| @@ -162,10 +162,12 @@ | ||
| 162 | 162 | 'app_query' => array( |
| 163 | 163 | 'required' => false, |
| 164 | 164 | 'type' => 'string', |
| 165 | 165 | 'description' => __( 'Custom query', 'wp-data-access' ), |
| 166 | - 'sanitize_callback' => 'sanitize_textarea_field', | |
| 167 | - 'validate_callback' => 'rest_validate_request_arg', | |
| 166 | + 'sanitize_callback' => function ( $param ) { | |
| 167 | + return html_entity_decode( wp_unslash( $param ), ENT_QUOTES ); | |
| 168 | + // Preserve SQL operators | |
| 169 | + }, | |
| 168 | 170 | ), |
| 169 | 171 | 'col' => array( |
| 170 | 172 | 'required' => true, |
| 171 | 173 | 'type' => 'string', |
| @@ -195,9 +197,9 @@ | ||
| 195 | 197 | 'page_index' => array( |
| 196 | 198 | 'required' => false, |
| 197 | 199 | 'type' => 'integer', |
| 198 | 200 | 'description' => __( 'Page number', 'wp-data-access' ), |
| 199 | - 'default' => 1, | |
| 201 | + 'default' => 0, | |
| 200 | 202 | 'minimum' => 0, |
| 201 | 203 | 'sanitize_callback' => 'absint', |
| 202 | 204 | 'validate_callback' => 'rest_validate_request_arg', |
| 203 | 205 | ), |
| @@ -390,9 +392,9 @@ | ||
| 390 | 392 | 'sanitize_callback' => 'absint', |
| 391 | 393 | 'validate_callback' => 'rest_validate_request_arg', |
| 392 | 394 | ), |
| 393 | 395 | 'media' => array( |
| 394 | - 'required' => true, | |
| 396 | + 'required' => false, | |
| 395 | 397 | 'type' => 'mixed', |
| 396 | 398 | 'description' => __( 'Media columns', 'wp-data-access' ), |
| 397 | 399 | 'sanitize_callback' => function ( $param ) { |
| 398 | 400 | $media = array(); |
| @@ -404,8 +406,77 @@ | ||
| 404 | 406 | 'validate_callback' => function ( $param ) { |
| 405 | 407 | return is_array( $param ); |
| 406 | 408 | }, |
| 407 | 409 | ), |
| 410 | + 'copy_key' => array( | |
| 411 | + 'required' => true, | |
| 412 | + 'type' => 'string', | |
| 413 | + 'description' => __( 'Internal copy action identifier', 'wp-data-access' ), | |
| 414 | + 'sanitize_callback' => 'sanitize_text_field', | |
| 415 | + 'validate_callback' => 'rest_validate_request_arg', | |
| 416 | + ), | |
| 417 | + 'access' => array( | |
| 418 | + 'required' => true, | |
| 419 | + 'type' => 'string', | |
| 420 | + 'description' => __( 'Access (user | global) ', 'wp-data-access' ), | |
| 421 | + 'sanitize_callback' => function ( $param ) { | |
| 422 | + return ( 'global' === strtolower( $param ) ? 'global' : 'user' ); | |
| 423 | + }, | |
| 424 | + 'validate_callback' => function ( $param ) { | |
| 425 | + return 'global' === strtolower( $param ) || 'user' === strtolower( $param ); | |
| 426 | + }, | |
| 427 | + ), | |
| 428 | + 'query' => array( | |
| 429 | + 'required' => true, | |
| 430 | + 'type' => 'string', | |
| 431 | + 'description' => __( 'SQL query', 'wp-data-access' ), | |
| 432 | + 'sanitize_callback' => function ( $param ) { | |
| 433 | + return html_entity_decode( wp_unslash( $param ), ENT_QUOTES ); | |
| 434 | + // Preserve SQL operators | |
| 435 | + }, | |
| 436 | + ), | |
| 437 | + 'name' => array( | |
| 438 | + 'required' => true, | |
| 439 | + 'type' => 'string', | |
| 440 | + 'description' => __( 'Query name', 'wp-data-access' ), | |
| 441 | + 'sanitize_callback' => 'sanitize_text_field', | |
| 442 | + 'validate_callback' => 'rest_validate_request_arg', | |
| 443 | + ), | |
| 444 | + 'vqb' => array( | |
| 445 | + 'required' => false, | |
| 446 | + 'type' => 'mixed', | |
| 447 | + 'description' => __( 'Visual Query Builder', 'wp-data-access' ), | |
| 448 | + 'sanitize_callback' => function ( $param ) { | |
| 449 | + return rest_sanitize_object( $param ); | |
| 450 | + }, | |
| 451 | + 'validate_callback' => 'rest_validate_request_arg', | |
| 452 | + ), | |
| 453 | + 'params' => array( | |
| 454 | + 'required' => false, | |
| 455 | + 'type' => 'array', | |
| 456 | + 'description' => __( 'Cron job parameters', 'wp-data-access' ), | |
| 457 | + 'sanitize_callback' => function ( $param ) { | |
| 458 | + $params = array(); | |
| 459 | + if ( is_array( $param ) ) { | |
| 460 | + foreach ( $param as $key => $value ) { | |
| 461 | + if ( 'params' === $key || 'notify' === $key ) { | |
| 462 | + // Sanitize custom parameters | |
| 463 | + $custom_params = array(); | |
| 464 | + foreach ( $value as $param_key => $param_value ) { | |
| 465 | + $custom_params[sanitize_text_field( $param_key )] = sanitize_text_field( $param_value ); | |
| 466 | + } | |
| 467 | + $params[sanitize_text_field( $key )] = $custom_params; | |
| 468 | + } else { | |
| 469 | + $params[sanitize_text_field( $key )] = sanitize_text_field( $value ); | |
| 470 | + } | |
| 471 | + } | |
| 472 | + } | |
| 473 | + return $params; | |
| 474 | + }, | |
| 475 | + 'validate_callback' => function ( $param ) { | |
| 476 | + return is_array( $param ); | |
| 477 | + }, | |
| 478 | + ), | |
| 408 | 479 | ); |
| 409 | 480 | } |
| 410 | 481 | |
| 411 | 482 | protected function get_param( $key, $description = null ) { |
| @@ -437,9 +508,9 @@ | ||
| 437 | 508 | } |
| 438 | 509 | return WPDA_API_Core::$user_login; |
| 439 | 510 | } |
| 440 | 511 | |
| 441 | - protected function current_user_can_access( $admins_only = false ) { | |
| 512 | + protected function current_user_can_access() { | |
| 442 | 513 | return WPDA::current_user_is_admin(); |
| 443 | 514 | } |
| 444 | 515 | |
| 445 | 516 | protected function unauthorized() { |
| @@ -447,9 +518,9 @@ | ||
| 447 | 518 | 'status' => 401, |
| 448 | 519 | )); |
| 449 | 520 | } |
| 450 | 521 | |
| 451 | - protected function current_user_token_valid( $request, $token_required = false ) { | |
| 522 | + protected function current_user_token_valid( $request ) { | |
| 452 | 523 | return wp_verify_nonce( $request->get_header( 'X-WP-Nonce' ), 'wp_rest' ); |
| 453 | 524 | } |
| 454 | 525 | |
| 455 | 526 | protected function invalid_nonce() { |
| @@ -474,9 +545,9 @@ | ||
| 474 | 545 | return false; |
| 475 | 546 | } |
| 476 | 547 | |
| 477 | 548 | public static function sanitize_db_identifier( $param ) { |
| 478 | - if ( null === $param ) { | |
| 549 | + if ( !is_string( $param ) ) { | |
| 479 | 550 | return null; |
| 480 | 551 | } |
| 481 | 552 | // Preserve starting and trailing spaces |
| 482 | 553 | $spaces_before = strlen( $param ) - strlen( ltrim( $param ) ); |
| @@ -532,15 +603,16 @@ | ||
| 532 | 603 | return $users; |
| 533 | 604 | } |
| 534 | 605 | |
| 535 | 606 | protected function get_env() { |
| 536 | - return array( | |
| 537 | - 'ip' => $_SERVER['REMOTE_ADDR'], | |
| 607 | + $env = array( | |
| 608 | + 'ip' => ( isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '' ), | |
| 538 | 609 | 'id' => WPDA::get_current_user_id(), |
| 539 | 610 | 'user' => WPDA::get_current_user_login(), |
| 540 | 611 | 'roles' => WPDA::get_current_user_roles(), |
| 541 | 612 | 'login' => 'anonymous' !== WPDA::get_current_user_login(), |
| 542 | 613 | ); |
| 614 | + return $env; | |
| 543 | 615 | } |
| 544 | 616 | |
| 545 | 617 | protected function get_table_info( $dbs, $tbl, $default_where = '' ) { |
| 546 | 618 | $wpdadb = WPDADB::get_db_connection( $dbs ); |
| @@ -550,11 +622,10 @@ | ||
| 550 | 622 | 'engine' => null, |
| 551 | 623 | 'count' => null, |
| 552 | 624 | ); |
| 553 | 625 | } |
| 554 | - $query = $wpdadb->prepare( "\n\t\t\t\t\tselect table_type,\n\t\t\t\t\t engine,\n\t\t\t\t\t table_rows\n\t\t\t\t\t from information_schema.tables\n\t\t\t\t\t where table_schema = %s\n\t\t\t\t\t and table_name = %s\n\t\t\t\t\t order by table_name\n\t\t\t\t", array($wpdadb->dbname, $tbl) ); | |
| 626 | + $query = $wpdadb->prepare( "\n\t\t\t\t\tselect table_type,\n\t\t\t\t\t engine,\n\t\t\t\t\t table_rows\n\t\t\t\t\t from information_schema.tables\n\t\t\t\t\t where table_schema = %s\n\t\t\t\t\t and table_name = %s\n\t\t\t\t", array($wpdadb->dbname, $tbl) ); | |
| 555 | 627 | $resultset = $wpdadb->get_results( $query, 'ARRAY_N' ); |
| 556 | - // phpcs:ignore Standard.Category.SniffName.ErrorCode | |
| 557 | 628 | if ( count( $resultset ) === 1 ) { |
| 558 | 629 | if ( null !== $resultset[0][2] ) { |
| 559 | 630 | return array( |
| 560 | 631 | 'type' => $resultset[0][0], |
| @@ -591,16 +662,22 @@ | ||
| 591 | 662 | return -1; |
| 592 | 663 | } |
| 593 | 664 | } |
| 594 | 665 | |
| 595 | - protected function get_media( $dbs, $tbl, $columns ) { | |
| 666 | + protected function get_media( | |
| 667 | + $dbs, | |
| 668 | + $tbl, | |
| 669 | + $columns, | |
| 670 | + $prefix = '' | |
| 671 | + ) { | |
| 596 | 672 | $media = array(); |
| 597 | 673 | $wp_media = array(); |
| 598 | 674 | foreach ( $columns as $column ) { |
| 599 | 675 | $media_type = WPDA_Media_Model::get_column_media( $tbl, $column['column_name'], $dbs ); |
| 676 | + $column_name = $prefix . $column['column_name']; | |
| 600 | 677 | switch ( $media_type ) { |
| 601 | 678 | case 'ImageURL': |
| 602 | - $media[$column['column_name']] = $media_type; | |
| 679 | + $media[$column_name] = $media_type; | |
| 603 | 680 | break; |
| 604 | 681 | case 'Hyperlink': |
| 605 | 682 | // Get table settings. |
| 606 | 683 | $table_settings_db = WPDA_Table_Settings_Model::query( $tbl, $dbs ); |
| @@ -610,20 +687,20 @@ | ||
| 610 | 687 | $table_settings = null; |
| 611 | 688 | } |
| 612 | 689 | // Check hyperlink format. |
| 613 | 690 | if ( isset( $table_settings['table_settings']['hyperlink_definition'] ) && 'text' === $table_settings['table_settings']['hyperlink_definition'] ) { |
| 614 | - $media[$column['column_name']] = 'HyperlinkURL'; | |
| 691 | + $media[$column_name] = 'HyperlinkURL'; | |
| 615 | 692 | } else { |
| 616 | - $media[$column['column_name']] = 'HyperlinkObject'; | |
| 693 | + $media[$column_name] = 'HyperlinkObject'; | |
| 617 | 694 | } |
| 618 | 695 | break; |
| 619 | 696 | default: |
| 620 | 697 | if ( false !== $media_type ) { |
| 621 | 698 | // Handle WordPress Media Library integration |
| 622 | - $media[$column['column_name']] = "WP-{$media_type}"; | |
| 699 | + $media[$column_name] = "WP-{$media_type}"; | |
| 623 | 700 | } |
| 624 | 701 | } |
| 625 | - $wp_media[$column['column_name']] = $media_type; | |
| 702 | + $wp_media[$column_name] = $media_type; | |
| 626 | 703 | } |
| 627 | 704 | return [ |
| 628 | 705 | 'media' => $media, |
| 629 | 706 | 'wp_media' => $wp_media, |
