wp-data-access / WPDataAccess / Settings / WPDA_Settings_BackEnd.php

WPDA_Settings_BackEnd.php in WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards 5.5.84, at WPDataAccess/Settings/WPDA_Settings_BackEnd.php

392 lines 14.8 KB

Raw Download Zip

1	<?php
2
3	namespace WPDataAccess\Settings {
4
5	use WPDataAccess\Data_Dictionary\WPDA_Dictionary_Exist;
6	use WPDataAccess\Data_Dictionary\WPDA_Dictionary_Lists;
7	use WPDataAccess\Utilities\WPDA_Message_Box;
8	use WPDataAccess\WPDA;
9
10	class WPDA_Settings_BackEnd extends WPDA_Settings {
11
12	/**
13	* Add back-end tab content
14	*
15	* See class documentation for flow explanation.
16	*
17	* @since 1.0.0
18	*/
19	protected function add_content() {
20	global $wpdb;
21
22	if ( isset( $_REQUEST['database'] ) ) {
23	$database = sanitize_text_field( wp_unslash( $_REQUEST['database'] ) ); // input var okay.
24	} else {
25	$database = $wpdb->dbname;
26	}
27	$is_wp_database = $database === $wpdb->dbname;
28
29	if ( isset( $_REQUEST['action'] ) ) {
30	$action = sanitize_text_field( wp_unslash( $_REQUEST['action'] ) ); // input var okay.
31
32	// Security check.
33	$wp_nonce = isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : ''; // input var okay.
34	if ( ! wp_verify_nonce( $wp_nonce, 'wpda-back-end-settings' ) ) {
35	wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
36	}
37
38	if ( 'save' === $action ) {
39	// Save options.
40	if ( $is_wp_database ) {
41	WPDA::set_option(
42	WPDA::OPTION_BE_TABLE_ACCESS,
43	isset( $_REQUEST['table_access'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['table_access'] ) ) : null // input var okay.
44	);
45	} else {
46	update_option(
47	WPDA::BACKEND_OPTIONNAME_DATABASE_ACCESS . $database,
48	isset( $_REQUEST['table_access'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['table_access'] ) ) : null // input var okay.
49	);}
50
51	$wpda_hide_manage_link = array();
52	if ( isset( $_REQUEST['wpda_hide_manage_link'] ) ) {
53	foreach ( $_REQUEST['wpda_hide_manage_link'] as $userid ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
54	if ( is_numeric( $userid ) ) {
55	$wpda_hide_manage_link[] = sanitize_text_field( wp_unslash( $userid ) );
56	}
57	}
58	}
59	update_option( 'wpda_hide_manage_link', $wpda_hide_manage_link );
60
61	$table_access_selected_new_value = isset( $_REQUEST['table_access_selected'] ) ?
62	WPDA::sanitize_text_field_array( $_REQUEST['table_access_selected'] ) : null; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
63	if ( is_array( $table_access_selected_new_value ) ) {
64	// Check the requested table names for sql injection. This is simply done by checking if the table
65	// name exists in our WordPress database.
66	$table_access_selected_new_value_checked = array();
67	foreach ( $table_access_selected_new_value as $key => $value ) {
68	$wpda_dictionary_checks = new WPDA_Dictionary_Exist( $database, $value );
69	if ( $wpda_dictionary_checks->table_exists( false ) ) {
70	// Add existing table to list.
71	$table_access_selected_new_value_checked[ $key ] = $value;
72	} else {
73	// An invalid table name was provided. Might be an sql injection attack or an invalid state.
74	wp_die( esc_attr__( 'ERROR: Invalid table name', 'wp-data-access' ) );
75	}
76	}
77	} else {
78	$table_access_selected_new_value_checked = '';
79	}
80	if ( $is_wp_database ) {
81	WPDA::set_option(
82	WPDA::OPTION_BE_TABLE_ACCESS_SELECTED,
83	$table_access_selected_new_value_checked
84	);
85	} else {
86	update_option(
87	WPDA::BACKEND_OPTIONNAME_DATABASE_SELECTED . $database,
88	$table_access_selected_new_value_checked
89	);
90	}
91
92	if (
93	isset( $_REQUEST['wpda_default_user'] ) &&
94	isset( $_REQUEST['wpda_default_database'] ) &&
95	'' !== $_REQUEST['wpda_default_user'] &&
96	'' !== $_REQUEST['wpda_default_database']
97	) {
98	$default_databases = get_option( 'wpda_default_database' );
99	if ( false === $default_databases ) {
100	$default_databases = array();
101	}
102	$wpda_default_user = sanitize_text_field( wp_unslash( $_REQUEST['wpda_default_user'] ) ); // input var okay.
103	$wpda_default_database = sanitize_text_field( wp_unslash( $_REQUEST['wpda_default_database'] ) ); // input var okay.
104
105	$default_databases[ $wpda_default_user ] = $wpda_default_database;
106	update_option( 'wpda_default_database', $default_databases );
107	}
108	} elseif ( 'setdefaults' === $action ) {
109	// Set all back-end settings back to default.
110	if ( $is_wp_database ) {
111	WPDA::set_option( WPDA::OPTION_BE_TABLE_ACCESS );
112	WPDA::set_option( WPDA::OPTION_BE_TABLE_ACCESS_SELECTED );
113	} else {
114	update_option(
115	WPDA::BACKEND_OPTIONNAME_DATABASE_ACCESS . $database,
116	'show'
117	);
118	update_option(
119	WPDA::BACKEND_OPTIONNAME_DATABASE_SELECTED . $database,
120	''
121	);
122	}
123	update_option( 'wpda_hide_manage_link', array() );
124	update_option( 'wpda_default_database', array() );
125	} elseif ( 'delete_default_user_database' === $action ) {
126	if ( isset( $_REQUEST['wpda_default_database_delete'] ) ) {
127	$delete_user_id = sanitize_text_field( wp_unslash( $_REQUEST['wpda_default_database_delete'] ) ); // input var okay.
128
129	$default_databases = get_option( 'wpda_default_database' );
130	if ( false !== $default_databases && isset( $default_databases[ $delete_user_id ] ) ) {
131	unset( $default_databases[ $delete_user_id ] );
132	update_option( 'wpda_default_database', $default_databases );
133	}
134	}
135	}
136
137	$msg = new WPDA_Message_Box(
138	array(
139	'message_text' => __( 'Settings saved', 'wp-data-access' ),
140	)
141	);
142	$msg->box();
143	}
144
145	// Get options.
146	if ( $is_wp_database ) {
147	$table_access = WPDA::get_option( WPDA::OPTION_BE_TABLE_ACCESS );
148	$table_access_selected = WPDA::get_option( WPDA::OPTION_BE_TABLE_ACCESS_SELECTED );
149	} else {
150	$table_access = get_option( WPDA::BACKEND_OPTIONNAME_DATABASE_ACCESS . $database );
151	if ( false === $table_access ) {
152	$table_access = 'show';
153	}
154	$table_access_selected = get_option( WPDA::BACKEND_OPTIONNAME_DATABASE_SELECTED . $database );
155	if ( false === $table_access_selected ) {
156	$table_access_selected = '';
157	}
158	}
159
160	if ( is_array( $table_access_selected ) ) {
161	// Convert table for simple access.
162	$table_access_selected_by_name = array();
163	foreach ( $table_access_selected as $key => $value ) {
164	$table_access_selected_by_name[ $value ] = true;
165	}
166	}
167
168	$wpda_hide_manage_link = get_option( 'wpda_hide_manage_link' );
169	if ( is_array( $wpda_hide_manage_link ) ) {
170	$wpda_hide_manage_list = array_flip( $wpda_hide_manage_link ); // phpcs:ignore -- 8.1 proof
171	} else {
172	$wpda_hide_manage_list = array();
173	}
174	?>
175
176	<form id="wpda_settings_backend" method="post"
177	action="?page=<?php echo esc_attr( $this->page ); ?>&tab=backend">
178	<table class="wpda-table-settings">
179	<tr>
180	<th><?php esc_html_e( 'Table access', 'wp-data-access' ); ?></th>
181	<td>
182	<select name="database" id="schema_name">
183	<?php
184	$schema_names = WPDA_Dictionary_Lists::get_db_schemas();
185	foreach ( $schema_names as $schema_name ) {
186	$selected = $database === $schema_name['schema_name'] ? ' selected' : '';
187	echo "<option value='{$schema_name['schema_name']}'$selected>{$schema_name['schema_name']}</option>"; // phpcs:ignore WordPress.Security.EscapeOutput
188	}
189	?>
190	</select>
191	<br/><br/>
192	<label>
193	<input
194	type="radio"
195	name="table_access"
196	value="show"
197	<?php echo 'show' === $table_access ? 'checked' : ''; ?>
198	><?php echo $is_wp_database ? esc_attr__( 'Show WordPress tables', 'wp-data-access' ) : esc_attr__( 'Show all tables', 'wp-data-access' ); ?>
199	</label>
200	<br/>
201	<?php
202	if ( $is_wp_database ) {
203	?>
204	<label>
205	<input
206	type="radio"
207	name="table_access"
208	value="hide"
209	<?php echo 'hide' === $table_access ? 'checked' : ''; ?>
210	><?php esc_html_e( 'Hide WordPress tables', 'wp-data-access' ); ?>
211	</label>
212	<br/>
213	<?php
214	}
215	?>
216	<label>
217	<input
218	type="radio"
219	name="table_access"
220	value="select"
221	<?php echo 'select' === $table_access ? 'checked' : ''; ?>
222	><?php esc_html_e( 'Show only selected tables', 'wp-data-access' ); ?>
223	</label>
224	<div id="tables_selected" <?php echo 'select' === $table_access ? '' : 'style="display:none"'; ?>>
225	<br/>
226	<select name="table_access_selected[]" multiple size="10">
227	<?php
228	$tables = WPDA_Dictionary_Lists::get_tables( true, $database );
229	foreach ( $tables as $table ) {
230	$table_name = $table['table_name'];
231	?>
232	<option value="<?php echo esc_attr( $table_name ); ?>" <?php echo isset( $table_access_selected_by_name[ $table_name ] ) ? 'selected' : ''; ?>><?php echo esc_attr( $table_name ); ?></option>
233	<?php
234	}
235	?>
236	</select>
237	</div>
238	<script type='text/javascript'>
239	jQuery(function () {
240	jQuery("input[name='table_access']").on("click", function () {
241	if (this.value == 'select') {
242	jQuery("#tables_selected").show();
243	} else {
244	jQuery("#tables_selected").hide();
245	}
246	});
247	jQuery('#schema_name').on('change', function() {
248	window.location = '?page=<?php echo esc_attr( $this->page ); ?>&tab=backend&database=' + jQuery(this).val();
249	});
250	});
251	</script>
252	</td>
253	</tr>
254	<tr>
255	<th><?php esc_html_e( 'Restrict table management', 'wp-data-access' ); ?></th>
256	<td>
257	<select name="wpda_hide_manage_link[]" multiple="true">
258	<?php
259	foreach ( get_users( array( 'role' => 'administrator' ) ) as $user ) {
260	$selected = isset( $wpda_hide_manage_list[ $user->ID ] ) ? 'selected' : '';
261	echo "<option value='{$user->ID}' {$selected}>{$user->user_login} ({$user->user_email})</option>"; // phpcs:ignore WordPress.Security.EscapeOutput
262	}
263	?>
264	</select>
265	<div style="margin-top:5px;margin-left:-5px">
266	<span class="dashicons dashicons-yes"></span>
267	Removes the manage link in the Data Explorer for selected admin users
268	</div>
269	<div style="margin-left:-5px">
270	<span class="dashicons dashicons-yes"></span>
271	Hold control key to deselect or select multiple users
272	</div>
273	<div style="margin-left:-5px">
274	<span class="dashicons dashicons-yes"></span>
275	Non admin users have no access by default
276	</div>
277	<div style="margin-left:-5px">
278	<span class="dashicons dashicons-yes"></span>
279	Every administrator can change this option
280	</div>
281	</td>
282	</tr>
283	<tr>
284	<th><?php esc_html_e( 'Default database', 'wp-data-access' ); ?></th>
285	<td>
286	<div>
287	<?php
288	$users = array();
289	foreach ( get_users() as $user ) {
290	$users[ $user->data->ID ] = $user->data->user_login;
291	}
292
293	$databases = array();
294	$db_databases = WPDA_Dictionary_Lists::get_db_schemas();
295	foreach ( $db_databases as $db_database ) {
296	$databases[ $db_database['schema_name'] ] = true;
297	}
298
299	$default_databases = get_option( 'wpda_default_database' );
300	if ( false === $default_databases ) {
301	$default_databases = array();
302	}
303	if ( is_array( $default_databases ) ) {
304	foreach ( $default_databases as $user_id => $database ) {
305	?>
306	<div id="wpda_default_database_<?php echo esc_attr( $user_id ); ?>">
307	<span class="dashicons dashicons-trash"
308	style="font-size: 14px; vertical-align: text-top; cursor: pointer;"
309	onclick="if (confirm('Remove default database for this user?')) { jQuery('#wpda_default_database_delete').val('<?php echo esc_attr( $user_id ); ?>'); jQuery('#delete_default_user_database_form').submit(); } "
310	></span>
311	<span>
312	<?php echo esc_attr( $users[ $user_id ] ); ?> > <?php echo esc_attr( $database ); ?>
313	</span>
314	</div>
315	<?php
316	}
317	}
318	?>
319	</div>
320	<?php
321	if ( count( $default_databases ) > 0 ) { // phpcs:ignore -- 8.1 proof
322	echo '<br/>';
323	}
324	?>
325	<div>
326	<a href="javascript:void(0)" onclick="jQuery('#list_default_databases').show()" class="button">Define default database for user in Data Explorer</a>
327	</div>
328	<div id="list_default_databases" style="display:none">
329	<br/>
330	<div>
331	<label for="wpda_default_user">User: </label>
332	<select name="wpda_default_user" id="wpda_default_user">
333	<option value="">Select user</option>
334	<?php
335	foreach ( get_users() as $user ) {
336	echo '<option value="' . esc_attr( $user->data->ID ) . '">' . esc_attr( $user->data->user_login ) . '</option>';
337	}
338	?>
339	</select>
340	<label for="wpda_default_database">Database: </label>
341	<select name="wpda_default_database" id="wpda_default_database">
342	<option value="">Select database</option>
343	<?php
344	foreach ( $databases as $database => $value ) {
345	echo '<option value="' . esc_attr( $database ) . '">' . esc_attr( $database ) . '</option>';
346	}
347	?>
348	</select>
349	<span class="dashicons dashicons-trash"
350	style="font-size: 14px; vertical-align: text-top; cursor: pointer;"
351	onclick="jQuery('#list_default_databases').hide(); jQuery('#wpda_default_user').val(''); jQuery('#wpda_default_database').val('');"
352	></span>
353	</div>
354	</div>
355	</td>
356	</tr>
357	</table>
358	<div class="wpda-table-settings-button">
359	<input type="hidden" name="action" value="save"/>
360	<button type="submit" class="button button-primary">
361	<i class="fas fa-check wpda_icon_on_button"></i>
362	<?php esc_html_e( 'Save Back-end Settings', 'wp-data-access' ); ?>
363	</button>
364	<a href="javascript:void(0)"
365	onclick="if (confirm('<?php esc_html_e( 'Reset to defaults?', 'wp-data-access' ); ?>')) {
366	jQuery('input[name="action"]').val('setdefaults');
367	jQuery('#wpda_settings_backend').trigger('submit')
368	}"
369	class="button">
370	<i class="fas fa-times-circle wpda_icon_on_button"></i>
371	<?php esc_html_e( 'Reset Back-end Settings To Defaults', 'wp-data-access' ); ?>
372	</a>
373	</div>
374	<?php wp_nonce_field( 'wpda-back-end-settings', '_wpnonce', false ); ?>
375	</form>
376
377	<form id="delete_default_user_database_form"
378	method="post"
379	action="?page=<?php echo esc_attr( $this->page ); ?>&tab=backend"
380	style="display:none">
381	<input type="hidden" name="wpda_default_database_delete" id="wpda_default_database_delete" value=""/>
382	<input type="hidden" name="action" value="delete_default_user_database"/>
383	<?php wp_nonce_field( 'wpda-back-end-settings', '_wpnonce', false ); ?>
384	</form>
385
386	<?php
387	}
388
389	}
390
391	}
392