← All changes | classes/Visualizer/Source/Query.php +33 -113 3.10.14 → 3.3.4 View file →

		@@ -35,35 +35,15 @@
35	35	*/
36	36	protected $_query;
37	37
38	38	/**
39		- * The chart id.
40		- *
41		- * @access protected
42		- * @var int
43		- */
44		- protected $_chart_id;
45		-
46		- /**
47		- * Any additional parameters (e.g. for connecting to a remote db).
48		- *
49		- * @access protected
50		- * @var array
51		- */
52		- protected $_params;
53		-
54		- /**
55	39	* Constructor.
56	40	*
57	41	* @access public
58	42	* @param string $query The query.
59		- * @param int $chart_id The chart id.
60		- * @param array $params Any additional parameters (e.g. for connecting to a remote db).
61	43	*/
62		- public function __construct( $query = null, $chart_id = null, $params = null ) {
	44	+ public function __construct( $query = null ) {
63	45	$this->_query = $query;
64		- $this->_chart_id = $chart_id;
65		- $this->_params = $params;
66	46	}
67	47
68	48	/**
69	49	* Fetches information from source, parses it and builds series and data arrays.
		@@ -79,118 +59,57 @@
79	59	return false;
80	60	}
81	61
82	62	// only select queries allowed.
83		- if ( ! preg_match( '/\s*(\bselect\b)\s/i', $this->_query ) ) {
	63	+ if ( preg_match( '/^\s*(insert|delete|update|replace|create|alter|drop|truncate)\s/i', $this->_query ) ) {
84	64	$this->_error = __( 'Only SELECT queries are allowed', 'visualizer' );
85	65	return false;
86	66	}
87	67
88		- // if previous check passed, check for disallowed query parts to prevent subqueries and other harmful queries.
89		- $disallow_query_parts = array(
90		- 'INSERT',
91		- 'UPDATE',
92		- 'DELETE',
93		- 'RENAME',
94		- 'DROP',
95		- 'CREATE',
96		- 'TRUNCATE',
97		- 'ALTER',
98		- 'COMMIT',
99		- 'ROLLBACK',
100		- 'MERGE',
101		- 'CALL',
102		- 'EXPLAIN',
103		- 'LOCK',
104		- 'GRANT',
105		- 'REVOKE',
106		- 'SAVEPOINT',
107		- 'TRANSACTION',
108		- 'SET',
109		- );
110		- $disallow_regex = implode(
111		- '|',
112		- array_map(
113		- function ( $value ) {
114		- return '\b' . $value . '\b';
115		- }, $disallow_query_parts
116		- )
117		- );
118		-
119		- if ( preg_match( '/(' . $disallow_regex . ')/i', $this->_query) !== 0 ) {
120		- $this->_error = __( 'Only SELECT queries are allowed', 'visualizer' );
121		- return false;
122		- }
123		-
124	68	// impose a limit if no limit clause is provided.
125	69	if ( strpos( strtolower( $this->_query ), ' limit ' ) === false ) {
126		- $this->_query .= ' LIMIT ' . apply_filters( 'visualizer_sql_query_limit', 1000, $this->_chart_id );
	70	+ $this->_query .= ' LIMIT ' . apply_filters( 'visualizer_sql_query_limit', 1000 );
127	71	}
128	72
129		- $this->_query = apply_filters( 'visualizer_db_query', $this->_query, $this->_chart_id, $this->_params );
	73	+ global $wpdb;
	74	+ $wpdb->hide_errors();
	75	+ // @codingStandardsIgnoreStart
	76	+ $rows = $wpdb->get_results( $this->_query, $results_as_numeric_array ? ARRAY_N : ARRAY_A );
	77	+ do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Firing query %s to get results %s with error %s', $this->_query, print_r( $rows, true ), print_r( $wpdb->last_error, true ) ), 'debug', __FILE__, __LINE__ );
	78	+ // @codingStandardsIgnoreEnd
	79	+ $wpdb->show_errors();
130	80
131		- $results = array();
132		- $headers = array();
133		-
134		- // short circuit results for remote dbs.
135		- if ( false !== ( $remote_results = apply_filters( 'visualizer_db_query_execute', false, $this->_query, $as_html, $results_as_numeric_array, $raw_results, $this->_chart_id, $this->_params ) ) ) {
136		- $error = $remote_results['error'];
137		- if ( empty( $error ) ) {
138		- $results = $remote_results['results'];
139		- $headers = $remote_results['headers'];
140		- }
141		-
142		- $this->_error = $error;
143		-
144		- if ( $raw_results ) {
145		- return $results;
146		- }
	81	+ if ( $raw_results ) {
	82	+ return $rows;
147	83	}
148	84
149		- if ( ! ( $results && $headers ) ) {
150		- global $wpdb;
151		- $wpdb->hide_errors();
152		- // @codingStandardsIgnoreStart
153		- $rows = $wpdb->get_results( $this->_query, $results_as_numeric_array ? ARRAY_N : ARRAY_A );
154		- // @codingStandardsIgnoreEnd
155		- $wpdb->show_errors();
156		-
157		- if ( $raw_results ) {
158		- return $rows;
159		- }
160		-
	85	+ if ( $rows ) {
	86	+ $results = array();
	87	+ $headers = array();
161	88	if ( $rows ) {
162		- $results = array();
163		- $headers = array();
164		- if ( $rows ) {
165		- $row_num = 0;
166		- foreach ( $rows as $row ) {
167		- $result = array();
168		- $col_num = 0;
169		- foreach ( $row as $k => $v ) {
170		- $result[] = $v;
171		- if ( 0 === $row_num ) {
172		- $headers[] = array( 'type' => $this->get_col_type( $col_num++ ), 'label' => $k );
173		- }
	89	+ $row_num = 0;
	90	+ foreach ( $rows as $row ) {
	91	+ $result = array();
	92	+ $col_num = 0;
	93	+ foreach ( $row as $k => $v ) {
	94	+ $result[] = $v;
	95	+ if ( 0 === $row_num ) {
	96	+ $headers[] = array( 'type' => $this->get_col_type( $col_num++ ), 'label' => $k );
174	97	}
175		- $results[] = $result;
176		- $row_num++;
177	98	}
	99	+ $results[] = $result;
	100	+ $row_num++;
178	101	}
	102	+ }
179	103
180		- $this->_error = $wpdb->last_error;
	104	+ if ( $as_html ) {
	105	+ return $this->html( $headers, $results );
181	106	}
	107	+ return $this->object( $headers, $results );
182	108	}
183		- // Query log.
184		- do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Firing query %s to get results %s with error %s', $this->_query, print_r( $rows, true ), print_r( $wpdb->last_error, true ) ), 'debug', __FILE__, __LINE__ );
185	109
186		- if ( $as_html ) {
187		- $results = $this->html( $headers, $results );
188		- } else {
189		- $results = $this->object( $headers, $results );
190		- }
191		-
192		- return apply_filters( 'visualizer_db_query_results', $results, $headers, $as_html, $results_as_numeric_array, $raw_results, $this->_query, $this->_chart_id, $this->_params );
	110	+ $this->_error = $wpdb->last_error;
	111	+ return null;
193	112	}
194	113
195	114	/**
196	115	* Get the data type of the column.
		@@ -252,9 +171,10 @@
252	171	foreach ( $results as $row ) {
253	172	$data[] = $this->_normalizeData( $row );
254	173	}
255	174	$this->_data = $data;
256		- return $this->_data;
	175	+
	176	+ return true;
257	177	}
258	178
259	179	/**
260	180	* Returns the final query.