| @@ -162,10 +162,12 @@ | ||
| 162 | 162 | 'app_query' => array( |
| 163 | 163 | 'required' => false, |
| 164 | 164 | 'type' => 'string', |
| 165 | 165 | 'description' => __( 'Custom query', 'wp-data-access' ), |
| 166 | - 'sanitize_callback' => 'sanitize_textarea_field', | |
| 167 | - 'validate_callback' => 'rest_validate_request_arg', | |
| 166 | + 'sanitize_callback' => function ( $param ) { | |
| 167 | + return html_entity_decode( wp_unslash( $param ), ENT_QUOTES ); | |
| 168 | + // Preserve SQL operators | |
| 169 | + }, | |
| 168 | 170 | ), |
| 169 | 171 | 'col' => array( |
| 170 | 172 | 'required' => true, |
| 171 | 173 | 'type' => 'string', |
| @@ -195,9 +197,9 @@ | ||
| 195 | 197 | 'page_index' => array( |
| 196 | 198 | 'required' => false, |
| 197 | 199 | 'type' => 'integer', |
| 198 | 200 | 'description' => __( 'Page number', 'wp-data-access' ), |
| 199 | - 'default' => 1, | |
| 201 | + 'default' => 0, | |
| 200 | 202 | 'minimum' => 0, |
| 201 | 203 | 'sanitize_callback' => 'absint', |
| 202 | 204 | 'validate_callback' => 'rest_validate_request_arg', |
| 203 | 205 | ), |
| @@ -404,8 +406,15 @@ | ||
| 404 | 406 | 'validate_callback' => function ( $param ) { |
| 405 | 407 | return is_array( $param ); |
| 406 | 408 | }, |
| 407 | 409 | ), |
| 410 | + 'copy_key' => array( | |
| 411 | + 'required' => true, | |
| 412 | + 'type' => 'string', | |
| 413 | + 'description' => __( 'Internal copy action identifier', 'wp-data-access' ), | |
| 414 | + 'sanitize_callback' => 'sanitize_text_field', | |
| 415 | + 'validate_callback' => 'rest_validate_request_arg', | |
| 416 | + ), | |
| 408 | 417 | 'access' => array( |
| 409 | 418 | 'required' => true, |
| 410 | 419 | 'type' => 'string', |
| 411 | 420 | 'description' => __( 'Access (user | global) ', 'wp-data-access' ), |
| @@ -433,11 +442,13 @@ | ||
| 433 | 442 | 'validate_callback' => 'rest_validate_request_arg', |
| 434 | 443 | ), |
| 435 | 444 | 'vqb' => array( |
| 436 | 445 | 'required' => false, |
| 437 | - 'type' => 'boolean', | |
| 438 | - 'description' => __( 'Query uses Visual Query Builder', 'wp-data-access' ), | |
| 439 | - 'sanitize_callback' => 'sanitize_text_field', | |
| 446 | + 'type' => 'mixed', | |
| 447 | + 'description' => __( 'Visual Query Builder', 'wp-data-access' ), | |
| 448 | + 'sanitize_callback' => function ( $param ) { | |
| 449 | + return rest_sanitize_object( $param ); | |
| 450 | + }, | |
| 440 | 451 | 'validate_callback' => 'rest_validate_request_arg', |
| 441 | 452 | ), |
| 442 | 453 | 'params' => array( |
| 443 | 454 | 'required' => false, |
| @@ -444,18 +455,20 @@ | ||
| 444 | 455 | 'type' => 'array', |
| 445 | 456 | 'description' => __( 'Cron job parameters', 'wp-data-access' ), |
| 446 | 457 | 'sanitize_callback' => function ( $param ) { |
| 447 | 458 | $params = array(); |
| 448 | - foreach ( $param as $key => $value ) { | |
| 449 | - if ( 'params' === $key || 'notify' === $key ) { | |
| 450 | - // Sanitize custom parameters | |
| 451 | - $custom_params = array(); | |
| 452 | - foreach ( $value as $param_key => $param_value ) { | |
| 453 | - $custom_params[sanitize_text_field( $param_key )] = sanitize_text_field( $param_value ); | |
| 459 | + if ( is_array( $param ) ) { | |
| 460 | + foreach ( $param as $key => $value ) { | |
| 461 | + if ( 'params' === $key || 'notify' === $key ) { | |
| 462 | + // Sanitize custom parameters | |
| 463 | + $custom_params = array(); | |
| 464 | + foreach ( $value as $param_key => $param_value ) { | |
| 465 | + $custom_params[sanitize_text_field( $param_key )] = sanitize_text_field( $param_value ); | |
| 466 | + } | |
| 467 | + $params[sanitize_text_field( $key )] = $custom_params; | |
| 468 | + } else { | |
| 469 | + $params[sanitize_text_field( $key )] = sanitize_text_field( $value ); | |
| 454 | 470 | } |
| 455 | - $params[sanitize_text_field( $key )] = $custom_params; | |
| 456 | - } else { | |
| 457 | - $params[sanitize_text_field( $key )] = sanitize_text_field( $value ); | |
| 458 | 471 | } |
| 459 | 472 | } |
| 460 | 473 | return $params; |
| 461 | 474 | }, |
| @@ -590,15 +603,16 @@ | ||
| 590 | 603 | return $users; |
| 591 | 604 | } |
| 592 | 605 | |
| 593 | 606 | protected function get_env() { |
| 594 | - return array( | |
| 595 | - 'ip' => $_SERVER['REMOTE_ADDR'], | |
| 607 | + $env = array( | |
| 608 | + 'ip' => ( isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '' ), | |
| 596 | 609 | 'id' => WPDA::get_current_user_id(), |
| 597 | 610 | 'user' => WPDA::get_current_user_login(), |
| 598 | 611 | 'roles' => WPDA::get_current_user_roles(), |
| 599 | 612 | 'login' => 'anonymous' !== WPDA::get_current_user_login(), |
| 600 | 613 | ); |
| 614 | + return $env; | |
| 601 | 615 | } |
| 602 | 616 | |
| 603 | 617 | protected function get_table_info( $dbs, $tbl, $default_where = '' ) { |
| 604 | 618 | $wpdadb = WPDADB::get_db_connection( $dbs ); |
| @@ -608,11 +622,10 @@ | ||
| 608 | 622 | 'engine' => null, |
| 609 | 623 | 'count' => null, |
| 610 | 624 | ); |
| 611 | 625 | } |
| 612 | - $query = $wpdadb->prepare( "\n\t\t\t\t\tselect table_type,\n\t\t\t\t\t engine,\n\t\t\t\t\t table_rows\n\t\t\t\t\t from information_schema.tables\n\t\t\t\t\t where table_schema = %s\n\t\t\t\t\t and table_name = %s\n\t\t\t\t\t order by table_name\n\t\t\t\t", array($wpdadb->dbname, $tbl) ); | |
| 626 | + $query = $wpdadb->prepare( "\n\t\t\t\t\tselect table_type,\n\t\t\t\t\t engine,\n\t\t\t\t\t table_rows\n\t\t\t\t\t from information_schema.tables\n\t\t\t\t\t where table_schema = %s\n\t\t\t\t\t and table_name = %s\n\t\t\t\t", array($wpdadb->dbname, $tbl) ); | |
| 613 | 627 | $resultset = $wpdadb->get_results( $query, 'ARRAY_N' ); |
| 614 | - // phpcs:ignore Standard.Category.SniffName.ErrorCode | |
| 615 | 628 | if ( count( $resultset ) === 1 ) { |
| 616 | 629 | if ( null !== $resultset[0][2] ) { |
| 617 | 630 | return array( |
| 618 | 631 | 'type' => $resultset[0][0], |
