← All changes | classes/Visualizer/Source/Query.php +6 -47 3.10.14 → 3.4.2 View file →

		@@ -79,56 +79,18 @@
79	79	return false;
80	80	}
81	81
82	82	// only select queries allowed.
83		- if ( ! preg_match( '/\s*(\bselect\b)\s/i', $this->_query ) ) {
	83	+ if ( preg_match( '/^\s*(insert|delete|update|replace|create|alter|drop|truncate)\s/i', $this->_query ) ) {
84	84	$this->_error = __( 'Only SELECT queries are allowed', 'visualizer' );
85	85	return false;
86	86	}
87	87
88		- // if previous check passed, check for disallowed query parts to prevent subqueries and other harmful queries.
89		- $disallow_query_parts = array(
90		- 'INSERT',
91		- 'UPDATE',
92		- 'DELETE',
93		- 'RENAME',
94		- 'DROP',
95		- 'CREATE',
96		- 'TRUNCATE',
97		- 'ALTER',
98		- 'COMMIT',
99		- 'ROLLBACK',
100		- 'MERGE',
101		- 'CALL',
102		- 'EXPLAIN',
103		- 'LOCK',
104		- 'GRANT',
105		- 'REVOKE',
106		- 'SAVEPOINT',
107		- 'TRANSACTION',
108		- 'SET',
109		- );
110		- $disallow_regex = implode(
111		- '|',
112		- array_map(
113		- function ( $value ) {
114		- return '\b' . $value . '\b';
115		- }, $disallow_query_parts
116		- )
117		- );
118		-
119		- if ( preg_match( '/(' . $disallow_regex . ')/i', $this->_query) !== 0 ) {
120		- $this->_error = __( 'Only SELECT queries are allowed', 'visualizer' );
121		- return false;
122		- }
123		-
124	88	// impose a limit if no limit clause is provided.
125	89	if ( strpos( strtolower( $this->_query ), ' limit ' ) === false ) {
126	90	$this->_query .= ' LIMIT ' . apply_filters( 'visualizer_sql_query_limit', 1000, $this->_chart_id );
127	91	}
128	92
129		- $this->_query = apply_filters( 'visualizer_db_query', $this->_query, $this->_chart_id, $this->_params );
130		-
131	93	$results = array();
132	94	$headers = array();
133	95
134	96	// short circuit results for remote dbs.
		@@ -150,8 +112,9 @@
150	112	global $wpdb;
151	113	$wpdb->hide_errors();
152	114	// @codingStandardsIgnoreStart
153	115	$rows = $wpdb->get_results( $this->_query, $results_as_numeric_array ? ARRAY_N : ARRAY_A );
	116	+ do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Firing query %s to get results %s with error %s', $this->_query, print_r( $rows, true ), print_r( $wpdb->last_error, true ) ), 'debug', __FILE__, __LINE__ );
154	117	// @codingStandardsIgnoreEnd
155	118	$wpdb->show_errors();
156	119
157	120	if ( $raw_results ) {
		@@ -179,18 +142,13 @@
179	142
180	143	$this->_error = $wpdb->last_error;
181	144	}
182	145	}
183		- // Query log.
184		- do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Firing query %s to get results %s with error %s', $this->_query, print_r( $rows, true ), print_r( $wpdb->last_error, true ) ), 'debug', __FILE__, __LINE__ );
185	146
186	147	if ( $as_html ) {
187		- $results = $this->html( $headers, $results );
188		- } else {
189		- $results = $this->object( $headers, $results );
	148	+ return $this->html( $headers, $results );
190	149	}
191		-
192		- return apply_filters( 'visualizer_db_query_results', $results, $headers, $as_html, $results_as_numeric_array, $raw_results, $this->_query, $this->_chart_id, $this->_params );
	150	+ return $this->object( $headers, $results );
193	151	}
194	152
195	153	/**
196	154	* Get the data type of the column.
		@@ -252,9 +210,10 @@
252	210	foreach ( $results as $row ) {
253	211	$data[] = $this->_normalizeData( $row );
254	212	}
255	213	$this->_data = $data;
256		- return $this->_data;
	214	+
	215	+ return true;
257	216	}
258	217
259	218	/**
260	219	* Returns the final query.