← All changes | classes/Visualizer/Source/Query.php +5 -67 4.0.5 → 3.7.9 View file →

		@@ -59,31 +59,14 @@
59	59	* @param int $chart_id The chart id.
60	60	* @param array $params Any additional parameters (e.g. for connecting to a remote db).
61	61	*/
62	62	public function __construct( $query = null, $chart_id = null, $params = null ) {
63		- $this->_query = $this->strip_sql_comments( $query );
	63	+ $this->_query = $query;
64	64	$this->_chart_id = $chart_id;
65	65	$this->_params = $params;
66	66	}
67	67
68	68	/**
69		- * Strips SQL comments from the query.
70		- *
71		- * @param string $query The query.
72		- *
73		- * @return string
74		- */
75		- private function strip_sql_comments( $query = '' ) {
76		- if ( empty( $query ) ) {
77		- return $query;
78		- }
79		-
80		- // Regex https://regex101.com/r/xd5Vrg/1
81		- $sql_comments_regex = '@(--[^\r\n]*)|(\#[^\r\n]*)|(/\*[\w\W]*?(?=\*/)\*/)@ms';
82		- return trim( preg_replace( $sql_comments_regex, '', $query ) );
83		- }
84		-
85		- /**
86	69	* Fetches information from source, parses it and builds series and data arrays.
87	70	*
88	71	* @param bool $as_html Should the result be fetched as an HTML table or as an object.
89	72	* @param bool $results_as_numeric_array Should the result be fetched as ARRAY_N instead of ARRAY_A.
		@@ -95,53 +78,14 @@
95	78	if ( empty( $this->_query ) ) {
96	79	return false;
97	80	}
98	81
99		- // only select queries allowed. must start with SELECT keyword.
100		- if ( ! preg_match( '/^(\bselect\b)\s/i', $this->_query ) ) {
	82	+ // only select queries allowed.
	83	+ if ( preg_match( '/^\s*(insert|delete|update|replace|create|alter|drop|truncate)\s/i', $this->_query ) ) {
101	84	$this->_error = __( 'Only SELECT queries are allowed', 'visualizer' );
102	85	return false;
103	86	}
104	87
105		- // if previous check passed, check for disallowed query parts to prevent subqueries and other harmful queries.
106		- $disallow_query_parts = array(
107		- 'CREATE',
108		- 'ALTER',
109		- 'TRUNCATE',
110		- 'DROP',
111		-
112		- 'INSERT',
113		- 'DELETE',
114		- 'UPDATE',
115		- 'REPLACE',
116		-
117		- 'RENAME',
118		- 'COMMIT',
119		- 'ROLLBACK',
120		- 'MERGE',
121		- 'CALL',
122		- 'EXPLAIN',
123		- 'LOCK',
124		- 'GRANT',
125		- 'REVOKE',
126		- 'SAVEPOINT',
127		- 'TRANSACTION',
128		- 'SET',
129		- );
130		- $disallow_regex = implode(
131		- '|',
132		- array_map(
133		- function ( $value ) {
134		- return '\b' . $value . '\b';
135		- }, $disallow_query_parts
136		- )
137		- );
138		-
139		- if ( preg_match( '/(' . $disallow_regex . ')/i', $this->_query) !== 0 ) {
140		- $this->_error = __( 'Only SELECT queries are allowed', 'visualizer' );
141		- return false;
142		- }
143		-
144	88	// impose a limit if no limit clause is provided.
145	89	if ( strpos( strtolower( $this->_query ), ' limit ' ) === false ) {
146	90	$this->_query .= ' LIMIT ' . apply_filters( 'visualizer_sql_query_limit', 1000, $this->_chart_id );
147	91	}
		@@ -151,10 +95,9 @@
151	95	$results = array();
152	96	$headers = array();
153	97
154	98	// short circuit results for remote dbs.
155		- $remote_results = apply_filters( 'visualizer_db_query_execute', false, $this->_query, $as_html, $results_as_numeric_array, $raw_results, $this->_chart_id, $this->_params );
156		- if ( false !== $remote_results ) {
	99	+ if ( false !== ( $remote_results = apply_filters( 'visualizer_db_query_execute', false, $this->_query, $as_html, $results_as_numeric_array, $raw_results, $this->_chart_id, $this->_params ) ) ) {
157	100	$error = $remote_results['error'];
158	101	if ( empty( $error ) ) {
159	102	$results = $remote_results['results'];
160	103	$headers = $remote_results['headers'];
		@@ -178,13 +121,8 @@
178	121	if ( $raw_results ) {
179	122	return $rows;
180	123	}
181	124
182		- if ( $wpdb->last_error ) {
183		- $this->_error = $wpdb->last_error;
184		- return array();
185		- }
186		-
187	125	if ( $rows ) {
188	126	$results = array();
189	127	$headers = array();
190	128	if ( $rows ) {
		@@ -198,9 +136,9 @@
198	136	$headers[] = array( 'type' => $this->get_col_type( $col_num++ ), 'label' => $k );
199	137	}
200	138	}
201	139	$results[] = $result;
202		- ++$row_num;
	140	+ $row_num++;
203	141	}
204	142	}
205	143
206	144	$this->_error = $wpdb->last_error;