $wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>$project_id));
637	766	$old_project_status_meta = $wppmfunction->get_project_meta($project_id,'old_project_status',true);
638	767	if(!empty($old_project_status_meta)){
639	768	$wppmfunction->delete_project_meta($project_id,'old_project_status');
640	769	}
		@@ -639,11 +768,11 @@
639	768	$wppmfunction->delete_project_meta($project_id,'old_project_status');
640	769	}
641	770	$change_status_value = array('prev_status'=>"$prev_status",'new_status'=>"$status_id");
642	771	$change_status_obj = serialize($change_status_value);
643		- $log_values = array('proj_id'=>"$project_id",'body'=>$change_status_obj,'attachment_ids'=>"",'create_time'=>date("Y-m-d h:i:sa"),'created_by'=>"$cu_id" );
	772	+ $log_values = array('proj_id'=>"$project_id",'body'=>$change_status_obj,'attachment_ids'=>"",'create_time'=>wp_date("Y-m-d h:i:sa"),'created_by'=>"$cu_id" );
644	773	$wpdb->insert($wpdb->prefix . 'wppm_project_comment',$log_values);
645		- $log_id = esc_sql($wpdb->insert_id);
	774	+ $log_id = absint($wpdb->insert_id);
646	775	$proj_log_values = array('proj_id'=>"$project_id",'comment_id'=>"$log_id",'comment_type'=>'change_proj_status');
647	776	$wpdb->insert($wpdb->prefix . 'wppm_project_comment_meta',$proj_log_values);
648	777	$wppmfunction->add_project_meta($project_id,'old_project_status',$prev_status);
649	778	do_action('wppm_set_change_project_status', $project_id, $status_id, $prev_status);
		@@ -651,9 +780,9 @@
651	780
652	781	public function change_project_raised_by($project_id, $user_id){
653	782	global $wpdb;
654	783	$values=array(
655		- 'created_by'=>esc_sql($user_id)
	784	+ 'created_by'=>absint($user_id)
656	785	);
657	786	$wpdb->update($wpdb->prefix.'wppm_project', $values, array('id'=>"$project_id"));
658	787	}
659	788
		@@ -659,16 +788,16 @@
659	788
660	789	// Email Notification types
661	790	public function get_email_notification_types(){
662	791	$notification_types = array(
663		- 'new_project'=>__('New Project','taskbuilder'),
664		- 'new_task'=>__('New Task','taskbuilder'),
665		- 'change_project_status' => __('Change Project Status','taskbuilder'),
666		- 'change_task_status' => __('Change Task Status','taskbuilder'),
667		- 'change_project_assign_users' => __('Change Project Assign Users','taskbuilder'),
668		- 'change_task_assign_users' => __('Change Task Assign Users','taskbuilder'),
669		- 'new_discussion' => __('New Comment','taskbuilder'),
670		- 'new_proj_discussion' =>__('New Project Comment','taskbuilder')
	792	+ 'new_project'=>esc_html__('New Project','taskbuilder'),
	793	+ 'new_task'=>esc_html__('New Task','taskbuilder'),
	794	+ 'change_project_status' => esc_html__('Change Project Status','taskbuilder'),
	795	+ 'change_task_status' => esc_html__('Change Task Status','taskbuilder'),
	796	+ 'change_project_assign_users' => esc_html__('Change Project Assign Users','taskbuilder'),
	797	+ 'change_task_assign_users' => esc_html__('Change Task Assign Users','taskbuilder'),
	798	+ 'new_discussion' => esc_html__('New Comment','taskbuilder'),
	799	+ 'new_proj_discussion' =>esc_html__('New Project Comment','taskbuilder')
671	800	);
672	801	return apply_filters('wppm_en_types',$notification_types);
673	802	}
674	803
		@@ -704,17 +833,17 @@
704	833	}
705	834
706	835	public function get_project_meta($project_id,$meta_key,$flag = false){
707	836	global $wpdb,$wppmfunction;
708		- $project_id = esc_sql($project_id);
	837	+ $project_id = absint($project_id);
709	838	$meta_key = esc_sql($meta_key);
710	839	if($flag){
711		- $get_meta = $wpdb->get_var("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = '$meta_key' ");
	840	+ $get_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
712	841	$project_meta = isset($get_meta) ? stripslashes($get_meta) : '';
713	842
714	843	} else {
715	844	$project_meta = array();
716		- $results = $wpdb->get_results("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = '$meta_key'");
	845	+ $results = $wpdb->get_results($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
717	846	if( (!empty($results)) ){
718	847	foreach ($results as $result) {
719	848	if(!empty($result)){
720	849	$project_meta[]= stripslashes($result->meta_value);
		@@ -726,17 +855,17 @@
726	855	}
727	856
728	857	public function get_task_meta($task_id,$meta_key,$flag = false){
729	858	global $wpdb,$wppmfunction;
730		- $task_id = esc_sql($task_id);
	859	+ $task_id = absint($task_id);
731	860	$meta_key = esc_sql($meta_key);
732	861	if($flag){
733		- $get_meta = $wpdb->get_var("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = '$meta_key' ");
	862	+ $get_meta = $wpdb->get_var($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
734	863	$task_meta = isset($get_meta) ? stripslashes($get_meta) : '';
735	864
736	865	} else {
737	866	$task_meta = array();
738		- $results = $wpdb->get_results("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = '$meta_key'");
	867	+ $results = $wpdb->get_results($wpdb->prepare("SELECT meta_value FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
739	868	if( (!empty($results)) ){
740	869	foreach ($results as $result) {
741	870	if(!empty($result)){
742	871	$task_meta[]= stripslashes($result->meta_value);
		@@ -799,11 +928,11 @@
799	928	* Update project meta for project
800	929	*/
801	930	function update_project_meta($project_id ,$meta_key ,$meta_value){
802	931	global $wpdb;
803		- $project_id = esc_sql($project_id);
	932	+ $project_id = absint($project_id);
804	933	$meta_key = esc_sql($meta_key);
805		- $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = '$project_id' AND meta_key = '$meta_key'");
	934	+ $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_project_meta WHERE project_id = %d AND meta_key = %s",$project_id,$meta_key));
806	935	$wpdb->update($wpdb->prefix.'wppm_project_meta', $meta_value, array('project_id'=>$project_id,'meta_key' => "$meta_key"));
807	936	}
808	937
809	938	/**
		@@ -810,25 +939,25 @@
810	939	* Update task meta for task
811	940	*/
812	941	function update_task_meta($task_id ,$meta_key ,$meta_value){
813	942	global $wpdb;
814		- $task_id = esc_sql($task_id);
	943	+ $task_id = absint($task_id);
815	944	$meta_key = esc_sql($meta_key);
816		- $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = '$task_id' AND meta_key = '$meta_key'");
817		- $wpdb->update($wpdb->prefix.'wppm_task_meta', $meta_value, array('task_id'=>"$task_id",'meta_key' => "$meta_key"));
	945	+ $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wppm_task_meta WHERE task_id = %d AND meta_key = %s",$task_id,$meta_key));
	946	+ $wpdb->update($wpdb->prefix.'wppm_task_meta', $meta_value, array('task_id'=>$task_id,'meta_key' => "$meta_key"));
818	947	}
819	948
820	949	function delete_project_meta($project_id ,$meta_key){
821	950	global $wpdb;
822		- $project_id = esc_sql($project_id);
823		- $meta_key = esc_sql($meta_key);
	951	+ $project_id = absint($project_id);
	952	+ $meta_key = ($meta_key);
824	953	$wpdb->delete( $wpdb->prefix.'wppm_project_meta', array( 'project_id' => "$project_id",'meta_key'=>"$meta_key") );
825	954	}
826	955
827	956	function delete_task_meta($task_id ,$meta_key){
828	957	global $wpdb;
829		- $task_id = esc_sql($task_id);
830		- $meta_key = esc_sql($meta_key);
	958	+ $task_id = absint($task_id);
	959	+ $meta_key = ($meta_key);
831	960	$wpdb->delete( $wpdb->prefix.'wppm_task_meta', array( 'task_id' => "$task_id",'meta_key'=>"$meta_key") );
832	961	}
833	962
834	963	public function replace_macro($str,$project_id){
		@@ -843,17 +972,17 @@
843	972
844	973	public function get_old_project_status_name($id){
845	974	global $wppmfunction, $wpdb;
846	975	$old_project_status = $wppmfunction->get_project_meta($id,'old_project_status',true);
847		- $old_project_status = esc_sql($old_project_status);
848		- $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id ='$old_project_status'");
	976	+ $old_project_status = absint($old_project_status);
	977	+ $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id = %d",$old_project_status));
849	978	return $status_name;
850	979	}
851	980
852	981	public function get_new_project_status_name($status_id){
853	982	global $wpdb;
854		- $status_id = esc_sql($status_id);
855		- $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id ='$status_id'");
	983	+ $status_id = absint($status_id);
	984	+ $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_statuses WHERE id = %d",$status_id));
856	985	return $status_name;
857	986	}
858	987
859	988	public function get_old_task_status_name($task_id){
		@@ -858,25 +987,25 @@
858	987
859	988	public function get_old_task_status_name($task_id){
860	989	global $wppmfunction, $wpdb;
861	990	$old_task_status = $wppmfunction->get_task_meta($task_id,'old_task_status',true);
862		- $old_task_status = esc_sql($old_task_status);
863		- $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id ='$old_task_status'");
	991	+ $old_task_status = absint($old_task_status);
	992	+ $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id = %d",$old_task_status));
864	993	return $status_name;
865	994	}
866	995
867	996	public function get_new_task_status_name($status_id){
868	997	global $wpdb;
869		- $status_id = esc_sql($status_id);
870		- $status_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id ='$status_id'");
	998	+ $status_id = absint($status_id);
	999	+ $status_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_statuses WHERE id = %d",$status_id));
871	1000	return $status_name;
872	1001	}
873	1002
874	1003	public function get_project_category_name($cat_id){
875	1004	global $wpdb;
876		- $cat_id = esc_sql($cat_id);
	1005	+ $cat_id = absint($cat_id);
877	1006	if(!empty($cat_id)){
878		- $cat_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_project_categories WHERE id ='$cat_id'");
	1007	+ $cat_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_project_categories WHERE id = %d",$cat_id));
879	1008	}else{
880	1009	$cat_name = "";
881	1010	}
882	1011	return $cat_name;
		@@ -953,17 +1082,17 @@
953	1082	}
954	1083
955	1084	public function get_task_priority_name($priority){
956	1085	global $wpdb;
957		- $priority = esc_sql($priority);
958		- $priority_name = $wpdb->get_var("SELECT name FROM {$wpdb->prefix}wppm_task_priorities WHERE id ='$priority'");
	1086	+ $priority = absint($priority);
	1087	+ $priority_name = $wpdb->get_var($wpdb->prepare("SELECT name FROM {$wpdb->prefix}wppm_task_priorities WHERE id = %d",$priority));
959	1088	return $priority_name;
960	1089	}
961	1090
962	1091	public function get_last_comment_user_name($task_id){
963	1092	global $wpdb;
964		- $task_id = esc_sql($task_id);
965		- $task_comment_creator = $wpdb->get_var("SELECT created_by FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = '$task_id')");
	1093	+ $task_id = absint($task_id);
	1094	+ $task_comment_creator = $wpdb->get_var($wpdb->prepare("SELECT created_by FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = %d)",$task_id));
966	1095	if(!empty($task_comment_creator)){
967	1096	$user = get_userdata( $task_comment_creator );
968	1097	return $user->display_name;
969	1098	}
		@@ -970,21 +1099,21 @@
970	1099	}
971	1100
972	1101	public function get_last_comment_body($task_id){
973	1102	global $wpdb;
974		- $task_id = esc_sql($task_id);
975		- $task_comment = $wpdb->get_var("SELECT body FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = '$task_id')");
	1103	+ $task_id = absint($task_id);
	1104	+ $task_comment = $wpdb->get_var($wpdb->prepare("SELECT body FROM {$wpdb->prefix}wppm_task_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_task_comment) AND task_id = %d)",$task_id));
976	1105	return $task_comment;
977	1106	}
978	1107
979		- public function create_duplicate_task($ptask_id, $project_id,$ajax_nonce){
	1108	+ public function create_duplicate_task($ptask_id, $project_id,$internal_code_flag=false){
980	1109	include WPPM_ABSPATH . 'includes/admin/tasks/open_task/wppm_set_clone_task.php';
981	1110	}
982	1111
983	1112	public function get_last_comment_proj_user_name($project_id){
984	1113	global $wpdb;
985		- $project_id = esc_sql($project_id);
986		- $proj_comment_creator = $wpdb->get_var("SELECT created_by FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = '$project_id')");
	1114	+ $project_id = absint($project_id);
	1115	+ $proj_comment_creator = $wpdb->get_var($wpdb->prepare("SELECT created_by FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = %d)",$project_id));
987	1116	if(!empty($proj_comment_creator)){
988	1117	$user = get_userdata( $proj_comment_creator );
989	1118	return $user->display_name;
990	1119	}
		@@ -991,16 +1120,16 @@
991	1120	}
992	1121
993	1122	public function get_proj_comment_body($project_id){
994	1123	global $wpdb;
995		- $project_id = esc_sql($project_id);
996		- $proj_comment = $wpdb->get_var("SELECT body FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = '$project_id')");
	1124	+ $project_id = absint($project_id);
	1125	+ $proj_comment = $wpdb->get_var($wpdb->prepare("SELECT body FROM {$wpdb->prefix}wppm_project_comment WHERE (id=(select MAX(id) from {$wpdb->prefix}wppm_project_comment) AND proj_id = %d)",$project_id));
997	1126	return $proj_comment;
998	1127	}
999	1128
1000	1129	public function get_project_url($project_id, $view){
1001	1130	global $wpdb,$wppmfunction;
1002		- $project_id = esc_sql($project_id);
	1131	+ $project_id = absint($project_id);
1003	1132	$page_settings = get_option( 'wppm-page-settings' );
1004	1133	if ( $view == '0' ) {
1005	1134	$url = admin_url( 'admin.php?page=wppm-projects&section=project-list&id=' . $project_id );
1006	1135	} else {
		@@ -1021,9 +1150,9 @@
1021	1150	}
1022	1151
1023	1152	public function get_task_url($task_id, $view){
1024	1153	global $wpdb,$wppmfunction;
1025		- $task_id = esc_sql($task_id);
	1154	+ $task_id = absint($task_id);
1026	1155	$page_settings = get_option( 'wppm-page-settings' );
1027	1156	if ( $view == '0' ) {
1028	1157	$url = admin_url( 'admin.php?page=wppm-tasks&section=task-list&id=' . $task_id );
1029	1158	} else{
		@@ -1044,12 +1173,12 @@
1044	1173
1045	1174	public function wppm_user_role(){
1046	1175	$user_role = array(
1047	1176	'wppm_admin' => array(
1048		- 'label' => __('WPPM Administrator','taskbuilder'),
	1177	+ 'label' => esc_html__('WPPM Administrator','taskbuilder'),
1049	1178	),
1050	1179	'wppm_manager' => array(
1051		- 'label' => __('WPPM Manager','taskbuilder'),
	1180	+ 'label' => esc_html__('WPPM Manager','taskbuilder'),
1052	1181	)
1053	1182	);
1054	1183	return $user_role;
1055	1184	}
		@@ -1163,8 +1292,101 @@
1163	1292	if ($minutes > 0 || empty($duration)) $duration[] = $minutes . 'm';
1164	1293
1165	1294	return implode(' ', $duration);
1166	1295
	1296	+ }
	1297	+
	1298	+ public function wppm_highlight_user_mentions($content, $current_user_id) {
	1299	+
	1300	+ return preg_replace_callback(
	1301	+ '/<span[^>]*class="wppm-mention"[^>]*data-user-id="(\d+)"[^>]*>(.*?)<\/span>/is',
	1302	+ function($matches) use ($current_user_id) {
	1303	+
	1304	+ $user_id = intval($matches[1]);
	1305	+ $text = $matches[2];
	1306	+
	1307	+ // already processed → skip
	1308	+ if (strpos($matches[0], 'wppm-mention-me') !== false) {
	1309	+ return $matches[0];
	1310	+ }
	1311	+
	1312	+ if ($user_id === $current_user_id) {
	1313	+ return '<span class="wppm-mention wppm-mention-me" data-user-id="' . esc_attr($user_id) . '">' . $text . '</span>';
	1314	+ }
	1315	+
	1316	+ return '<span class="wppm-mention" data-user-id="' . esc_attr($user_id) . '">' . $text . '</span>';
	1317	+ },
	1318	+ $content
	1319	+ );
	1320	+ }
	1321	+ function wppm_clean_mentions_html($content) {
	1322	+ // Remove dropdown items
	1323	+ $content = preg_replace('/<div[^>]*class="mention-item"[^>]*>.*?<\/div>/is', '', $content);
	1324	+
	1325	+ // Remove mention dropdown container
	1326	+ $content = preg_replace('/<div[^>]*id="wppm_mention_list"[^>]*>.*?<\/div>/is', '', $content);
	1327	+
	1328	+ return $content;
	1329	+ }
	1330	+
	1331	+ function wppm_extract_mentions($comment) {
	1332	+ preg_match_all('/data-user-id="(\d+)"/', $comment, $matches);
	1333	+ return $matches[1];
	1334	+ }
	1335	+
	1336	+ function wppm_get_users_from_mentions($user_ids) {
	1337	+ $users = [];
	1338	+ foreach ($user_ids as $user_id) {
	1339	+ $user = get_user_by('id', intval($user_id));
	1340	+ if ($user) {
	1341	+ $users[] = $user;
	1342	+ }
	1343	+ }
	1344	+ return $users;
	1345	+ }
	1346	+
	1347	+ function wppm_send_mention_email($email_addresses, $comment, $task_id) {
	1348	+ $page_setting = get_option('wppm-page-settings');
	1349	+ $from_name = get_option('wppm_en_from_name');
	1350	+ $from_email = get_option('wppm_en_from_email');
	1351	+ $view = $page_setting['task-url-page'];
	1352	+ $subject = esc_html__("You were mentioned in a comment", "taskbuilder");
	1353	+ $to = isset($email_addresses[0]) ? $email_addresses[0] : '';
	1354	+ if (!$to) {
	1355	+ return;
	1356	+ }
	1357	+ unset($email_addresses[0]);
	1358	+ $headers = "From: {$from_name} <{$from_email}>\r\n";
	1359	+ foreach ($email_addresses as $email_address) {
	1360	+ $headers .= "BCC: {$email_address}\r\n";
	1361	+ }
	1362	+ $headers .= "Content-Type: text/html; charset=UTF-8\r\n";
	1363	+ $task_url = $this->get_task_url($task_id, $view);
	1364	+ $message = esc_html__("Hello,", "taskbuilder");
	1365	+ $message .= "<br><br>";
	1366	+ $message .= esc_html__("You were mentioned in a comment:", "taskbuilder");
	1367	+ $message .= "<br><br>";
	1368	+ $message .= nl2br(esc_html(strip_tags($comment)));
	1369	+ $message .= "<br><br>";
	1370	+ $message .= esc_html__("View Task:", "taskbuilder") . " ";
	1371	+ $message .= '<a class="wppm_link" href="' . esc_url($task_url) . '" target="_blank">' . esc_html__("View Task", "taskbuilder") . '</a>';
	1372	+ wp_mail($to, $subject, $message, $headers);
	1373	+ do_action('wppm_after_sent_mention_mail', $email_addresses, $comment, $task_id);
	1374	+ }
	1375	+
	1376	+ function wppm_insert_notification($user_id, $message, $link,$is_read,$type) {
	1377	+ global $wpdb;
	1378	+ $wpdb->insert(
	1379	+ $wpdb->prefix . 'wppm_notifications',
	1380	+ [
	1381	+ 'user_id' => $user_id,
	1382	+ 'message' => $message,
	1383	+ 'link' => $link,
	1384	+ 'is_read' => $is_read,
	1385	+ 'notification_type'=>$type,
	1386	+ 'created_at' => current_time('mysql')
	1387	+ ]
	1388	+ );
1167	1389	}
1168	1390	}
1169	1391	endif;
1170	1392	$GLOBALS['wppmfunction'] = new WPPM_Functions();