← All changes | WPDataAccess/Simple_Form/WPDA_Simple_Form.php +37 -33 5.5.22 → 5.5.84 View file →

		@@ -4,8 +4,9 @@
4	4	* Suppress "error - 0 - No summary was found for this file" on phpdoc generation
5	5	*
6	6	* @package WPDataAccess\Simple_Form
7	7	*/
	8	+// phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- verified on page
8	9	namespace WPDataAccess\Simple_Form;
9	10
10	11	use WPDataAccess\Data_Dictionary\WPDA_List_Columns;
11	12	use WPDataAccess\Plugin_Table_Models\WPDA_Media_Model;
		@@ -346,9 +347,9 @@
346	347	if ( isset( $_REQUEST['page'] ) ) {
347	348	$this->page = sanitize_text_field( wp_unslash( $_REQUEST['page'] ) );
348	349	// input var okay.
349	350	} else {
350		- wp_die( __( 'ERROR: Wrong arguments [missing page argument]', 'wp-data-access' ) );
	351	+ wp_die( esc_attr__( 'ERROR: Wrong arguments [missing page argument]', 'wp-data-access' ) );
351	352	}
352	353	if ( isset( $_REQUEST['action'] ) ) {
353	354	// Possible values: "new", "edit" and "view".
354	355	$this->action = sanitize_text_field( wp_unslash( $_REQUEST['action'] ) );
		@@ -356,9 +357,9 @@
356	357	} else {
357	358	if ( isset( $args['action'] ) ) {
358	359	$this->action = $args['action'];
359	360	} else {
360		- wp_die( __( 'ERROR: Wrong arguments [missing action argument]', 'wp-data-access' ) );
	361	+ wp_die( esc_attr__( 'ERROR: Wrong arguments [missing action argument]', 'wp-data-access' ) );
361	362	}
362	363	}
363	364	if ( isset( $_REQUEST['action2'] ) ) {
364	365	$this->action2 = sanitize_text_field( wp_unslash( $_REQUEST['action2'] ) );
		@@ -367,23 +368,23 @@
367	368	$this->schema_name = $schema_name;
368	369	$this->table_name = $table_name;
369	370	if ( '' === $this->table_name ) {
370	371	// Without a table name it makes no sense to continue.
371		- wp_die( __( 'ERROR: Wrong arguments [missing table_name argument]' ) );
	372	+ wp_die( esc_attr__( 'ERROR: Wrong arguments [missing table_name argument]', 'wp-data-access' ) );
372	373	}
373	374	if ( !WPDA::is_wpda_table( $this->table_name ) ) {
374	375	// Check access rights for tables that do not belong to the plugin.
375	376	if ( 'on' !== WPDA::get_option( WPDA::OPTION_BE_ALLOW_INSERT ) && 'new' === $this->action ) {
376	377	// Insert not allowed.
377		- wp_die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	378	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
378	379	}
379	380	if ( 'on' !== WPDA::get_option( WPDA::OPTION_BE_VIEW_LINK ) && 'view' === $this->action ) {
380	381	// Viewing not allowed.
381		- wp_die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	382	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
382	383	}
383	384	if ( 'on' !== WPDA::get_option( WPDA::OPTION_BE_ALLOW_UPDATE ) && 'edit' === $this->action ) {
384	385	// Update not allowed.
385		- wp_die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	386	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
386	387	}
387	388	}
388	389	// Get columns information.
389	390	$this->wpda_list_columns = $wpda_list_columns;
		@@ -463,10 +464,11 @@
463	464	}
464	465	// Add search arguments to link to return to same page
465	466	foreach ( $_REQUEST as $key => $value ) {
466	467	if ( substr( $key, 0, 19 ) === 'wpda_search_column_' ) {
467		- $this->page_number_link .= "&{$key}={$value}";
468		- $this->page_number_item .= "<input type='hidden' name='{$key}' value='{$value}' />";
	468	+ $esc_attr = 'esc_attr';
	469	+ $this->page_number_link .= "&{$esc_attr( $key )}={$esc_attr( $value )}";
	470	+ $this->page_number_item .= "<input type='hidden' name='{$esc_attr( $key )}' value='{$esc_attr( $value )}' />";
469	471	}
470	472	}
471	473	// Check if button text "back to list" should be changed
472	474	if ( isset( $args['back_to_list_text'] ) && '' !== $args['back_to_list_text'] ) {
		@@ -497,18 +499,17 @@
497	499	* @since 1.5.0
498	500	*/
499	501	protected function get_url_arguments() {
500	502	// Get OLD and NEW values for all items.
	503	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
501	504	foreach ( $this->wpda_list_columns->get_table_columns() as $column ) {
502	505	if ( isset( $_REQUEST[$column['column_name'] . '_old'] ) ) {
503	506	$this->form_items_old_values[$column['column_name']] = wp_unslash( $_REQUEST[$column['column_name'] . '_old'] );
504		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
505	507	}
506	508	if ( isset( $_REQUEST[$column['column_name']] ) ) {
507	509	if ( is_array( $_REQUEST[$column['column_name']] ) ) {
508	510	$column_array = '';
509	511	foreach ( $_REQUEST[$column['column_name']] as $column_value ) {
510		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
511	512	$column_array .= wp_unslash( $column_value ) . ',';
512	513	}
513	514	if ( '' !== $column_array ) {
514	515	$this->form_items_new_values[$column['column_name']] = substr( $column_array, 0, strlen( $column_array ) - 1 );
		@@ -514,12 +515,12 @@
514	515	$this->form_items_new_values[$column['column_name']] = substr( $column_array, 0, strlen( $column_array ) - 1 );
515	516	}
516	517	} else {
517	518	$this->form_items_new_values[$column['column_name']] = wp_unslash( $_REQUEST[$column['column_name']] );
518		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
519	519	}
520	520	}
521	521	}
	522	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
522	523	}
523	524
524	525	/**
525	526	* Prepare form items and handle transactions
		@@ -537,9 +538,9 @@
537	538	// Security check (is action allowed?).
538	539	$wp_nonce = ( isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : '' );
539	540	// input var okay.
540	541	if ( !wp_verify_nonce( $wp_nonce, $this->get_nonce_action() ) ) {
541		- wp_die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	542	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
542	543	}
543	544	if ( 'new' === $this->action ) {
544	545	// Prepare row and items for validation
545	546	$this->row = $this->row_data->new_row();
		@@ -694,9 +695,8 @@
694	695	<?php
695	696	if ( substr( $this->page, 0, 13 ) === \WP_Data_Access_Admin::PAGE_EXPLORER || !is_admin() ) {
696	697	// Button is available on web pages only
697	698	if ( 'view' !== $this->action && !$this->hide_add_new ) {
698		- //phpcs:ignore - 8.1 proof
699	699	if ( WPDA::is_wpda_table( $this->table_name ) || ('on' === WPDA::get_option( WPDA::OPTION_BE_ALLOW_INSERT ) && count( $this->wpda_list_columns->get_table_primary_key() )) > 0 ) {
700	700	$title = __( 'Add new row to table', 'wp-data-access' );
701	701	?>
702	702	<form
		@@ -727,9 +727,9 @@
727	727	?>"
728	728	>
729	729	<i class="fas fa-plus-circle wpda_icon_on_button"></i>
730	730	<?php
731		- echo __( 'Add New', 'wp-data-access' );
	731	+ esc_html_e( 'Add New', 'wp-data-access' );
732	732	?>
733	733	</button>
734	734	</div>
735	735	</form>
		@@ -772,9 +772,11 @@
772	772	} else {
773	773	$id = '';
774	774	}
775	775	$expandable = ( isset( $fieldset['expandable'] ) && true === $fieldset['expandable'] ? true : false );
	776	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput.MissingUnslash
776	777	$expandable_state = ( isset( $_REQUEST["wpda_fieldset_expand_{$id}"] ) ? sanitize_text_field( $_REQUEST["wpda_fieldset_expand_{$id}"] ) : 'off' );
	778	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput.MissingUnslash
777	779	$expandable_icons = ( 'on' === $expandable_state ? 'minus-circle' : 'plus-circle' );
778	780	?>
779	781	<fieldset class="wpda_fieldset">
780	782	<?php
		@@ -807,9 +809,8 @@
807	809	cellpadding="0"
808	810	>
809	811	<?php
810	812	$fieldset_columns = array_flip( $fieldset['fields'] );
811		- //phpcs:ignore - 8.1 proof
812	813	foreach ( $this->form_items as $item ) {
813	814	if ( isset( $fieldset_columns[$item->get_item_name()] ) ) {
814	815	$item->show( $this->action, $this->update_keys_allowed );
815	816	$js_code .= $item->get_item_js();
		@@ -857,11 +858,12 @@
857	858	}
858	859	?>
859	860	<?php
860	861	$this->add_parent_args();
	862	+ // phpcs:disable WordPress.Security.EscapeOutput
861	863	echo $this->page_number_item;
862		- // phpcs:ignore WordPress.Security.EscapeOutput
863	864	echo $this->add_case_sensitive_search();
	865	+ // phpcs:enable WordPress.Security.EscapeOutput
864	866	wp_nonce_field( $this->get_nonce_action( false ), '_wpnonce', false );
865	867	?>
866	868	<?php
867	869	if ( 'view' !== $this->action ) {
		@@ -871,9 +873,9 @@
871	873	name="submit_button"
872	874	onclick="return submit_form(event)">
873	875	<i class="fas fa-check wpda_icon_on_button"></i>
874	876	<?php
875		- echo __( 'Submit', 'wp-data-access' );
	877	+ esc_html_e( 'Submit', 'wp-data-access' );
876	878	?>
877	879	</button>
878	880	<?php
879	881	if ( $this->show_back_button && $this->show_back_icon ) {
		@@ -883,9 +885,9 @@
883	885	name="submit_button"
884	886	onclick="return submit_form(event)">
885	887	<i class="fas fa-check wpda_icon_on_button"></i>
886	888	<?php
887		- echo __( 'Submit', 'wp-data-access' );
	889	+ esc_html_e( 'Submit', 'wp-data-access' );
888	890	?>
889	891	<i class="fas fa-angle-right wpda_icon_on_button"></i>
890	892	<?php
891	893	echo esc_attr( $this->back_to_list_text );
		@@ -939,11 +941,12 @@
939	941	echo esc_attr( $url_back );
940	942	?>">
941	943	<?php
942	944	$this->add_parent_args();
	945	+ // phpcs:disable WordPress.Security.EscapeOutput
943	946	echo $this->page_number_item;
944		- // phpcs:ignore WordPress.Security.EscapeOutput
945	947	echo $this->add_case_sensitive_search();
	948	+ // phpcs:enable WordPress.Security.EscapeOutput
946	949	?>
947	950	<?php
948	951	if ( is_admin() ) {
949	952	// Hide schema and table name on front-end
		@@ -996,11 +999,11 @@
996	999	if (jQuery(obj).val() === '') {
997	1000	objData = jQuery(obj).data();
998	1001	if (objData.dbIsNull===undefined || objData.dbIsNull!==false) {
999	1002	alert(<?php
1000		- echo __( '\'Item\'', 'wp-data-access' );
1001		- ?> +' ' + jQuery(obj).attr('name') + ' ' + <?php
1002		- echo __( '\'must be entered\'', 'wp-data-access' );
	1003	+ echo "'" . esc_attr__( 'Item', 'wp-data-access' ) . "'";
	1004	+ ?> + ' ' + jQuery(obj).attr('name') + ' ' + <?php
	1005	+ echo "'" . esc_attr__( 'must be entered', 'wp-data-access' ) . "'";
1003	1006	?>);
1004	1007	failed = true;
1005	1008	} else {
1006	1009	element_old = jQuery("input[name=" + jQuery(obj).attr("name") + "_old" + "]");
		@@ -1005,11 +1008,11 @@
1005	1008	} else {
1006	1009	element_old = jQuery("input[name=" + jQuery(obj).attr("name") + "_old" + "]");
1007	1010	if (element_old && element_old.val()!=='') {
1008	1011	alert(<?php
1009		- echo __( '\'Item\'', 'wp-data-access' );
	1012	+ echo "'" . esc_attr__( 'Item', 'wp-data-access' ) . "'";
1010	1013	?> +' ' + jQuery(obj).attr('name') + ' ' + <?php
1011		- echo __( '\'must be entered\'', 'wp-data-access' );
	1014	+ echo "'" . esc_attr__( 'must be entered', 'wp-data-access' ) . "'";
1012	1015	?>);
1013	1016	failed = true;
1014	1017	}
1015	1018	}
		@@ -1016,11 +1019,11 @@
1016	1019	}
1017	1020	});
1018	1021	jQuery('.wpda_input_error').each(function(i, obj) {
1019	1022	alert(<?php
1020		- echo __( '\'Column\'', 'wp-data-access' );
1021		- ?> +' ' + jQuery(obj).attr('name') + <?php
1022		- echo __( '\': max size exceeded\'', 'wp-data-access' );
	1023	+ echo "'" . esc_attr__( 'Column', 'wp-data-access' ) . "'";
	1024	+ ?> + ' ' + jQuery(obj).attr('name') + <?php
	1025	+ echo "'" . esc_attr__( ': max size exceeded', 'wp-data-access' ) . "'";
1023	1026	?>);
1024	1027	failed = true;
1025	1028	});
1026	1029	jQuery('.wpda_hyperlink').each(function(i, obj) {
		@@ -1086,9 +1089,9 @@
1086	1089	if (isNaN(this.value) || (numberFormat[0]!='' && this.value.length>numberFormat[0])) {
1087	1090	jQuery(this).addClass('wpda_input_error');
1088	1091	if (this.value.length>numberFormat[0]) {
1089	1092	jQuery.notify('<?php
1090		- echo __( 'Max size exceeded' );
	1093	+ esc_html_e( 'Max size exceeded', 'wp-data-access' );
1091	1094	?>','error');
1092	1095	}
1093	1096	} else {
1094	1097	jQuery(this).removeClass('wpda_input_error');
		@@ -1101,9 +1104,9 @@
1101	1104	if (isNaN(this.value) || this.value>=maxNumber) {
1102	1105	jQuery(this).addClass('wpda_input_error');
1103	1106	if (this.value>=maxNumber) {
1104	1107	jQuery.notify('<?php
1105		- echo __( 'Max size exceeded' );
	1108	+ esc_html_e( 'Max size exceeded', 'wp-data-access' );
1106	1109	?>','error');
1107	1110	}
1108	1111	} else {
1109	1112	jQuery(this).removeClass('wpda_input_error');
		@@ -1114,9 +1117,9 @@
1114	1117	}
1115	1118	if (currentNumber.length===2 && currentNumber[1].length>numberFormat[1]) {
1116	1119	jQuery(this).addClass('wpda_input_error');
1117	1120	jQuery.notify('<?php
1118		- echo __( 'Max size exceeded' );
	1121	+ esc_html_e( 'Max size exceeded', 'wp-data-access' );
1119	1122	?>','error');
1120	1123	}
1121	1124	});
1122	1125	jQuery( '.wpda_tooltip' ).tooltip();
		@@ -1128,10 +1131,11 @@
1128	1131	jQuery("#wpda_new_row").submit();
1129	1132	});
1130	1133	});
1131	1134	<?php
	1135	+ // phpcs:disable WordPress.Security.EscapeOutput
1132	1136	echo $js_code;
1133		- // phpcs:ignore WordPress.Security.EscapeOutput
	1137	+ // phpcs:enable WordPress.Security.EscapeOutput
1134	1138	?>
1135	1139	</script>
1136	1140	<?php
1137	1141	}
		@@ -1263,9 +1267,8 @@
1263	1267	* @since 1.0.0
1264	1268	*/
1265	1269	protected function prepare_items( $set_back_form_values = false ) {
1266	1270	$count_cols = count( $this->table_columns );
1267		- //phpcs:ignore - 8.1 proof
1268	1271	for ($i = 0; $i < $count_cols; $i++) {
1269	1272	$column_name = $this->table_columns[$i]['column_name'];
1270	1273	$item_enum = '';
1271	1274	if ( 'enum' === $this->table_columns[$i]['data_type'] || 'set' === $this->table_columns[$i]['data_type'] ) {
		@@ -1514,9 +1517,8 @@
1514	1517	if ( !is_array( $column_array ) ) {
1515	1518	return -1;
1516	1519	}
1517	1520	$count_cols = count( $column_array );
1518		- //phpcs:ignore - 8.1 proof
1519	1521	for ($i = 0; $i < $count_cols; $i++) {
1520	1522	if ( $column_array[$i]['column_name'] === $column_name ) {
1521	1523	return $i;
1522	1524	}
		@@ -1633,4 +1635,6 @@
1633	1635	return $this->row;
1634	1636	}
1635	1637
1636	1638	}
	1639	+
	1640	+// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing