← All changes | WPDataAccess/API/WPDA_API_Core.php +35 -21 5.5.41 → 5.5.84 View file →

		@@ -162,10 +162,12 @@
162	162	'app_query' => array(
163	163	'required' => false,
164	164	'type' => 'string',
165	165	'description' => __( 'Custom query', 'wp-data-access' ),
166		- 'sanitize_callback' => 'sanitize_textarea_field',
167		- 'validate_callback' => 'rest_validate_request_arg',
	166	+ 'sanitize_callback' => function ( $param ) {
	167	+ return html_entity_decode( wp_unslash( $param ), ENT_QUOTES );
	168	+ // Preserve SQL operators
	169	+ },
168	170	),
169	171	'col' => array(
170	172	'required' => true,
171	173	'type' => 'string',
		@@ -195,9 +197,9 @@
195	197	'page_index' => array(
196	198	'required' => false,
197	199	'type' => 'integer',
198	200	'description' => __( 'Page number', 'wp-data-access' ),
199		- 'default' => 1,
	201	+ 'default' => 0,
200	202	'minimum' => 0,
201	203	'sanitize_callback' => 'absint',
202	204	'validate_callback' => 'rest_validate_request_arg',
203	205	),
		@@ -404,8 +406,15 @@
404	406	'validate_callback' => function ( $param ) {
405	407	return is_array( $param );
406	408	},
407	409	),
	410	+ 'copy_key' => array(
	411	+ 'required' => true,
	412	+ 'type' => 'string',
	413	+ 'description' => __( 'Internal copy action identifier', 'wp-data-access' ),
	414	+ 'sanitize_callback' => 'sanitize_text_field',
	415	+ 'validate_callback' => 'rest_validate_request_arg',
	416	+ ),
408	417	'access' => array(
409	418	'required' => true,
410	419	'type' => 'string',
411	420	'description' => __( 'Access (user | global) ', 'wp-data-access' ),
		@@ -420,9 +429,10 @@
420	429	'required' => true,
421	430	'type' => 'string',
422	431	'description' => __( 'SQL query', 'wp-data-access' ),
423	432	'sanitize_callback' => function ( $param ) {
424		- return wp_kses_post( $param );
	433	+ return html_entity_decode( wp_unslash( $param ), ENT_QUOTES );
	434	+ // Preserve SQL operators
425	435	},
426	436	),
427	437	'name' => array(
428	438	'required' => true,
		@@ -432,11 +442,13 @@
432	442	'validate_callback' => 'rest_validate_request_arg',
433	443	),
434	444	'vqb' => array(
435	445	'required' => false,
436		- 'type' => 'boolean',
437		- 'description' => __( 'Query uses Visual Query Builder', 'wp-data-access' ),
438		- 'sanitize_callback' => 'sanitize_text_field',
	446	+ 'type' => 'mixed',
	447	+ 'description' => __( 'Visual Query Builder', 'wp-data-access' ),
	448	+ 'sanitize_callback' => function ( $param ) {
	449	+ return rest_sanitize_object( $param );
	450	+ },
439	451	'validate_callback' => 'rest_validate_request_arg',
440	452	),
441	453	'params' => array(
442	454	'required' => false,
		@@ -443,18 +455,20 @@
443	455	'type' => 'array',
444	456	'description' => __( 'Cron job parameters', 'wp-data-access' ),
445	457	'sanitize_callback' => function ( $param ) {
446	458	$params = array();
447		- foreach ( $param as $key => $value ) {
448		- if ( 'params' === $key || 'notify' === $key ) {
449		- // Sanitize custom parameters
450		- $custom_params = array();
451		- foreach ( $value as $param_key => $param_value ) {
452		- $custom_params[sanitize_text_field( $param_key )] = sanitize_text_field( $param_value );
	459	+ if ( is_array( $param ) ) {
	460	+ foreach ( $param as $key => $value ) {
	461	+ if ( 'params' === $key || 'notify' === $key ) {
	462	+ // Sanitize custom parameters
	463	+ $custom_params = array();
	464	+ foreach ( $value as $param_key => $param_value ) {
	465	+ $custom_params[sanitize_text_field( $param_key )] = sanitize_text_field( $param_value );
	466	+ }
	467	+ $params[sanitize_text_field( $key )] = $custom_params;
	468	+ } else {
	469	+ $params[sanitize_text_field( $key )] = sanitize_text_field( $value );
453	470	}
454		- $params[sanitize_text_field( $key )] = $custom_params;
455		- } else {
456		- $params[sanitize_text_field( $key )] = sanitize_text_field( $value );
457	471	}
458	472	}
459	473	return $params;
460	474	},
		@@ -531,9 +545,9 @@
531	545	return false;
532	546	}
533	547
534	548	public static function sanitize_db_identifier( $param ) {
535		- if ( null === $param ) {
	549	+ if ( !is_string( $param ) ) {
536	550	return null;
537	551	}
538	552	// Preserve starting and trailing spaces
539	553	$spaces_before = strlen( $param ) - strlen( ltrim( $param ) );
		@@ -589,15 +603,16 @@
589	603	return $users;
590	604	}
591	605
592	606	protected function get_env() {
593		- return array(
594		- 'ip' => $_SERVER['REMOTE_ADDR'],
	607	+ $env = array(
	608	+ 'ip' => ( isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '' ),
595	609	'id' => WPDA::get_current_user_id(),
596	610	'user' => WPDA::get_current_user_login(),
597	611	'roles' => WPDA::get_current_user_roles(),
598	612	'login' => 'anonymous' !== WPDA::get_current_user_login(),
599	613	);
	614	+ return $env;
600	615	}
601	616
602	617	protected function get_table_info( $dbs, $tbl, $default_where = '' ) {
603	618	$wpdadb = WPDADB::get_db_connection( $dbs );
		@@ -607,11 +622,10 @@
607	622	'engine' => null,
608	623	'count' => null,
609	624	);
610	625	}
611		- $query = $wpdadb->prepare( "\n\t\t\t\t\tselect table_type,\n\t\t\t\t\t engine,\n\t\t\t\t\t table_rows\n\t\t\t\t\t from information_schema.tables\n\t\t\t\t\t where table_schema = %s\n\t\t\t\t\t and table_name = %s\n\t\t\t\t\t order by table_name\n\t\t\t\t", array($wpdadb->dbname, $tbl) );
	626	+ $query = $wpdadb->prepare( "\n\t\t\t\t\tselect table_type,\n\t\t\t\t\t engine,\n\t\t\t\t\t table_rows\n\t\t\t\t\t from information_schema.tables\n\t\t\t\t\t where table_schema = %s\n\t\t\t\t\t and table_name = %s\n\t\t\t\t", array($wpdadb->dbname, $tbl) );
612	627	$resultset = $wpdadb->get_results( $query, 'ARRAY_N' );
613		- // phpcs:ignore Standard.Category.SniffName.ErrorCode
614	628	if ( count( $resultset ) === 1 ) {
615	629	if ( null !== $resultset[0][2] ) {
616	630	return array(
617	631	'type' => $resultset[0][0],