← All changes | WPDataProjects/WPDP.php +26 -17 5.5.37 → 5.5.84 View file →

		@@ -102,12 +102,13 @@
102	102	/**
103	103	* WPDP constructor
104	104	*/
105	105	public function __construct( $main_menu_slug = null ) {
	106	+ // phpcs:disable WordPress.Security.NonceVerification.Recommended -- verfication in main app
106	107	if ( isset( $_REQUEST['page'] ) ) {
107	108	$this->page = sanitize_text_field( wp_unslash( $_REQUEST['page'] ) );
108		- // input var okay.
109	109	}
	110	+ // phpcs:enable WordPress.Security.NonceVerification.Recommended
110	111	$this->main_menu_slug = $main_menu_slug;
111	112	$this->projects_page_title = 'Data Projects';
112	113	$this->templates_page_title = 'Project Templates';
113	114	}
		@@ -199,12 +200,12 @@
199	200	?>
200	201	<div class="wrap">
201	202	<h1 class="wp-heading-inline">
202	203	<span><?php
203		- echo $this->projects_page_title;
	204	+ echo esc_attr( $this->projects_page_title );
204	205	?></span>
205	206	<a href="<?php
206		- echo 'https://wpdataaccess.com/docs/data-forms/data-projects/';
	207	+ echo 'https://docs.legacy.wpdataaccess.com/docs/data-projects/';
207	208	?>" target="_blank">
208	209	<span class="dashicons dashicons-editor-help"
209	210	style="text-decoration:none;vertical-align:top;font-size:30px;">
210	211	</span></a>
		@@ -210,9 +211,9 @@
210	211	</span></a>
211	212	</h1>
212	213	<p>
213	214	<?php
214		- echo __( 'ERROR: Repository table(s) not found!', 'wp-data-access' );
	215	+ esc_html_e( 'ERROR: Repository table(s) not found!', 'wp-data-access' );
215	216	?>
216	217	</p>
217	218	</div>
218	219	<?php
		@@ -224,12 +225,12 @@
224	225	?>
225	226	<div class="wrap">
226	227	<h1 class="wp-heading-inline">
227	228	<span><?php
228		- echo $this->projects_page_title;
	229	+ echo esc_attr( $this->projects_page_title );
229	230	?></span>
230	231	<a href="<?php
231		- echo 'https://wpdataaccess.com/docs/templates/project-templates/';
	232	+ echo 'https://docs.legacy.wpdataaccess.com/docs/project-templates/';
232	233	?>" target="_blank">
233	234	<span class="dashicons dashicons-editor-help"
234	235	style="text-decoration:none;vertical-align:top;font-size:30px;">
235	236	</span></a>
		@@ -235,9 +236,9 @@
235	236	</span></a>
236	237	</h1>
237	238	<p>
238	239	<?php
239		- echo __( 'ERROR: Repository table(s) not found!', 'wp-data-access' );
	240	+ esc_html_e( 'ERROR: Repository table(s) not found!', 'wp-data-access' );
240	241	?>
241	242	</p>
242	243	</div>
243	244	<?php
		@@ -257,12 +258,13 @@
257	258	global $wpdb;
258	259	$project_project_table_name = $wpdb->prefix . 'wpda_project';
259	260	$project_page_table_name = $wpdb->prefix . 'wpda_project_page';
260	261	$query_projects = "select * from {$project_project_table_name} where add_to_menu = 'Yes' order by project_sequence";
	262	+ // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter -- plugin table
261	263	$projects = $wpdb->get_results( $query_projects, 'ARRAY_A' );
262		- // phpcs:ignore Standard.Category.SniffName.ErrorCode
	264	+ // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
263	265	if ( count( $projects ) > 0 ) {
264		- //phpcs:ignore - 8.1 proof
	266	+ // phpcs:ignore -- 8.1 proof
265	267	// Check for repository tables to prevent dashboard errors.
266	268	if ( !WPDP_Project_Design_Table_Model::table_exists() || !WPDP_Page_Model::table_exists() ) {
267	269	return;
268	270	}
		@@ -277,23 +279,26 @@
277	279	if ( false === $user_roles ) {
278	280	// Cannot determine the user role(s). Not able to show project menus.
279	281	break;
280	282	}
	283	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- plugin table
281	284	$query_pages = $wpdb->prepare( " select * from {$project_page_table_name} " . " where project_id = %d " . " and add_to_menu = 'Yes' " . " order by page_sequence", [$project['project_id']] );
	285	+ // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	286	+ // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
282	287	$pages = $wpdb->get_results( $query_pages, 'ARRAY_A' );
283		- // phpcs:ignore Standard.Category.SniffName.ErrorCode
	288	+ // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, PluginCheck.Security.DirectDB.UnescapedDBParameter
284	289	$project_menu_shown = false;
285	290	foreach ( $pages as $page ) {
286	291	$user_has_role = false;
287	292	if ( '' === $page['page_role'] || null === $page['page_role'] ) {
288	293	$user_has_role = in_array( 'administrator', $user_roles );
289		- //phpcs:ignore - 8.1 proof
	294	+ // phpcs:ignore -- 8.1 proof
290	295	} else {
291	296	$user_role_array = explode( ',', $page['page_role'] );
292		- //phpcs:ignore - 8.1 proof
	297	+ // phpcs:ignore -- 8.1 proof
293	298	foreach ( $user_role_array as $user_role_array_item ) {
294	299	$user_has_role = in_array( $user_role_array_item, $user_roles );
295		- //phpcs:ignore - 8.1 proof
	300	+ // phpcs:ignore -- 8.1 proof
296	301	if ( $user_has_role ) {
297	302	break;
298	303	}
299	304	}
		@@ -478,12 +483,12 @@
478	483	* Manage project page
479	484	*/
480	485	public function manage_project_page() {
481	486	$ids = explode( '_', (string) $this->page );
482		- //phpcs:ignore - 8.1 proof
	487	+ // phpcs:ignore -- 8.1 proof
483	488	if ( 4 !== count( $ids ) ) {
484		- //phpcs:ignore - 8.1 proof
485		- wp_die( __( 'ERROR: Wrong arguments [missing page]', 'wp-data-access' ) );
	489	+ // phpcs:ignore -- 8.1 proof
	490	+ wp_die( esc_attr__( 'ERROR: Wrong arguments [missing page]', 'wp-data-access' ) );
486	491	}
487	492	$project_id = $ids[2];
488	493	$page_id = $ids[3];
489	494	if ( isset( $this->wpdp_project_views[$project_id . '_' . $page_id] ) ) {
		@@ -492,13 +497,17 @@
492	497	if ( isset( $this->wpdp_projects_content[$project_id . '_' . $page_id] ) ) {
493	498	$post_id = $this->wpdp_projects_content[$project_id . '_' . $page_id];
494	499	$post = get_post( $post_id );
495	500	$content = $post->post_content;
	501	+ // phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
496	502	$content = apply_filters( 'the_content', $content );
	503	+ // phpcs:enable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
497	504	$content = str_replace( ']]>', ']]&gt;', $content );
	505	+ // phpcs:disable WordPress.Security.EscapeOutput
498	506	echo $content;
	507	+ // phpcs:enable WordPress.Security.EscapeOutput
499	508	} else {
500		- wp_die( __( 'ERROR: Project page initialization failed', 'wp-data-access' ) );
	509	+ wp_die( esc_attr__( 'ERROR: Project page initialization failed', 'wp-data-access' ) );
501	510	}
502	511	}
503	512	}
504	513