← All changes | classes/orderList.class.php +45 -15 2.11.30 → 2.12.4 View file →

		@@ -40,8 +40,9 @@
40	40	var $startdate;
41	41	var $enddate;
42	42
43	43	public $listOption;
	44	+ public $cookie_key;
44	45	public $totalRow;
45	46	public $selectedRow;
46	47	public $headers;
47	48
		@@ -51,12 +52,17 @@
51	52	* @param string $tableName Table name.
52	53	* @param array $arr_column Column.
53	54	*/
54	55	public function __construct( $tableName, $arr_column ) {
	56	+ global $wpdb;
55	57	$this->table = $tableName;
56	58	$this->columns = $arr_column;
57	59	$this->rows = array();
58	60
	61	+ // 旧受注リストは新受注リスト(WlcOrderList)と同じ Cookie キーを共有すると, 検索条件やページング状態が
	62	+ // 混在して警告や表示崩れの原因になる. 受注リストのみ専用の Cookie キーを使い, 状態を完全に分離する.
	63	+ $this->cookie_key = ( $wpdb->prefix . 'usces_order' === $this->table ) ? $this->table . '_old' : $this->table;
	64	+
59	65	$this->maxRow = apply_filters( 'usces_filter_orderlist_maxrow', 30 );
60	66	$this->naviMaxButton = 11;
61	67	$this->firstPage = 1;
62	68	$this->action_status = 'none';
		@@ -262,15 +268,21 @@
262	268	$this->arr_search = apply_filters( 'usces_filter_order_list_arr_search', $arr_search, $this );
263	269	}
264	270	if ( isset( $this->data_cookie['sortSwitchs'] ) ) {
265	271	$this->sortSwitchs = $this->data_cookie['sortSwitchs'];
	272	+ foreach ( $this->columns as $key => $value ) {
	273	+ if ( ! isset( $this->sortSwitchs[ $value ] ) ) {
	274	+ $this->sortSwitchs[ $value ] = 'DESC';
	275	+ }
	276	+ }
266	277	} else {
267	278	foreach ( $this->columns as $key => $value ) {
268	279	$this->sortSwitchs[ $value ] = 'DESC';
269	280	}
270	281	}
271		- $this->startdate = ( isset( $_REQUEST['startdate'] ) ) ? $_REQUEST['startdate'] : ( ( isset( $this->data_cookie['startdate'] ) ) ? $this->data_cookie['startdate'] : '' );
272		- $this->enddate = ( isset( $_REQUEST['enddate'] ) ) ? $_REQUEST['enddate'] : ( ( isset( $this->data_cookie['enddate'] ) ) ? $this->data_cookie['enddate'] : '' );
	282	+ // startdate / enddate は画面のフォーム value や JS へ出力される. 書式外を空に落とし, 反映型 XSS を防ぐ.
	283	+ $this->startdate = $this->sanitize_search_date( ( isset( $_REQUEST['startdate'] ) ) ? $_REQUEST['startdate'] : ( ( isset( $this->data_cookie['startdate'] ) ) ? $this->data_cookie['startdate'] : '' ) );
	284	+ $this->enddate = $this->sanitize_search_date( ( isset( $_REQUEST['enddate'] ) ) ? $_REQUEST['enddate'] : ( ( isset( $this->data_cookie['enddate'] ) ) ? $this->data_cookie['enddate'] : '' ) );
273	285	$this->SetTotalRow();
274	286	}
275	287
276	288	/**
		@@ -405,17 +417,17 @@
405	417	* Validation Search Parameters.
406	418	*/
407	419	public function validationSearchParameters() {
408	420	$default_sku_columns = [ 'item_code', 'item_name' ];
409		- if ( 'none' != $this->arr_search['column'] && ! in_array( $this->arr_search['column'], $this->columns ) ) {
410		- if ( is_array( $this->arr_search['word'] ) && count( $this->arr_search['word'] ) && in_array( $key = key( $this->arr_search['word'] ), $this->columns ) ) {
	421	+ if ( ! empty( $this->arr_search['column'] ) && 'none' != $this->arr_search['column'] && ! in_array( $this->arr_search['column'], $this->columns ) ) {
	422	+ if ( ! empty( $this->arr_search['word'] ) && is_array( $this->arr_search['word'] ) && count( $this->arr_search['word'] ) && in_array( $key = key( $this->arr_search['word'] ), $this->columns ) ) {
411	423	$this->arr_search['column'] = $key;
412	424	} else {
413	425	$this->arr_search['column'] = 'none';
414	426	}
415	427	}
416		- if ( 'none' != $this->arr_search['sku'] && ! in_array( $this->arr_search['sku'], $default_sku_columns ) ) {
417		- if ( is_array( $this->arr_search['skuword'] ) && count( $this->arr_search['skuword'] ) && in_array( $key = key( $this->arr_search['skuword'] ), $default_sku_columns ) ) {
	428	+ if ( ! empty( $this->arr_search['sku'] ) && 'none' != $this->arr_search['sku'] && ! in_array( $this->arr_search['sku'], $default_sku_columns ) ) {
	429	+ if ( ! empty( $this->arr_search['skuword'] ) && is_array( $this->arr_search['skuword'] ) && count( $this->arr_search['skuword'] ) && in_array( $key = key( $this->arr_search['skuword'] ), $default_sku_columns ) ) {
418	430	$this->arr_search['sku'] = $key;
419	431	} else {
420	432	$this->arr_search['sku'] = 'none';
421	433	}
		@@ -479,8 +491,26 @@
479	491	return str_replace( $this->placeholder_escape, '%', $query );
480	492	}
481	493
482	494	/**
	495	+ * 期間検索の日付をサニタイズする
	496	+ *
	497	+ * リクエストまたは検索条件 Cookie 由来の startdate / enddate は、
	498	+ * WHERE 句へ文字列連結される. 書式に合わない値は空文字に落とし、
	499	+ * 「日付指定なし」として扱う.
	500	+ *
	501	+ * @param mixed $date Date string.
	502	+ * @return string
	503	+ */
	504	+ private function sanitize_search_date( $date ) {
	505	+ if ( ! is_scalar( $date ) ) {
	506	+ return '';
	507	+ }
	508	+ $date = trim( (string) $date );
	509	+ return ( preg_match( '/^\d{4}-\d{2}-\d{2}$/', $date ) ) ? $date : '';
	510	+ }
	511	+
	512	+ /**
483	513	* Set Total Rows.
484	514	*/
485	515	public function SetTotalRow() {
486	516	global $wpdb;
		@@ -486,17 +516,17 @@
486	516	global $wpdb;
487	517	$where = '';
488	518	if ( $this->period_specified_index == $this->arr_search['period'] ) {
489	519	if ( isset( $_REQUEST['startdate'] ) ) {
490		- $startdate = $_REQUEST['startdate'];
	520	+ $startdate = $this->sanitize_search_date( $_REQUEST['startdate'] );
491	521	} else {
492		- $startdate = $this->data_cookie['startdate'];
	522	+ $startdate = $this->sanitize_search_date( $this->data_cookie['startdate'] );
493	523	}
494	524
495	525	if ( isset( $_REQUEST['enddate'] ) ) {
496		- $enddate = $_REQUEST['enddate'];
	526	+ $enddate = $this->sanitize_search_date( $_REQUEST['enddate'] );
497	527	} else {
498		- $enddate = $this->data_cookie['enddate'];
	528	+ $enddate = $this->sanitize_search_date( $this->data_cookie['enddate'] );
499	529	}
500	530	if ( '' != $startdate || '' != $enddate ) {
501	531	if ( '' == $enddate ) {
502	532	$where = " WHERE order_date >= '{$startdate}'";
		@@ -525,17 +555,17 @@
525	555	$str = '';
526	556	$where = '';
527	557	if ( $this->period_specified_index == $this->arr_search['period'] ) {
528	558	if ( isset( $_REQUEST['startdate'] ) ) {
529		- $startdate = $_REQUEST['startdate'];
	559	+ $startdate = $this->sanitize_search_date( $_REQUEST['startdate'] );
530	560	} else {
531		- $startdate = $this->data_cookie['startdate'];
	561	+ $startdate = $this->sanitize_search_date( $this->data_cookie['startdate'] );
532	562	}
533	563
534	564	if ( isset( $_REQUEST['enddate'] ) ) {
535		- $enddate = $_REQUEST['enddate'];
	565	+ $enddate = $this->sanitize_search_date( $_REQUEST['enddate'] );
536	566	} else {
537		- $enddate = $this->data_cookie['enddate'];
	567	+ $enddate = $this->sanitize_search_date( $this->data_cookie['enddate'] );
538	568	}
539	569	if ( '' != $startdate || '' != $enddate ) {
540	570	if ( '' == $enddate ) {
541	571	$where = " WHERE order_date >= '{$startdate}'";
		@@ -742,9 +772,9 @@
742	772	/**
743	773	* Get Cookie.
744	774	*/
745	775	public function getCookie() {
746		- $this->data_cookie = ( isset( $_COOKIE[ $this->table ] ) ) ? json_decode( str_replace( "\'", "'", str_replace( '\"', '"', $_COOKIE[ $this->table ] ) ), true ) : array();
	776	+ $this->data_cookie = ( isset( $_COOKIE[ $this->cookie_key ] ) ) ? json_decode( str_replace( "\'", "'", str_replace( '\"', '"', $_COOKIE[ $this->cookie_key ] ) ), true ) : array();
747	777	}
748	778
749	779	/**
750	780	* Set Headers.