← All changes
|
includes/admin/tasks/open_task/wppm_edit_task_details.php
+30
-16
5.0.3
→
6.0.7
View file →
| @@ -3,23 +3,34 @@ | ||
| 3 | 3 | exit; // Exit if accessed directly |
| 4 | 4 | } |
| 5 | 5 | |
| 6 | 6 | global $wpdb,$wppmfunction,$current_user; |
| 7 | -$task_id = isset($_POST['task_id']) ? intval(sanitize_text_field($_POST['task_id'])) : '' ; | |
| 8 | -$proj_id = isset($_POST['proj_id']) ? intval(sanitize_text_field($_POST['proj_id'])) : '' ; | |
| 7 | +$task_id = isset($_POST['task_id']) ? intval(sanitize_text_field(wp_unslash($_POST['task_id']))) : '' ; | |
| 8 | +$proj_id = isset($_POST['proj_id']) ? intval(sanitize_text_field(wp_unslash($_POST['proj_id']))) : '' ; | |
| 9 | +$current_project_id = isset($_POST['project_id']) ? intval(sanitize_text_field(wp_unslash($_POST['project_id']))) : '' ; | |
| 9 | 10 | if (!(($current_user->ID && $current_user->has_cap('manage_options')) || $wppmfunction->has_permission('change_task_details',$task_id))) {exit;} |
| 10 | 11 | $task_data = $wppmfunction->get_task($task_id); |
| 11 | 12 | $settings = get_option("wppm-ap-modal"); |
| 12 | -$orderby_proj_sql = esc_sql(sanitize_sql_orderby( "project_name" )); | |
| 13 | +$orderby_proj_sql = (sanitize_sql_orderby( "project_name" )); | |
| 13 | 14 | $project_data = $wppmfunction->get_project(intval(sanitize_text_field($task_data['project']))); |
| 14 | 15 | if($current_user->has_cap('manage_options')){ |
| 15 | - $projects = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}wppm_project ORDER BY $orderby_proj_sql" ); | |
| 16 | + $projects = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wppm_project ORDER BY $orderby_proj_sql"); | |
| 16 | 17 | }else{ |
| 17 | - $query = ("SELECT Proj.* | |
| 18 | - FROM {$wpdb->prefix}wppm_project AS Proj | |
| 19 | - Left join {$wpdb->prefix}wppm_project_meta proj_meta ON Proj.id = proj_meta.project_id | |
| 20 | - where (FIND_IN_SET($current_user->ID,Proj.users)) OR (Proj.id = proj_meta.project_id AND proj_meta.meta_key='public_project' AND proj_meta.meta_value=1) Group by Proj.id ORDER BY $orderby_proj_sql"); | |
| 21 | - $projects = $wpdb->get_results($query); | |
| 18 | + $sql = $wpdb->prepare( | |
| 19 | + "SELECT Proj.* | |
| 20 | + FROM {$wpdb->prefix}wppm_project AS Proj | |
| 21 | + LEFT JOIN {$wpdb->prefix}wppm_project_meta AS proj_meta | |
| 22 | + ON Proj.id = proj_meta.project_id | |
| 23 | + WHERE FIND_IN_SET(%d, Proj.users) | |
| 24 | + OR (proj_meta.meta_key = 'public_project' AND proj_meta.meta_value = 1) | |
| 25 | + GROUP BY Proj.id", | |
| 26 | + $current_user->ID | |
| 27 | + ); | |
| 28 | +// 4️⃣ Append ORDER BY (safe because we whitelisted columns) | |
| 29 | +$sql .= " ORDER BY $orderby_proj_sql"; | |
| 30 | + | |
| 31 | +// 5️⃣ Execute | |
| 32 | +$projects = $wpdb->get_results($sql); | |
| 22 | 33 | } |
| 23 | 34 | $priority_id = sanitize_text_field($task_data['priority']); |
| 24 | 35 | $project_id = sanitize_text_field($task_data['project']); |
| 25 | 36 | |
| @@ -48,9 +59,9 @@ | ||
| 48 | 59 | <?php |
| 49 | 60 | if(!empty($projects)){ |
| 50 | 61 | foreach($projects as $proj) { |
| 51 | 62 | ?> |
| 52 | - <option <?php echo esc_attr($proj->id)==esc_attr($project_id) ?'selected="selected"':''?> value="<?php echo esc_attr($proj->id)?>"><?php echo esc_html_e($proj->project_name,'taskbuilder');?></option> | |
| 63 | + <option <?php echo esc_attr($proj->id)==esc_attr($project_id) ?'selected="selected"':''?> value="<?php echo esc_attr($proj->id)?>"><?php echo esc_html($proj->project_name);?></option> | |
| 53 | 64 | <?php } |
| 54 | 65 | } ?> |
| 55 | 66 | </select> |
| 56 | 67 | </div> |
| @@ -104,17 +115,19 @@ | ||
| 104 | 115 | </div> |
| 105 | 116 | <div class="row" style="padding-left:2px;"> |
| 106 | 117 | <div class="col-sm-12"> |
| 107 | 118 | <textarea id="wppm_edit_task_description" class="form-control" name="wppm_edit_task_description"> |
| 108 | - <?php echo isset($task_data['description']) ? stripslashes(htmlspecialchars_decode(esc_textarea($task_data['description']),ENT_QUOTES)) :""?> | |
| 119 | + <?php echo !empty($task_data['description']) ? wp_kses_post(wpautop($task_data['description'])) :""?> | |
| 109 | 120 | </textarea> |
| 110 | 121 | </div> |
| 111 | 122 | </div> |
| 112 | 123 | <?php do_action('wppm_edit_task_details',$task_id,$project_id);?> |
| 113 | 124 | <input type="hidden" name="action" value="wppm_set_change_task_details" /> |
| 114 | - <input type="hidden" name="_ajax_nonce" value="<?php echo wp_create_nonce('wppm_set_change_task_details')?>"> | |
| 125 | + <input type="hidden" name="_ajax_nonce" value="<?php echo esc_attr(wp_create_nonce('wppm_set_change_task_details'))?>"> | |
| 115 | 126 | <input type="hidden" name="user_id" id="user_id" value=""> |
| 116 | 127 | <input type="hidden" name="task_id" value="<?php echo esc_attr($task_id) ?>" /> |
| 128 | + <input type="hidden" name="proj_id" value="<?php echo esc_attr($proj_id) ?>" /> | |
| 129 | + <input type="hidden" name="project_id" value="<?php echo esc_attr($current_project_id) ?>" /> | |
| 117 | 130 | </form> |
| 118 | 131 | <style> |
| 119 | 132 | .select2-results__options { |
| 120 | 133 | color:<?php echo esc_attr( $settings['body-text-color'])?>!important; |
| @@ -125,13 +138,14 @@ | ||
| 125 | 138 | wppm_select_project(); |
| 126 | 139 | jQuery("#wppm_edit_task_start_date").flatpickr({ |
| 127 | 140 | enableTime: true, |
| 128 | 141 | dateFormat: "Y-m-d H:i", |
| 142 | + defaultDate: "today" | |
| 129 | 143 | }); |
| 130 | 144 | jQuery("#wppm_edit_task_end_date").flatpickr({ |
| 131 | 145 | enableTime: true, |
| 132 | - dateFormat: "Y-m-d H:i" | |
| 133 | - //minDate: startdate | |
| 146 | + dateFormat: "Y-m-d H:i", | |
| 147 | + defaultDate: "today" // | |
| 134 | 148 | }); |
| 135 | 149 | tinymce.remove(); |
| 136 | 150 | tinymce.init({ |
| 137 | 151 | selector:'#wppm_edit_task_description', |
| @@ -174,9 +188,9 @@ | ||
| 174 | 188 | |
| 175 | 189 | ob_start(); |
| 176 | 190 | ?> |
| 177 | 191 | <button type="button" class="btn <?php echo ($proj_id!="0") ? 'wppm_popup_close': 'wppm_task_popup_close' ?> " onclick="<?php echo ($proj_id!=0) ? "wppm_modal_close()":"wppm_task_modal_close()"?>"><?php echo esc_html_e('Close','taskbuilder');?></button> |
| 178 | -<button type="button" class="btn <?php echo ($proj_id!="0") ? 'wppm_popup_action': 'wppm_task_popup_action' ?> " onclick="wppm_set_change_task_details(<?php echo esc_attr($task_id)?>,<?php echo esc_attr($proj_id) ?>);"><?php echo esc_html_e('Save','taskbuilder');?></button> | |
| 192 | +<button type="button" class="btn <?php echo ($proj_id!="0") ? 'wppm_popup_action': 'wppm_task_popup_action' ?> " onclick="wppm_set_change_task_details(<?php echo esc_attr($task_id)?>,<?php echo esc_attr($proj_id) ?>,<?php echo esc_attr($current_project_id) ?>);"><?php echo esc_html_e('Save','taskbuilder');?></button> | |
| 179 | 193 | <?php |
| 180 | 194 | $footer = ob_get_clean(); |
| 181 | 195 | |
| 182 | 196 | $output = array( |
| @@ -182,6 +196,6 @@ | ||
| 182 | 196 | $output = array( |
| 183 | 197 | 'body' => $body, |
| 184 | 198 | 'footer' => $footer |
| 185 | 199 | ); |
| 186 | -echo json_encode($output); | |
| 200 | +echo wp_json_encode( $output ); | |
| 187 | 201 | ?> |