| @@ -79,49 +79,13 @@ | ||
| 79 | 79 | return false; |
| 80 | 80 | } |
| 81 | 81 | |
| 82 | 82 | // only select queries allowed. |
| 83 | - if ( ! preg_match( '/\s*(\bselect\b)\s/i', $this->_query ) ) { | |
| 83 | + if ( preg_match( '/^\s*(insert|delete|update|replace|create|alter|drop|truncate)\s/i', $this->_query ) ) { | |
| 84 | 84 | $this->_error = __( 'Only SELECT queries are allowed', 'visualizer' ); |
| 85 | 85 | return false; |
| 86 | 86 | } |
| 87 | 87 | |
| 88 | - // if previous check passed, check for disallowed query parts to prevent subqueries and other harmful queries. | |
| 89 | - $disallow_query_parts = array( | |
| 90 | - 'INSERT', | |
| 91 | - 'UPDATE', | |
| 92 | - 'DELETE', | |
| 93 | - 'RENAME', | |
| 94 | - 'DROP', | |
| 95 | - 'CREATE', | |
| 96 | - 'TRUNCATE', | |
| 97 | - 'ALTER', | |
| 98 | - 'COMMIT', | |
| 99 | - 'ROLLBACK', | |
| 100 | - 'MERGE', | |
| 101 | - 'CALL', | |
| 102 | - 'EXPLAIN', | |
| 103 | - 'LOCK', | |
| 104 | - 'GRANT', | |
| 105 | - 'REVOKE', | |
| 106 | - 'SAVEPOINT', | |
| 107 | - 'TRANSACTION', | |
| 108 | - 'SET', | |
| 109 | - ); | |
| 110 | - $disallow_regex = implode( | |
| 111 | - '|', | |
| 112 | - array_map( | |
| 113 | - function ( $value ) { | |
| 114 | - return '\b' . $value . '\b'; | |
| 115 | - }, $disallow_query_parts | |
| 116 | - ) | |
| 117 | - ); | |
| 118 | - | |
| 119 | - if ( preg_match( '/(' . $disallow_regex . ')/i', $this->_query) !== 0 ) { | |
| 120 | - $this->_error = __( 'Only SELECT queries are allowed', 'visualizer' ); | |
| 121 | - return false; | |
| 122 | - } | |
| 123 | - | |
| 124 | 88 | // impose a limit if no limit clause is provided. |
| 125 | 89 | if ( strpos( strtolower( $this->_query ), ' limit ' ) === false ) { |
| 126 | 90 | $this->_query .= ' LIMIT ' . apply_filters( 'visualizer_sql_query_limit', 1000, $this->_chart_id ); |
| 127 | 91 | } |
| @@ -150,8 +114,9 @@ | ||
| 150 | 114 | global $wpdb; |
| 151 | 115 | $wpdb->hide_errors(); |
| 152 | 116 | // @codingStandardsIgnoreStart |
| 153 | 117 | $rows = $wpdb->get_results( $this->_query, $results_as_numeric_array ? ARRAY_N : ARRAY_A ); |
| 118 | + do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Firing query %s to get results %s with error %s', $this->_query, print_r( $rows, true ), print_r( $wpdb->last_error, true ) ), 'debug', __FILE__, __LINE__ ); | |
| 154 | 119 | // @codingStandardsIgnoreEnd |
| 155 | 120 | $wpdb->show_errors(); |
| 156 | 121 | |
| 157 | 122 | if ( $raw_results ) { |
| @@ -179,10 +144,8 @@ | ||
| 179 | 144 | |
| 180 | 145 | $this->_error = $wpdb->last_error; |
| 181 | 146 | } |
| 182 | 147 | } |
| 183 | - // Query log. | |
| 184 | - do_action( 'themeisle_log_event', Visualizer_Plugin::NAME, sprintf( 'Firing query %s to get results %s with error %s', $this->_query, print_r( $rows, true ), print_r( $wpdb->last_error, true ) ), 'debug', __FILE__, __LINE__ ); | |
| 185 | 148 | |
| 186 | 149 | if ( $as_html ) { |
| 187 | 150 | $results = $this->html( $headers, $results ); |
| 188 | 151 | } else { |
| @@ -252,9 +215,10 @@ | ||
| 252 | 215 | foreach ( $results as $row ) { |
| 253 | 216 | $data[] = $this->_normalizeData( $row ); |
| 254 | 217 | } |
| 255 | 218 | $this->_data = $data; |
| 256 | - return $this->_data; | |
| 219 | + | |
| 220 | + return true; | |
| 257 | 221 | } |
| 258 | 222 | |
| 259 | 223 | /** |
| 260 | 224 | * Returns the final query. |
