← All changes | classes/Visualizer/Source/Query.php +33 -8 3.10.15 → 3.11.7 View file →

		@@ -59,14 +59,31 @@
59	59	* @param int $chart_id The chart id.
60	60	* @param array $params Any additional parameters (e.g. for connecting to a remote db).
61	61	*/
62	62	public function __construct( $query = null, $chart_id = null, $params = null ) {
63		- $this->_query = $query;
	63	+ $this->_query = $this->strip_sql_comments( $query );
64	64	$this->_chart_id = $chart_id;
65	65	$this->_params = $params;
66	66	}
67	67
68	68	/**
	69	+ * Strips SQL comments from the query.
	70	+ *
	71	+ * @param string $query The query.
	72	+ *
	73	+ * @return string
	74	+ */
	75	+ private function strip_sql_comments( $query = '' ) {
	76	+ if ( empty( $query ) ) {
	77	+ return $query;
	78	+ }
	79	+
	80	+ // Regex https://regex101.com/r/xd5Vrg/1
	81	+ $sql_comments_regex = '@(--[^\r\n]*)|(\#[^\r\n]*)|(/\*[\w\W]*?(?=\*/)\*/)@ms';
	82	+ return trim( preg_replace( $sql_comments_regex, '', $query ) );
	83	+ }
	84	+
	85	+ /**
69	86	* Fetches information from source, parses it and builds series and data arrays.
70	87	*
71	88	* @param bool $as_html Should the result be fetched as an HTML table or as an object.
72	89	* @param bool $results_as_numeric_array Should the result be fetched as ARRAY_N instead of ARRAY_A.
		@@ -78,10 +95,10 @@
78	95	if ( empty( $this->_query ) ) {
79	96	return false;
80	97	}
81	98
82		- // only select queries allowed.
83		- if ( ! preg_match( '/\s*(\bselect\b)\s/i', $this->_query ) ) {
	99	+ // only select queries allowed. must start with SELECT keyword.
	100	+ if ( ! preg_match( '/^(\bselect\b)\s/i', $this->_query ) ) {
84	101	$this->_error = __( 'Only SELECT queries are allowed', 'visualizer' );
85	102	return false;
86	103	}
87	104
		@@ -86,16 +103,19 @@
86	103	}
87	104
88	105	// if previous check passed, check for disallowed query parts to prevent subqueries and other harmful queries.
89	106	$disallow_query_parts = array(
	107	+ 'CREATE',
	108	+ 'ALTER',
	109	+ 'TRUNCATE',
	110	+ 'DROP',
	111	+
90	112	'INSERT',
	113	+ 'DELETE',
91	114	'UPDATE',
92		- 'DELETE',
	115	+ 'REPLACE',
	116	+
93	117	'RENAME',
94		- 'DROP',
95		- 'CREATE',
96		- 'TRUNCATE',
97		- 'ALTER',
98	118	'COMMIT',
99	119	'ROLLBACK',
100	120	'MERGE',
101	121	'CALL',
		@@ -155,8 +175,13 @@
155	175	$wpdb->show_errors();
156	176
157	177	if ( $raw_results ) {
158	178	return $rows;
	179	+ }
	180	+
	181	+ if ( $wpdb->last_error ) {
	182	+ $this->_error = $wpdb->last_error;
	183	+ return [];
159	184	}
160	185
161	186	if ( $rows ) {
162	187	$results = array();