PluginProbe
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards / 5.5.84
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards v5.5.84
5.5.84 5.5.83 5.5.82 5.5.81 5.5.80 5.5.79 5.5.77 5.5.76 5.5.75 5.5.73 5.5.72 5.5.22 5.5.23 5.5.29 5.5.3 5.5.31 5.5.32 5.5.34 5.5.35 5.5.36 5.5.37 5.5.4 5.5.40 5.5.41 5.5.42 All 160 releases
← All changes | WPDataAccess/Design_Table/WPDA_Design_Table_Form.php +175 -116 5.5.76 → 5.5.84 View file →
@@ -242,31 +242,31 @@
242 242 *
243 243 * @since 1.1.0
244 244 */
245 245 public function __construct() {
246 - if ( isset( $_REQUEST['page'] ) ) {
247 - $this->page = sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ); // input var okay.
246 + if ( isset( $_REQUEST['page'] ) ) { // phpcs:ignore
247 + $this->page = sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ); // phpcs:ignore
248 248 } else {
249 - wp_die( __( 'ERROR: Wrong arguments [page not found]', 'wp-data-access' ) );
249 + wp_die( esc_attr__( 'ERROR: Wrong arguments [page not found]', 'wp-data-access' ) );
250 250 }
251 251
252 - if ( isset( $_REQUEST['action'] ) ) {
253 - $this->action = sanitize_text_field( wp_unslash( $_REQUEST['action'] ) ); // input var okay.
252 + if ( isset( $_REQUEST['action'] ) ) { // phpcs:ignore
253 + $this->action = sanitize_text_field( wp_unslash( $_REQUEST['action'] ) ); // phpcs:ignore
254 254 }
255 255
256 - if ( isset( $_REQUEST['action2'] ) ) {
257 - $this->action2 = sanitize_text_field( wp_unslash( $_REQUEST['action2'] ) ); // input var okay.
256 + if ( isset( $_REQUEST['action2'] ) ) { // phpcs:ignore
257 + $this->action2 = sanitize_text_field( wp_unslash( $_REQUEST['action2'] ) ); // phpcs:ignore
258 258 $this->action2_posted = $this->action2;
259 259 }
260 260
261 - if ( isset( $_REQUEST['design_mode'] ) ) {
262 - $this->design_mode = sanitize_text_field( wp_unslash( $_REQUEST['design_mode'] ) ); // input var okay.
261 + if ( isset( $_REQUEST['design_mode'] ) ) { // phpcs:ignore
262 + $this->design_mode = sanitize_text_field( wp_unslash( $_REQUEST['design_mode'] ) ); // phpcs:ignore
263 263 } else {
264 264 $this->design_mode = WPDA::get_option( WPDA::OPTION_BE_DESIGN_MODE ); // Default design mode.
265 265 }
266 266
267 - if ( isset( $_REQUEST['caller'] ) ) {
268 - $this->caller = sanitize_text_field( wp_unslash( $_REQUEST['caller'] ) ); // input var okay.
267 + if ( isset( $_REQUEST['caller'] ) ) { // phpcs:ignore
268 + $this->caller = sanitize_text_field( wp_unslash( $_REQUEST['caller'] ) ); // phpcs:ignore
269 269 }
270 270
271 271 $this->fulltext_support = get_option( 'wpda_fulltext_support' );
272 272
@@ -272,17 +272,17 @@
272 272
273 273 global $wpdb;
274 274
275 275 if ( 'init' === $this->action2 ) {
276 - if ( isset( $_REQUEST['wpda_table_name'] ) && isset( $_REQUEST['wpda_schema_name'] ) ) {
276 + if ( isset( $_REQUEST['wpda_table_name'] ) && isset( $_REQUEST['wpda_schema_name'] ) ) { // phpcs:ignore
277 277 // Check if table is already in repository.
278 - $wpdb->get_results(
278 + $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
279 279 $wpdb->prepare(
280 280 'select * from `%1s` where wpda_schema_name = %s and wpda_table_name = %s ', // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders
281 281 array(
282 282 WPDA::remove_backticks( WPDA_Design_Table_Model::get_base_table_name() ),
283 - sanitize_text_field( wp_unslash( $_REQUEST['wpda_schema_name'] ) ),
284 - sanitize_text_field( wp_unslash( $_REQUEST['wpda_table_name'] ) ),
283 + sanitize_text_field( wp_unslash( $_REQUEST['wpda_schema_name'] ) ), // phpcs:ignore
284 + sanitize_text_field( wp_unslash( $_REQUEST['wpda_table_name'] ) ), // phpcs:ignore
285 285 )
286 286 )
287 287 );
288 288 if ( 1 === $wpdb->num_rows ) {
@@ -292,19 +292,19 @@
292 292 // Table not in repository.
293 293 $this->action2 = 'wpda_reverse_engineering';
294 294 }
295 295 } else {
296 - wp_die( __( 'ERROR: Wrong arguments [table not found]', 'wp-data-access' ) );
296 + wp_die( esc_attr__( 'ERROR: Wrong arguments [table not found]', 'wp-data-access' ) );
297 297 }
298 298 }
299 299
300 300 if ( 'wpda_reverse_engineering' === $this->action2 || 'wpda_reconcile' === $this->action2 ) {
301 - if ( isset( $_REQUEST['wpda_table_name_re'] ) && isset( $_REQUEST['wpda_schema_name_re'] ) ) {
302 - $wpda_table_name_re = sanitize_text_field( wp_unslash( $_REQUEST['wpda_table_name_re'] ) );
303 - $wpda_schema_name_re = sanitize_text_field( wp_unslash( $_REQUEST['wpda_schema_name_re'] ) );
301 + if ( isset( $_REQUEST['wpda_table_name_re'] ) && isset( $_REQUEST['wpda_schema_name_re'] ) ) { // phpcs:ignore
302 + $wpda_table_name_re = sanitize_text_field( wp_unslash( $_REQUEST['wpda_table_name_re'] ) ); // phpcs:ignore
303 + $wpda_schema_name_re = sanitize_text_field( wp_unslash( $_REQUEST['wpda_schema_name_re'] ) ); // phpcs:ignore
304 304 if ( 'wpda_reconcile' === $this->action2 ) {
305 305 // Before table can be reconciled old table structure must be deleted.
306 - $wpdb->query(
306 + $wpdb->query( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
307 307 $wpdb->prepare(
308 308 'delete from `%1s` where wpda_table_name = %s and wpda_schema_name = %s ', // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders
309 309 array(
310 310 WPDA::remove_backticks( WPDA_Design_Table_Model::get_base_table_name() ),
@@ -315,27 +315,27 @@
315 315 );
316 316 }
317 317 // Start reverse engineering table.
318 318 $wpda_reverse_engineering = new WPDA_Reverse_Engineering( $wpda_table_name_re, $wpda_schema_name_re );
319 - $this->design_mode = isset( $_REQUEST['design_mode_re'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['design_mode_re'] ) ) : $this->design_mode; // input var okay.
319 + $this->design_mode = isset( $_REQUEST['design_mode_re'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['design_mode_re'] ) ) : $this->design_mode; // phpcs:ignore
320 320 $table_structure = $wpda_reverse_engineering->get_designer_format( $this->design_mode );
321 - if ( count( $table_structure ) > 0 ) {//phpcs:ignore - 8.1 proof
322 - if ( isset( $_REQUEST['wpda_table_name'] ) && '' !== trim( $_REQUEST['wpda_table_name'] ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
323 - $this->wpda_table_name = sanitize_text_field( wp_unslash( $_REQUEST['wpda_table_name'] ) );
321 + if ( count( $table_structure ) > 0 ) { // phpcs:ignore -- 8.1 proof
322 + if ( isset( $_REQUEST['wpda_table_name'] ) && '' !== trim( $_REQUEST['wpda_table_name'] ) ) { // phpcs:ignore
323 + $this->wpda_table_name = sanitize_text_field( wp_unslash( $_REQUEST['wpda_table_name'] ) ); // phpcs:ignore
324 324 } else {
325 325 $this->wpda_table_name = $wpda_table_name_re;
326 326 }
327 - if ( isset( $_REQUEST['wpda_schema_name'] ) && '' !== trim( $_REQUEST['wpda_schema_name'] ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
328 - $this->wpda_schema_name = sanitize_text_field( wp_unslash( $_REQUEST['wpda_schema_name'] ) );
327 + if ( isset( $_REQUEST['wpda_schema_name'] ) && '' !== trim( $_REQUEST['wpda_schema_name'] ) ) { // phpcs:ignore
328 + $this->wpda_schema_name = sanitize_text_field( wp_unslash( $_REQUEST['wpda_schema_name'] ) ); // phpcs:ignore
329 329 } else {
330 330 $this->wpda_schema_name = $wpda_schema_name_re;
331 331 }
332 332 $this->wpda_table_design = $table_structure;
333 333 } else {
334 - wp_die( __( 'ERROR: Reverse engineering table failed [invalid structure]', 'wp-data-access' ) );
334 + wp_die( esc_attr__( 'ERROR: Reverse engineering table failed [invalid structure]', 'wp-data-access' ) );
335 335 }
336 336 if ( ! WPDA_Design_Table_Model::insert_reverse_engineered( $this->wpda_table_name, $this->wpda_schema_name, $this->wpda_table_design ) ) {
337 - wp_die( __( 'ERROR: Reverse engineering table failed [insert failed]', 'wp-data-access' ) );
337 + wp_die( esc_attr__( 'ERROR: Reverse engineering table failed [insert failed]', 'wp-data-access' ) );
338 338 } else {
339 339 // Convert named array to object (needed to display structure).
340 340 $this->wpda_table_design = json_decode( json_encode( $table_structure ) );
341 341 }
@@ -340,19 +340,19 @@
340 340 $this->wpda_table_design = json_decode( json_encode( $table_structure ) );
341 341 }
342 342 $this->action2 = 'edit';
343 343 } else {
344 - wp_die( __( 'ERROR: Wrong arguments [table not found]', 'wp-data-access' ) );
344 + wp_die( esc_attr__( 'ERROR: Wrong arguments [table not found]', 'wp-data-access' ) );
345 345 }
346 - } elseif ( isset( $_REQUEST['wpda_table_name'] ) && isset( $_REQUEST['wpda_schema_name'] ) ) {
347 - $this->wpda_table_name = sanitize_text_field( wp_unslash( $_REQUEST['wpda_table_name'] ) );
348 - $this->wpda_schema_name = sanitize_text_field( wp_unslash( $_REQUEST['wpda_schema_name'] ) );
346 + } elseif ( isset( $_REQUEST['wpda_table_name'] ) && isset( $_REQUEST['wpda_schema_name'] ) ) { // phpcs:ignore
347 + $this->wpda_table_name = sanitize_text_field( wp_unslash( $_REQUEST['wpda_table_name'] ) ); // phpcs:ignore
348 + $this->wpda_schema_name = sanitize_text_field( wp_unslash( $_REQUEST['wpda_schema_name'] ) ); // phpcs:ignore
349 349 $this->model = new WPDA_Design_Table_Model();
350 350
351 351 if ( 'new' === $this->action2 ) {
352 352 $insert_result = $this->model->insert();
353 353 if ( false === $insert_result || $insert_result < 1 ) {
354 - wp_die( __( 'ERROR: Insert failed', 'wp-data-access' ) );
354 + wp_die( esc_attr__( 'ERROR: Insert failed', 'wp-data-access' ) );
355 355 }
356 356 $this->action2 = 'edit'; // Show saved records and allow editing.
357 357 } elseif ( 'edit' === $this->action2 && 'init' !== $this->action2_posted ) {
358 358 $result_update = $this->model->update();
@@ -474,8 +474,30 @@
474 474 }
475 475 }
476 476
477 477 $this->databases = WPDA_Dictionary_Lists::get_db_schemas();
478 +
479 + if ( ! isset( $_REQUEST['_wpnonce'] ) ) {
480 + wp_die( esc_attr__( 'Not authorized', 'wp-data-access' ) );
481 + } else {
482 + // phpcs:disable WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
483 + if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], "wpda-design-table-form-{$this->wpda_table_name}" )) { // direct form access
484 + if (
485 + '' === $this->wpda_table_name &&
486 + ! wp_verify_nonce( $_REQUEST['_wpnonce'], "wpda-design-table-form-" . WPDA_Design_Table_Model::get_base_table_name() )
487 + ) { // insert new table
488 + if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], "wpda-alter-{$this->wpda_table_name}" ) ) { // access from alter table button
489 + $schema_name = isset( $_POST['wpda_schema_name'] ) ? $_POST['wpda_schema_name'] : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated
490 + $table_name = isset( $_POST['wpda_table_name'] ) ? $_POST['wpda_table_name'] : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated
491 + $dsg_tbl = 'wpda-query-' . WPDA_Design_Table_Model::get_base_table_name() . '-' . $schema_name . '-' . $table_name;
492 + if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], $dsg_tbl ) ) { // access from list table
493 + wp_die( esc_attr__( 'Not authorized', 'wp-data-access' ) );
494 + }
495 + }
496 + }
497 + }
498 + // phpcs:enable WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
499 + }
478 500 }
479 501
480 502 public function prepare_form() {}
481 503
@@ -522,9 +544,10 @@
522 544 $this->alter_table();
523 545
524 546 $wpdadb = WPDADB::get_db_connection( $this->wpda_schema_name );
525 547 if ( null === $wpdadb ) {
526 - wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->wpda_schema_name ) ) );
548 + /* translators: %s = remote database name */
549 + wp_die( esc_attr( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), $this->wpda_schema_name ) ) );
527 550 }
528 551
529 552 $suppress = $wpdadb->suppress_errors( true );
530 553 $create_table_statement = str_replace( self::NEW_LINE, "\n", $this->create_table_statement );
@@ -620,9 +643,9 @@
620 643 }
621 644
622 645 if ( ! $real_column_found ) {
623 646 // Drop column
624 - //phpcs:ignore - 8.1 proof
647 + // phpcs:ignore -- 8.1 proof
625 648 array_push(
626 649 $this->alter_table_statement,
627 650 'DROP COLUMN `' . str_replace( '`', '', $real_column->column_name ) . '`,' . self::NEW_LINE
628 651 );
@@ -632,9 +655,9 @@
632 655 $create_keys_real[] = $real_column->column_name;
633 656 }
634 657 }
635 658
636 - if ( 0 < count( $this->alter_table_statement ) ) {//phpcs:ignore - 8.1 proof
659 + if ( 0 < count( $this->alter_table_statement ) ) { // phpcs:ignore -- 8.1 proof
637 660 $this->create_table_statement .= "ALTER TABLE `{$this->wpda_table_name}` ";
638 661 foreach ( $this->alter_table_statement as $sql ) {
639 662 $this->create_table_statement .= $sql;
640 663 }
@@ -641,21 +664,21 @@
641 664 $this->create_table_statement =
642 665 substr( $this->create_table_statement, 0, strrpos( $this->create_table_statement, ',' ) ) .
643 666 ';' . self::NEW_LINE . self::NEW_LINE;
644 667
645 - $array_difference_1 = array_diff( $create_keys_design, $create_keys_real ); //phpcs:ignore - 8.1 proof
646 - $array_difference_2 = array_diff( $create_keys_real, $create_keys_design ); //phpcs:ignore - 8.1 proof
647 - if ( 0 !== count( $array_difference_1 ) || 0 !== count( $array_difference_2 ) ) { //phpcs:ignore - 8.1 proof
648 - if ( 0 < count( $create_keys_real ) ) { //phpcs:ignore - 8.1 proof
668 + $array_difference_1 = array_diff( $create_keys_design, $create_keys_real ); // phpcs:ignore -- 8.1 proof
669 + $array_difference_2 = array_diff( $create_keys_real, $create_keys_design ); // phpcs:ignore -- 8.1 proof
670 + if ( 0 !== count( $array_difference_1 ) || 0 !== count( $array_difference_2 ) ) { // phpcs:ignore -- 8.1 proof
671 + if ( 0 < count( $create_keys_real ) ) { // phpcs:ignore -- 8.1 proof
649 672 $this->create_table_statement =
650 673 "ALTER TABLE `{$this->wpda_table_name}` DROP PRIMARY KEY;" .
651 674 self::NEW_LINE . self::NEW_LINE . $this->create_table_statement;
652 675 }
653 - if ( 0 < count( $create_keys_design ) ) { //phpcs:ignore - 8.1 proof
676 + if ( 0 < count( $create_keys_design ) ) { // phpcs:ignore -- 8.1 proof
654 677 $alter_table_statement =
655 678 "ALTER TABLE `{$this->wpda_table_name}` ADD PRIMARY KEY ";
656 679 foreach ( $create_keys_design as $key ) {
657 - $alter_table_statement .= $key === reset( $create_keys_design ) ? '(' : ',';//phpcs:ignore - 8.1 proof
680 + $alter_table_statement .= $key === reset( $create_keys_design ) ? '(' : ','; // phpcs:ignore -- 8.1 proof
658 681 $alter_table_statement .= '`' . str_replace( '`', '', $key ) . '`';
659 682 }
660 683 $alter_table_statement .= ');' . self::NEW_LINE . self::NEW_LINE;
661 684
@@ -691,9 +714,9 @@
691 714 } else {
692 715 $unique = '';
693 716 }
694 717 }
695 - $column_names_array = explode( ',', ( string ) $design_index->column_names );//phpcs:ignore - 8.1 proof
718 + $column_names_array = explode( ',', ( string ) $design_index->column_names ); // phpcs:ignore -- 8.1 proof
696 719 $column_names = '`' . implode( '`,`', $column_names_array ) . '`';
697 720 $this->create_table_statement .=
698 721 "CREATE $unique INDEX `" . str_replace( '`', '', $design_index->index_name ) . "` ON `{$this->wpda_table_name}` ($column_names);" .
699 722 self::NEW_LINE;
@@ -731,9 +754,9 @@
731 754
732 755 array_push(
733 756 $this->alter_table_statement,
734 757 $alter_table_statement
735 - );//phpcs:ignore - 8.1 proof
758 + ); // phpcs:ignore -- 8.1 proof
736 759 }
737 760
738 761 /**
739 762 * Drop database table
@@ -743,15 +766,18 @@
743 766 * @since 2.0.14
744 767 */
745 768 protected function drop_table() {
746 769 if ( $this->is_wp_table ) {
770 + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment
747 771 $msg = new WPDA_Message_Box(
748 772 array(
773 + /* translators: %s = table name */
749 774 'message_text' => sprintf( __( 'Cannot drop WordPress table `%s`', 'wp-data-access' ), $this->wpda_table_name ),
750 775 'message_type' => 'error',
751 776 'message_is_dismissible' => false,
752 777 )
753 778 );
779 + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment
754 780 $msg->box();
755 781
756 782 return;
757 783 }
@@ -758,19 +784,23 @@
758 784
759 785 if ( $this->table_exists ) {
760 786 $wpdadb = WPDADB::get_db_connection( $this->wpda_schema_name );
761 787 if ( null === $wpdadb ) {
762 - wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->wpda_schema_name ) ) );
788 + /* translators: %s = remote database name */
789 + wp_die( esc_attr( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), $this->wpda_schema_name ) ) );
763 790 }
764 791
765 792 $suppress = $wpdadb->suppress_errors( true );
766 793 $drop_table_statement = "DROP TABLE `{$this->wpda_table_name}`";
767 794 if ( $wpdadb->query( $drop_table_statement ) ) {
795 + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment
768 796 $msg = new WPDA_Message_Box(
769 797 array(
798 + /* translators: %s = table name */
770 799 'message_text' => sprintf( __( 'Table `%s` dropped', 'wp-data-access' ), $this->wpda_table_name ),
771 800 )
772 801 );
802 + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment
773 803 $msg->box();
774 804 } else {
775 805 $msg = new WPDA_Message_Box(
776 806 array(
@@ -796,9 +826,9 @@
796 826 $this->create_table_statement = "CREATE TABLE `{$this->wpda_table_name}`" . self::NEW_LINE;
797 827
798 828 $create_keys = array();
799 829 foreach ( $this->wpda_table_design->table as $row ) {
800 - $this->create_table_statement .= $row === reset( $this->wpda_table_design->table ) ? '(' : ',';//phpcs:ignore - 8.1 proof
830 + $this->create_table_statement .= $row === reset( $this->wpda_table_design->table ) ? '(' : ','; // phpcs:ignore -- 8.1 proof
801 831 $this->create_table_statement .= '`' . str_replace( '`', '', $row->column_name ) . '`';
802 832 $this->create_table_statement .= ' ';
803 833 $this->create_table_statement .= $row->data_type;
804 834 if ( '' !== $row->max_length ) {
@@ -840,12 +870,12 @@
840 870 $create_keys[] = $row->column_name;
841 871 }
842 872 $this->create_table_statement .= self::NEW_LINE;
843 873 }
844 - if ( 0 < count( $create_keys ) ) {//phpcs:ignore - 8.1 proof
874 + if ( 0 < count( $create_keys ) ) { // phpcs:ignore -- 8.1 proof
845 875 $this->create_table_statement .= ',PRIMARY KEY ';
846 876 foreach ( $create_keys as $key ) {
847 - $this->create_table_statement .= $key === reset( $create_keys ) ? '(' : ',';//phpcs:ignore - 8.1 proof
877 + $this->create_table_statement .= $key === reset( $create_keys ) ? '(' : ','; // phpcs:ignore -- 8.1 proof
848 878 $this->create_table_statement .= '`' . str_replace( '`', '', $key ) . '`';
849 879 }
850 880 $this->create_table_statement .= ')';
851 881 $this->create_table_statement .= self::NEW_LINE;
@@ -854,9 +884,9 @@
854 884 if ( isset( $this->wpda_table_design->engine ) && '' !== $this->wpda_table_design->engine ) {
855 885 $this->create_table_statement .= ' ENGINE ' . $this->wpda_table_design->engine;
856 886 }
857 887 if ( isset( $this->wpda_table_design->collation ) && '' !== $this->wpda_table_design->collation ) {
858 - $collation = explode( '_', $this->wpda_table_design->collation );//phpcs:ignore - 8.1 proof
888 + $collation = explode( '_', $this->wpda_table_design->collation ); // phpcs:ignore -- 8.1 proof
859 889 $this->create_table_statement .= ' DEFAULT CHARACTER SET ' . $collation[0] . ' COLLATE=' . $this->wpda_table_design->collation;
860 890 }
861 891 $this->create_table_statement .= ';' . self::NEW_LINE . self::NEW_LINE;
862 892
@@ -871,9 +901,10 @@
871 901 } else {
872 902 // Create table and indexes.
873 903 $wpdadb = WPDADB::get_db_connection( $this->wpda_schema_name );
874 904 if ( null === $wpdadb ) {
875 - wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->wpda_schema_name ) ) );
905 + /* translators: %s = remote database name */
906 + wp_die( esc_attr( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), $this->wpda_schema_name ) ) );
876 907 }
877 908
878 909 $suppress = $wpdadb->suppress_errors( true );
879 910
@@ -1108,14 +1139,14 @@
1108 1139 }
1109 1140
1110 1141 function pre_submit() {
1111 1142 if (jQuery('#wpda_table_name').val() === '') {
1112 - alert('<?php echo __( 'Table name cannot be empty' ); ?>');
1143 + alert('<?php echo esc_attr__( 'Table name cannot be empty', 'wp-data-access' ); ?>');
1113 1144 return false;
1114 1145 }
1115 1146 if ('<?php echo esc_attr( $this->action2 ); ?>' === 'new') {
1116 1147 if (wpda_db_table_name[jQuery('#wpda_table_name').val()]) {
1117 - alert('<?php echo __( 'Table name already used for another table design' ); ?>');
1148 + alert('<?php echo esc_attr__( 'Table name already used for another table design', 'wp-data-access' ); ?>');
1118 1149 return false;
1119 1150 }
1120 1151 }
1121 1152 var all_columns_entered = true;
@@ -1120,9 +1151,9 @@
1120 1151 }
1121 1152 var all_columns_entered = true;
1122 1153 jQuery("input[name='column_name[]']").each(function () {
1123 1154 if (jQuery(this).val() === '') {
1124 - alert('<?php echo __( 'Column names cannot be empty' ); ?>');
1155 + alert('<?php echo esc_attr__( 'Column names cannot be empty', 'wp-data-access' ); ?>');
1125 1156 all_columns_entered = false;
1126 1157 }
1127 1158 });
1128 1159 if (!all_columns_entered) {
@@ -1493,9 +1524,9 @@
1493 1524 }
1494 1525
1495 1526 function pre_submit_re() {
1496 1527 if (wpda_db_table_name[jQuery('select[name="wpda_table_name_re"]').val()]) {
1497 - alert('<?php echo __( 'Table name already used for another table design' ); ?>');
1528 + alert('<?php echo esc_attr__( 'Table name already used for another table design', 'wp-data-access' ); ?>');
1498 1529 return false;
1499 1530 }
1500 1531 jQuery('#design_mode_re').val(jQuery('input[name="design_mode"]:checked').val());
1501 1532 return true;
@@ -1530,9 +1561,9 @@
1530 1561 <a
1531 1562 href="?page=<?php echo '' === $this->caller ? esc_attr( $this->page ) : esc_attr( \WP_Data_Access_Admin::PAGE_MAIN ); ?>"
1532 1563 style="display: inline-block; vertical-align: unset;"
1533 1564 class="dashicons dashicons-arrow-left-alt2 wpda_tooltip"
1534 - title="<?php echo __( 'List', 'wp-data-access' ); ?>"
1565 + title="<?php echo esc_attr__( 'List', 'wp-data-access' ); ?>"
1535 1566 ></a>
1536 1567 Data Designer
1537 1568 </h1>
1538 1569 <div style="display:none;">
@@ -1545,8 +1576,9 @@
1545 1576 value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1546 1577 <input type="hidden" name="wpda_schema_name"
1547 1578 value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1548 1579 <input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1580 + <?php $this->create_nonce(); ?>
1549 1581 </form>
1550 1582 <form id="wpda_alter_table_form"
1551 1583 action="?page=<?php echo esc_attr( $this->page ); ?>"
1552 1584 method="post">
@@ -1556,8 +1588,9 @@
1556 1588 value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1557 1589 <input type="hidden" name="wpda_schema_name"
1558 1590 value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1559 1591 <input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1592 + <?php $this->create_nonce(); ?>
1560 1593 </form>
1561 1594 <form id="wpda_drop_table_form"
1562 1595 action="?page=<?php echo esc_attr( $this->page ); ?>"
1563 1596 method="post">
@@ -1567,8 +1600,9 @@
1567 1600 value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1568 1601 <input type="hidden" name="wpda_schema_name"
1569 1602 value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1570 1603 <input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1604 + <?php $this->create_nonce(); ?>
1571 1605 </form>
1572 1606 <form id="wpda_create_index_form"
1573 1607 action="?page=<?php echo esc_attr( $this->page ); ?>"
1574 1608 method="post" style="margin-left:1px;margin-right:1px;">
@@ -1578,8 +1612,9 @@
1578 1612 value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1579 1613 <input type="hidden" name="wpda_schema_name"
1580 1614 value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1581 1615 <input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1616 + <?php $this->create_nonce(); ?>
1582 1617 </form>
1583 1618 <form id="wpda_drop_index_form"
1584 1619 action="?page=<?php echo esc_attr( $this->page ); ?>"
1585 1620 method="post" style="margin-left:1px;margin-right:1px;">
@@ -1589,8 +1624,9 @@
1589 1624 value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1590 1625 <input type="hidden" name="wpda_schema_name"
1591 1626 value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1592 1627 <input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1628 + <?php $this->create_nonce(); ?>
1593 1629 </form>
1594 1630 </div>
1595 1631 <style>
1596 1632 #overlay_show_create_table {
@@ -1634,9 +1670,9 @@
1634 1670 <a id="button-copy-clipboard" href="javascript:void(0)" class="button button-secondary"
1635 1671 style="text-align:center;width:150px;"
1636 1672 data-clipboard-text="<?php echo str_replace( self::NEW_LINE, "\n", $this->create_table_statement ) . str_replace( self::NEW_LINE, "\n", $this->create_index_statement ); // phpcs:ignore WordPress.Security.EscapeOutput ?>">
1637 1673 <i class="fas fa-clipboard wpda_icon_on_button"></i>
1638 - <?php echo __( 'Copy to clipboard' ); ?>
1674 + <?php echo esc_attr__( 'Copy to clipboard', 'wp-data-access' ); ?>
1639 1675 </a>
1640 1676 <br/>
1641 1677 <div style="height: 5px;"></div>
1642 1678 <a href="javascript:void(0)" class="button button-primary"
@@ -1642,9 +1678,9 @@
1642 1678 <a href="javascript:void(0)" class="button button-primary"
1643 1679 style="text-align:center;width:150px;"
1644 1680 onclick="jQuery('#overlay_show_create_table').hide()">
1645 1681 <i class="fas fa-times-circle wpda_icon_on_button"></i>
1646 - <?php echo __( 'Close' ); ?>
1682 + <?php echo esc_attr__( 'Close', 'wp-data-access' ); ?>
1647 1683 </a>
1648 1684 </div>
1649 1685 </div>
1650 1686 <script type='text/javascript'>
@@ -1653,12 +1689,12 @@
1653 1689 jQuery('#overlay_show_create_table').show();
1654 1690 <?php } ?>
1655 1691 var sql_to_clipboard = new ClipboardJS('#button-copy-clipboard');
1656 1692 sql_to_clipboard.on('success', function (e) {
1657 - jQuery.notify('<?php echo __( 'SQL successfully copied to clipboard!' ); ?>','info');
1693 + jQuery.notify('<?php echo esc_attr__( 'SQL successfully copied to clipboard!', 'wp-data-access' ); ?>','info');
1658 1694 });
1659 1695 sql_to_clipboard.on('error', function (e) {
1660 - jQuery.notify('<?php echo __( 'Could not copy SQL to clipboard!' ); ?>','error');
1696 + jQuery.notify('<?php echo esc_attr__( 'Could not copy SQL to clipboard!', 'wp-data-access' ); ?>','error');
1661 1697 });
1662 1698 jQuery('#wpda_table_structure').sortable();
1663 1699 jQuery( '.wpda_tooltip' ).tooltip();
1664 1700 });
@@ -1672,9 +1708,9 @@
1672 1708 <br/>
1673 1709 <div class="wpda_reverse_engineering">
1674 1710 <form id="wpda_reverse_engineering_form"
1675 1711 action="?page=<?php echo esc_attr( $this->page ); ?>" method="post">
1676 - <label><?php echo __( 'Load table from database' ); ?> </label>
1712 + <label><?php echo esc_attr__( 'Load table from database', 'wp-data-access' ); ?> </label>
1677 1713 <select name="wpda_schema_name_re" id="wpda_schema_name_re_list" onchange="get_tables()">
1678 1714 <?php
1679 1715 global $wpdb;
1680 1716 foreach ( $this->databases as $database ) {
@@ -1713,9 +1749,10 @@
1713 1749 value="Start Reverse Engineering"
1714 1750 onclick="return pre_submit_re()"
1715 1751 >
1716 1752 <a href="javascript:void(0)" onclick="jQuery('#wpda_reverse_engineering').hide()"
1717 - class="button"><?php echo __( 'Dismiss' ); ?></a>
1753 + class="button"><?php echo esc_attr__( 'Dismiss', 'wp-data-access' ); ?></a>
1754 + <?php $this->create_nonce(); ?>
1718 1755 </form>
1719 1756 </div>
1720 1757 </div>
1721 1758 <?php
@@ -1733,8 +1770,9 @@
1733 1770 value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1734 1771 <input type="hidden" name="wpda_schema_name_re"
1735 1772 value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1736 1773 <input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1774 + <?php $this->create_nonce(); ?>
1737 1775 </form>
1738 1776 </div>
1739 1777 <?php
1740 1778 }
@@ -1755,8 +1793,9 @@
1755 1793 value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1756 1794 <input type="hidden" name="wpda_schema_name"
1757 1795 value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1758 1796 <input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1797 + <?php $this->create_nonce(); ?>
1759 1798 </form>
1760 1799 <form id="show_alter_table_form" action="?page=<?php echo esc_attr( $this->page ); ?>"
1761 1800 method="post">
1762 1801 <input type="hidden" name="action" value="edit"/>
@@ -1765,8 +1804,9 @@
1765 1804 value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1766 1805 <input type="hidden" name="wpda_schema_name"
1767 1806 value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1768 1807 <input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1808 + <?php $this->create_nonce(); ?>
1769 1809 </form>
1770 1810 </div>
1771 1811 <form id="design_table_form"
1772 1812 action="?page=<?php echo esc_attr( $this->page ); ?>"
@@ -1774,9 +1814,9 @@
1774 1814 method="post" onsubmit="return pre_submit()">
1775 1815 <fieldset class="wpda_fieldset">
1776 1816 <legend>
1777 1817 <span>
1778 - <?php echo __( 'Table definition', 'wp-data-access' ); ?>
1818 + <?php echo esc_attr__( 'Table definition', 'wp-data-access' ); ?>
1779 1819 <?php
1780 1820 if (
1781 1821 '' !== $this->wpda_schema_name &&
1782 1822 '' !== $this->wpda_table_name &&
@@ -1783,9 +1823,9 @@
1783 1823 null !== $this->wpda_table_design
1784 1824 ) {
1785 1825 $table_structure = json_decode( json_encode( $this->wpda_table_design ), true );
1786 1826 if ( isset( $table_structure['table'] ) ) {
1787 - $column_names = array_column( (array) $table_structure['table'], 'column_name' ); //phpcs:ignore - 8.1 proof
1827 + $column_names = array_column( (array) $table_structure['table'], 'column_name' ); // phpcs:ignore -- 8.1 proof
1788 1828 } else {
1789 1829 $column_names = array();
1790 1830 }
1791 1831 // Validate schema, table and column names
@@ -1800,9 +1840,9 @@
1800 1840 <table class="wpda-table-structure">
1801 1841 <thead>
1802 1842 <tr>
1803 1843 <td class="wpda-table-structure-first-column">
1804 - <label for "wpda_schema_name"><?php echo __( 'Database' ); ?> </label>
1844 + <label for "wpda_schema_name"><?php echo esc_attr__( 'Database', 'wp-data-access' ); ?> </label>
1805 1845 </td>
1806 1846 <td>
1807 1847 <select name="wpda_schema_name" id="wpda_schema_name" style="width:100%;max-width:100%;">
1808 1848 <?php
@@ -1835,9 +1875,9 @@
1835 1875 class="design_mode"
1836 1876 onclick="return switch_mode(event)"
1837 1877 <?php echo 'basic' === $this->design_mode ? 'checked' : ''; ?>
1838 1878 >
1839 - <?php echo __( 'Basic Design Mode' ); ?>
1879 + <?php echo esc_attr__( 'Basic Design Mode', 'wp-data-access' ); ?>
1840 1880 </label>
1841 1881 <label>
1842 1882 <input type="radio"
1843 1883 name="design_mode"
@@ -1845,15 +1885,15 @@
1845 1885 class="design_mode"
1846 1886 onclick="return switch_mode(event)"
1847 1887 <?php echo 'advanced' === $this->design_mode ? 'checked' : ''; ?>
1848 1888 >
1849 - <?php echo __( 'Advanced Design Mode' ); ?>
1889 + <?php echo esc_attr__( 'Advanced Design Mode', 'wp-data-access' ); ?>
1850 1890 </label>
1851 1891 </span>
1852 1892 </td> </tr>
1853 1893 <tr>
1854 1894 <td class="wpda-table-structure-first-column">
1855 - <label for "wpda_table_name"><?php echo __( 'Table name' ); ?> </label>
1895 + <label for "wpda_table_name"><?php echo esc_attr__( 'Table name', 'wp-data-access' ); ?> </label>
1856 1896 </td>
1857 1897 <td>
1858 1898 <input type="text" name="wpda_table_name" id="wpda_table_name" maxlength="64"
1859 1899 style="width:100%;max-width:100%;"
@@ -1867,15 +1907,15 @@
1867 1907 if ( $this->table_exists ) {
1868 1908 if ( $this->is_wp_table ) {
1869 1909 ?>
1870 1910 <span style="vertical-align:-webkit-baseline-middle; cursor:pointer;"
1871 - title="<?php echo __( 'You cannot use a WordPress table name', 'wp-data-access' ); ?>"
1911 + title="<?php echo esc_attr__( 'You cannot use a WordPress table name', 'wp-data-access' ); ?>"
1872 1912 class="dashicons dashicons-flag wpda_tooltip">
1873 1913 </span>
1874 1914 <?php
1875 1915 } else {
1876 1916 ?>
1877 - <i title="<?php echo __( 'A table with this name already exists in the database', 'wp-data-access' ); ?>"
1917 + <i title="<?php echo esc_attr__( 'A table with this name already exists in the database', 'wp-data-access' ); ?>"
1878 1918 class="fas fa-info-circle pointer wpda_tooltip" style="padding: 0 5px; font-size: 24px; line-height: 30px"></i>
1879 1919 <?php
1880 1920 }
1881 1921 ?>
@@ -1880,13 +1920,13 @@
1880 1920 }
1881 1921 ?>
1882 1922 <a href="javascript:void(0)"
1883 1923 id="reconcile_button"
1884 - onclick="if (confirm('<?php echo __( 'Reconcile table? Your current modifications will be lost!' ); ?>')) { jQuery('#wpda_reconcile_form').submit(); }"
1924 + onclick="if (confirm('<?php echo esc_attr__( 'Reconcile table? Your current modifications will be lost!', 'wp-data-access' ); ?>')) { jQuery('#wpda_reconcile_form').submit(); }"
1885 1925 class="button wpda_tooltip"
1886 1926 title="Update table design from database table (overwrites current design)">
1887 1927 <i class="fas fa-redo wpda_icon_on_button"></i>
1888 - <?php echo __( 'Reconcile' ); ?>
1928 + <?php echo esc_attr__( 'Reconcile', 'wp-data-access' ); ?>
1889 1929 </a>
1890 1930 <?php
1891 1931 } else {
1892 1932 $title = __( 'New table', 'wp-data-access' );
@@ -1891,9 +1931,9 @@
1891 1931 } else {
1892 1932 $title = __( 'New table', 'wp-data-access' );
1893 1933 ?>
1894 1934 <span style="vertical-align:-webkit-baseline-middle; cursor:pointer;"
1895 - title="<?php echo $title; // phpcs:ignore WordPress.Security.EscapeOutput ?>"
1935 + title="<?php echo esc_attr( $title ); ?>"
1896 1936 class="dashicons dashicons-warning wpda_tooltip">
1897 1937 </span>
1898 1938 <?php
1899 1939 }
@@ -1907,11 +1947,11 @@
1907 1947 ?>
1908 1948 <a href="javascript:void(0)"
1909 1949 onclick="jQuery('#wpda_reverse_engineering').show()"
1910 1950 class="button wpda_view_table wpda_tooltip"
1911 - title="<?php echo __( 'Load table from database' ); ?>"
1951 + title="<?php echo esc_attr__( 'Load table from database', 'wp-data-access' ); ?>"
1912 1952 >
1913 - <?php echo __( 'Reverse engineering' ); ?>
1953 + <?php echo esc_attr__( 'Reverse engineering', 'wp-data-access' ); ?>
1914 1954 </a>
1915 1955 <?php
1916 1956 }
1917 1957 ?>
@@ -1921,9 +1961,9 @@
1921 1961 </tr>
1922 1962 <?php if ( 'advanced' === $this->design_mode ) { ?>
1923 1963 <tr>
1924 1964 <td class="wpda-table-structure-first-column">
1925 - <label for "engine"><?php echo __( 'Engine' ); ?> </label>
1965 + <label for "engine"><?php echo esc_attr__( 'Engine', 'wp-data-access' ); ?> </label>
1926 1966 </td>
1927 1967 <td>
1928 1968 <select name="engine" id="engine" style="width:100%;max-width:100%;" class="wpda_view_table">
1929 1969 <?php
@@ -1955,9 +1995,9 @@
1955 1995 class="button button-secondary wpda_tooltip"
1956 1996 title="Generates a create table script from table and index design."
1957 1997 onclick="jQuery('#show_create_table_form').submit();">
1958 1998 <i class="fas fa-code wpda_icon_on_button"></i>
1959 - <?php echo __( 'Show CREATE TABLE script' ); ?>
1999 + <?php echo esc_attr__( 'Show CREATE TABLE script', 'wp-data-access' ); ?>
1960 2000 </a>
1961 2001 <a id="button_show_alter_table" href="javascript:void(0)"
1962 2002 class="button button-secondary wpda_tooltip"
1963 2003 title="Generates a alter table script from table and index design."
@@ -1962,9 +2002,9 @@
1962 2002 class="button button-secondary wpda_tooltip"
1963 2003 title="Generates a alter table script from table and index design."
1964 2004 onclick="jQuery('#show_alter_table_form').submit();">
1965 2005 <i class="fas fa-code wpda_icon_on_button"></i>
1966 - <?php echo __( 'Show ALTER TABLE script' ); ?>
2006 + <?php echo esc_attr__( 'Show ALTER TABLE script', 'wp-data-access' ); ?>
1967 2007 </a>
1968 2008 </span>
1969 2009 </td>
1970 2010 </tr>
@@ -1969,9 +2009,9 @@
1969 2009 </td>
1970 2010 </tr>
1971 2011 <tr>
1972 2012 <td class="wpda-table-structure-first-column">
1973 - <label for "collation"><?php echo __( 'Collation' ); ?> </label>
2013 + <label for "collation"><?php echo esc_attr__( 'Collation', 'wp-data-access' ); ?> </label>
1974 2014 </td>
1975 2015 <td>
1976 2016 <select name="collation" id="collation" style="width:100%;max-width:100%;"
1977 2017 class="wpda_view_table">
@@ -2012,9 +2052,9 @@
2012 2052 <span style="float:right;">
2013 2053 <label id="checkbox_show_deleted_label">
2014 2054 <input id="checkbox_show_deleted" type="checkbox"
2015 2055 onclick="if (jQuery(this).is(':checked')) { jQuery('.wpda_column_deleted').show(); } else { jQuery('.wpda_column_deleted').hide(); }">
2016 - <?php echo __( 'Show deleted columns and indexes' ); ?>
2056 + <?php echo esc_attr__( 'Show deleted columns and indexes', 'wp-data-access' ); ?>
2017 2057 </label>
2018 2058 </span>
2019 2059 </td>
2020 2060 </tr>
@@ -2025,9 +2065,9 @@
2025 2065 <br/>
2026 2066 <fieldset class="wpda_fieldset">
2027 2067 <legend>
2028 2068 <span>
2029 - <?php echo __( 'Add columns', 'wp-data-access' ); ?>
2069 + <?php echo esc_attr__( 'Add columns', 'wp-data-access' ); ?>
2030 2070 </span>
2031 2071 </legend>
2032 2072 <table class="wpda-table-structure" style="border-collapse: collapse;">
2033 2073 <thead>
@@ -2033,29 +2073,29 @@
2033 2073 <thead>
2034 2074 <tr>
2035 2075 <th class="wpda-table-structure-first-column-move"></th>
2036 2076 <th>
2037 - <?php echo __( 'Column name' ); ?>
2077 + <?php echo esc_attr__( 'Column name', 'wp-data-access' ); ?>
2038 2078 </th>
2039 2079 <th>
2040 - <?php echo __( 'Column type' ); ?>
2080 + <?php echo esc_attr__( 'Column type', 'wp-data-access' ); ?>
2041 2081 </th>
2042 2082 <?php if ( 'advanced' === $this->design_mode ) { ?>
2043 2083 <th>
2044 - <?php echo __( 'Type attribute' ); ?>
2084 + <?php echo esc_attr__( 'Type attribute', 'wp-data-access' ); ?>
2045 2085 </th>
2046 2086 <?php } ?>
2047 2087 <th style="min-width:60px;">
2048 - <?php echo __( 'Key?' ); ?>
2088 + <?php echo esc_attr__( 'Key?', 'wp-data-access' ); ?>
2049 2089 </th>
2050 2090 <th style="min-width:90px;">
2051 - <?php echo __( 'Mandatory?' ); ?>
2091 + <?php echo esc_attr__( 'Mandatory?', 'wp-data-access' ); ?>
2052 2092 </th>
2053 2093 <th>
2054 - <?php echo __( 'Max length' ); ?>
2094 + <?php echo esc_attr__( 'Max length', 'wp-data-access' ); ?>
2055 2095 </th>
2056 2096 <th>
2057 - <?php echo __( 'Extra' ); ?>
2097 + <?php echo esc_attr__( 'Extra', 'wp-data-access' ); ?>
2058 2098 <i title="Possible values:
2059 2099
2060 2100 auto_increment
2061 2101 on update current_timestamp (for column types: timestamp and datetime)
@@ -2067,12 +2107,12 @@
2067 2107 Or combined:
2068 2108 default_generated on update current_timestamp" class="fas fa-circle-question pointer wpda_tooltip"></i>
2069 2109 </th>
2070 2110 <th>
2071 - <?php echo __( 'Default value' ); ?>
2111 + <?php echo esc_attr__( 'Default value', 'wp-data-access' ); ?>
2072 2112 </th>
2073 2113 <th>
2074 - <?php echo __( 'List values' ); ?>
2114 + <?php echo esc_attr__( 'List values', 'wp-data-access' ); ?>
2075 2115 </th>
2076 2116 <th class="wpda-table-structure-last-column">
2077 2117 <a href="javascript:void(0)"
2078 2118 onclick="add_row('<?php echo esc_attr( $this->design_mode ); ?>')"
@@ -2108,9 +2148,9 @@
2108 2148 echo ' disabled';
2109 2149 }
2110 2150 ?>
2111 2151 "
2112 - onclick="if ( confirm('Create database table `<?php echo WPDA::remove_backticks( $this->wpda_schema_name ); // phpcs:ignore WordPress.Security.EscapeOutput ?>`.`<?php echo WPDA::remove_backticks( $this->wpda_table_name ); // phpcs:ignore WordPress.Security.EscapeOutput ?>`?\nDoes not create indexes!') ) { jQuery('#wpda_create_table_form').submit(); }"
2152 + onclick="if ( confirm('Create database table `<?php echo esc_attr( WPDA::remove_backticks( $this->wpda_schema_name ) ); ?>`.`<?php echo esc_attr( WPDA::remove_backticks( $this->wpda_table_name ) ); ?>`?\nDoes not create indexes!') ) { jQuery('#wpda_create_table_form').submit(); }"
2113 2153 <?php
2114 2154 if ( $this->table_exists || 'new' === strtolower( $this->action2 ) ) {
2115 2155 echo ' readonly disabled';
2116 2156 }
@@ -2116,16 +2156,16 @@
2116 2156 }
2117 2157 ?>
2118 2158 >
2119 2159 <i class="fas fa-check wpda_icon_on_button"></i>
2120 - <?php echo __( 'CREATE TABLE', 'wp-data-access' ); ?>
2160 + <?php echo esc_attr__( 'CREATE TABLE', 'wp-data-access' ); ?>
2121 2161 </a>
2122 2162 <a id="button_alter_table" href="javascript:void(0)" class="button wpda_view wpda_tooltip"
2123 2163 title="Writes design changes to database table and indexes."
2124 - onclick="if ( confirm('Alter database table `<?php echo WPDA::remove_backticks( $this->wpda_schema_name ); // phpcs:ignore WordPress.Security.EscapeOutput ?>`.`<?php echo WPDA::remove_backticks( $this->wpda_table_name ); // phpcs:ignore WordPress.Security.EscapeOutput ?>`?\nAlters modified indexes as well!') ) { jQuery('#wpda_alter_table_form').submit(); }"
2164 + onclick="if ( confirm('Alter database table `<?php echo esc_attr( WPDA::remove_backticks( $this->wpda_schema_name ) ); ?>`.`<?php echo esc_attr( WPDA::remove_backticks( $this->wpda_table_name ) ); ?>`?\nAlters modified indexes as well!') ) { jQuery('#wpda_alter_table_form').submit(); }"
2125 2165 >
2126 2166 <i class="fas fa-redo wpda_icon_on_button"></i>
2127 - <?php echo __( 'ALTER TABLE', 'wp-data-access' ); ?>
2167 + <?php echo esc_attr__( 'ALTER TABLE', 'wp-data-access' ); ?>
2128 2168 </a>
2129 2169 <a href="javascript:void(0)"
2130 2170 title="This action drops your database table! Not your table design... This cannot be undone."
2131 2171 class="button wpda_tooltip wpda_view
@@ -2134,9 +2174,9 @@
2134 2174 echo ' disabled';
2135 2175 }
2136 2176 ?>
2137 2177 "
2138 - onclick="if ( confirm('Drop database table `<?php echo WPDA::remove_backticks( $this->wpda_schema_name ); // phpcs:ignore WordPress.Security.EscapeOutput ?>`.`<?php echo WPDA::remove_backticks( $this->wpda_table_name ); // phpcs:ignore WordPress.Security.EscapeOutput ?>`?\nTable design will not be deleted!') ) { jQuery('#wpda_drop_table_form').submit(); }"
2178 + onclick="if ( confirm('Drop database table `<?php echo esc_attr( WPDA::remove_backticks( $this->wpda_schema_name ) ); ?>`.`<?php echo esc_attr( WPDA::remove_backticks( $this->wpda_table_name ) ); ?>`?\nTable design will not be deleted!') ) { jQuery('#wpda_drop_table_form').submit(); }"
2139 2179 <?php
2140 2180 if ( ! $this->table_exists ) {
2141 2181 echo ' readonly disabled';
2142 2182 }
@@ -2142,9 +2182,9 @@
2142 2182 }
2143 2183 ?>
2144 2184 >
2145 2185 <i class="fas fa-trash wpda_icon_on_button"></i>
2146 - <?php echo __( 'DROP TABLE', 'wp-data-access' ); ?>
2186 + <?php echo esc_attr__( 'DROP TABLE', 'wp-data-access' ); ?>
2147 2187 </a>
2148 2188 <input type='hidden' name='caller'
2149 2189 value='<?php echo esc_attr( $this->caller ); ?>'/>
2150 2190 <button type="submit" class="button button-primary wpda_view_table wpda_tooltip"
@@ -2157,8 +2197,9 @@
2157 2197 </tr>
2158 2198 </tfoot>
2159 2199 </table>
2160 2200 </fieldset>
2201 + <?php $this->create_nonce(); ?>
2161 2202 </form>
2162 2203 <form id="wpda_reset_form" action="?page=<?php echo esc_attr( $this->page ); ?>" method="post">
2163 2204 <input type="hidden" name="action" value="edit"/>
2164 2205 <?php
@@ -2171,15 +2212,17 @@
2171 2212 <?php
2172 2213 }
2173 2214 ?>
2174 2215 <input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
2216 + <?php $this->create_nonce(); ?>
2175 2217 </form>
2176 2218 <form id="switch_mode_form" method="post"
2177 2219 action="?page=<?php echo esc_attr( $this->page ); ?>">
2178 2220 <input type="hidden" name="design_mode"
2179 - value="<?php echo 'basic' === $this->design_mode ? 'advanced' : 'basic'; // phpcs:ignore WordPress.Security.EscapeOutput ?>">
2221 + value="<?php echo 'basic' === $this->design_mode ? 'advanced' : 'basic'; ?>">
2180 2222 <input type="hidden" name="action" value="edit">
2181 2223 <input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
2224 + <?php $this->create_nonce(); ?>
2182 2225 </form>
2183 2226 </div>
2184 2227 <br/>
2185 2228 <div>
@@ -2187,9 +2230,9 @@
2187 2230 method="post">
2188 2231 <fieldset class="wpda_fieldset">
2189 2232 <legend>
2190 2233 <span>
2191 - <?php echo __( 'Add indexes' ); ?>
2234 + <?php echo esc_attr__( 'Add indexes', 'wp-data-access' ); ?>
2192 2235 </span>
2193 2236 </legend>
2194 2237 <table class="wpda-table-structure" style="border-collapse: collapse;">
2195 2238 <thead>
@@ -2194,15 +2237,15 @@
2194 2237 <table class="wpda-table-structure" style="border-collapse: collapse;">
2195 2238 <thead>
2196 2239 <tr>
2197 2240 <th style="padding-left:10px;">
2198 - <?php echo __( 'Index name' ); ?>
2241 + <?php echo esc_attr__( 'Index name', 'wp-data-access' ); ?>
2199 2242 </th>
2200 2243 <th>
2201 - <?php echo __( 'Type?' ); ?>
2244 + <?php echo esc_attr__( 'Type?', 'wp-data-access' ); ?>
2202 2245 </th>
2203 2246 <th>
2204 - <?php echo __( 'Column name(s)' ); ?>
2247 + <?php echo esc_attr__( 'Column name(s)', 'wp-data-access' ); ?>
2205 2248 </th>
2206 2249 <th></th>
2207 2250 <th class="wpda-table-structure-last-column" style="width:20px;">
2208 2251 <a href="javascript:void(0)" onclick="add_index()"
@@ -2232,29 +2275,29 @@
2232 2275 value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
2233 2276 <a id="wpda_create_index" href="javascript:void(0)"
2234 2277 title="Drops all indexes and recreates them."
2235 2278 class="button wpda_view wpda_tooltip"
2236 - onclick="if ( confirm('<?php echo __( 'Drop all deleted indexes and recreate all changed indexes for table' . ' `' . $this->wpda_table_name . '`?' ); ?>') ) { jQuery('#wpda_create_index_form').submit(); }"
2279 + onclick="if ( confirm('<?php echo 'Drop all deleted indexes and recreate all changed indexes for table' . ' `' . esc_attr( $this->wpda_table_name ) . '`?'; ?>') ) { jQuery('#wpda_create_index_form').submit(); }"
2237 2280 >
2238 2281 <i class="fas fa-check wpda_icon_on_button"></i>
2239 - <?php echo __( '(RE)CREATE INDEXES', 'wp-data-access' ); ?>
2282 + <?php echo esc_attr__( '(RE)CREATE INDEXES', 'wp-data-access' ); ?>
2240 2283 </a>
2241 2284 <a id="wpda_drop_index" href="javascript:void(0)"
2242 2285 title="This action drops your indexes from the database! This cannot be undone."
2243 2286 class="button wpda_view wpda_tooltip"
2244 - onclick="if ( confirm('<?php echo __( 'Drop all indexes for table' . ' `' . $this->wpda_table_name . '`?\n' . __( 'Does not drop primary key indexes and index designs!' ) ); ?>')) { jQuery('#wpda_drop_index_form').submit(); }"
2287 + onclick="if ( confirm('<?php echo esc_attr__( 'Drop all indexes for table', 'wp-data-access' ) . ' `' . esc_attr( $this->wpda_table_name ) . '`?\n' . esc_attr__( 'Does not drop primary key indexes and index designs!', 'wp-data-access' ); ?>')) { jQuery('#wpda_drop_index_form').submit(); }"
2245 2288 >
2246 2289 <i class="fas fa-trash wpda_icon_on_button"></i>
2247 - <?php echo __( 'DROP INDEXES', 'wp-data-access' ); ?>
2290 + <?php echo esc_attr__( 'DROP INDEXES', 'wp-data-access' ); ?>
2248 2291 </a>
2249 2292 <input type='hidden' name='caller'
2250 2293 value='<?php echo esc_attr( $this->caller ); ?>'/>
2251 2294 <a id="submit_indexes" href="javascript:void(0)"
2252 2295 title="Does NOT create indexes! It just saves your index design..."
2253 - onclick="if (!jQuery(this).attr('disabled')) { jQuery('#design_table_form_indexes').submit(); } else { alert('<?php echo __( 'Save table design changes first!' ); ?>'); }"
2296 + onclick="if (!jQuery(this).attr('disabled')) { jQuery('#design_table_form_indexes').submit(); } else { alert('<?php echo esc_attr__( 'Save table design changes first!', 'wp-data-access' ); ?>'); }"
2254 2297 class="button button-primary wpda_view_index wpda_tooltip">
2255 2298 <i class="fas fa-check wpda_icon_on_button"></i>
2256 - <?php echo __( 'Save Indexes' ); ?>
2299 + <?php echo esc_attr__( 'Save Indexes', 'wp-data-access' ); ?>
2257 2300 </a>
2258 2301 </td>
2259 2302 </tr>
2260 2303 </tfoot>
@@ -2259,8 +2302,9 @@
2259 2302 </tr>
2260 2303 </tfoot>
2261 2304 </table>
2262 2305 </fieldset>
2306 + <?php $this->create_nonce(); ?>
2263 2307 </form>
2264 2308 </div>
2265 2309 <?php
2266 2310 if ( null !== $this->create_table_statement && false === $this->create_table_succeeded ) {
@@ -2270,9 +2314,9 @@
2270 2314 <table class="wpda-table-structure">
2271 2315 <tfoot>
2272 2316 <tr>
2273 2317 <td>
2274 - <h3><?php echo __( 'The following CREATE TABLE statement failed' ); ?></h3>
2318 + <h3><?php echo esc_attr__( 'The following CREATE TABLE statement failed', 'wp-data-access' ); ?></h3>
2275 2319 <div>
2276 2320 <div style="padding:10px; text-align: left; width: fit-content; margin: 0 auto;">
2277 2321 <?php echo $this->create_table_statement; // phpcs:ignore WordPress.Security.EscapeOutput ?>
2278 2322 </div>
@@ -2277,9 +2321,9 @@
2277 2321 <?php echo $this->create_table_statement; // phpcs:ignore WordPress.Security.EscapeOutput ?>
2278 2322 </div>
2279 2323 </div>
2280 2324 <div>
2281 - <strong><?php echo $this->wpdb_error; // phpcs:ignore WordPress.Security.EscapeOutput ?></strong>
2325 + <strong><?php echo esc_attr( $this->wpdb_error ); ?></strong>
2282 2326 </div>
2283 2327 </td>
2284 2328 </tr>
2285 2329 </tfoot>
@@ -2286,9 +2330,9 @@
2286 2330 </table>
2287 2331 </div>
2288 2332 <?php
2289 2333 }
2290 - if ( null !== $this->create_index_failed && 0 < count( $this->create_index_failed ) ) {//phpcs:ignore - 8.1 proof
2334 + if ( null !== $this->create_index_failed && 0 < count( $this->create_index_failed ) ) { // phpcs:ignore -- 8.1 proof
2291 2335 ?>
2292 2336 <br/>
2293 2337 <div class="wpda_design_table">
2294 2338 <table class="wpda-table-structure">
@@ -2294,9 +2338,9 @@
2294 2338 <table class="wpda-table-structure">
2295 2339 <tfoot>
2296 2340 <tr>
2297 2341 <td>
2298 - <h3><?php echo __( 'The following CREATE INDEX statement(s) failed' ); ?></h3>
2342 + <h3><?php echo esc_attr__( 'The following CREATE INDEX statement(s) failed', 'wp-data-access' ); ?></h3>
2299 2343 <div>
2300 2344 <div style="padding:10px; text-align: left; width: fit-content; margin: 0 auto;">
2301 2345 <?php
2302 2346 foreach ( $this->create_index_failed as $index_failed ) {
@@ -2319,9 +2363,9 @@
2319 2363 <table class="wpda-table-structure">
2320 2364 <tfoot>
2321 2365 <tr>
2322 2366 <td>
2323 - <h3><?php echo __( 'The following ALTER TABLE statement failed' ); ?></h3>
2367 + <h3><?php echo esc_attr__( 'The following ALTER TABLE statement failed', 'wp-data-access' ); ?></h3>
2324 2368 <div>
2325 2369 <div style="padding:10px; text-align: left; width: fit-content; margin: 0 auto;">
2326 2370 <?php echo $this->create_table_statement; // phpcs:ignore WordPress.Security.EscapeOutput ?>
2327 2371 </div>
@@ -2326,9 +2370,9 @@
2326 2370 <?php echo $this->create_table_statement; // phpcs:ignore WordPress.Security.EscapeOutput ?>
2327 2371 </div>
2328 2372 </div>
2329 2373 <div>
2330 - <strong><?php echo $this->wpdb_error; // phpcs:ignore WordPress.Security.EscapeOutput ?></strong>
2374 + <strong><?php echo esc_attr( $this->wpdb_error ); ?></strong>
2331 2375 </div>
2332 2376 </td>
2333 2377 </tr>
2334 2378 </tfoot>
@@ -2484,9 +2528,9 @@
2484 2528 true,
2485 2529 '<?php echo esc_attr( $design_index->index_name ); ?>',
2486 2530 '<?php echo esc_attr( $design_index->unique ); ?>',
2487 2531 '<?php echo esc_attr( $design_index->column_names ); ?>',
2488 - '<?php echo $index_changed; // phpcs:ignore WordPress.Security.EscapeOutput ?>'
2532 + '<?php echo esc_attr( $index_changed ); ?>'
2489 2533 );
2490 2534 </script>
2491 2535 <?php
2492 2536 $indexes_found = true;
@@ -2598,8 +2642,15 @@
2598 2642 </script>
2599 2643 <?php
2600 2644 }
2601 2645
2646 + private function create_nonce() {
2647 + if ( '' === $this->wpda_table_name ) {
2648 + return wp_nonce_field( "wpda-design-table-form-" . WPDA_Design_Table_Model::get_base_table_name() );
2649 + }
2650 + return wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" );
2651 + }
2652 +
2602 2653 /**
2603 2654 * Drop all indexes from database
2604 2655 *
2605 2656 * @since 2.0.14
@@ -2619,9 +2670,10 @@
2619 2670 */
2620 2671 protected function drop_index( $index_name ) {
2621 2672 $wpdadb = WPDADB::get_db_connection( $this->wpda_schema_name );
2622 2673 if ( null === $wpdadb ) {
2623 - wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->wpda_schema_name ) ) );
2674 + /* translators: %s = remote database name */
2675 + wp_die( esc_attr( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), $this->wpda_schema_name ) ) );
2624 2676 }
2625 2677
2626 2678 $suppress = $wpdadb->suppress_errors( true );
2627 2679
@@ -2627,13 +2679,16 @@
2627 2679
2628 2680 // Index is deleted from table design: drop index
2629 2681 $drop_index_statement = 'DROP INDEX `' . str_replace( '`', '', $index_name ) . "` ON `{$this->wpda_table_name}`";
2630 2682 if ( $wpdadb->query( $drop_index_statement ) ) {
2683 + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment
2631 2684 $msg = new WPDA_Message_Box(
2632 2685 array(
2686 + /* translators: %s = index name */
2633 2687 'message_text' => sprintf( __( 'Index `%s` dropped', 'wp-data-access' ), esc_attr( $index_name) ),
2634 2688 )
2635 2689 );
2690 + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment
2636 2691 $msg->box();
2637 2692 } else {
2638 2693 $msg = new WPDA_Message_Box(
2639 2694 array(
@@ -2655,9 +2710,10 @@
2655 2710 */
2656 2711 protected function create_index() {
2657 2712 $wpdadb = WPDADB::get_db_connection( $this->wpda_schema_name );
2658 2713 if ( null === $wpdadb ) {
2659 - wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->wpda_schema_name ) ) );
2714 + /* translators: %s = remote database name */
2715 + wp_die( esc_attr( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), $this->wpda_schema_name ) ) );
2660 2716 }
2661 2717
2662 2718 $suppress = $wpdadb->suppress_errors( true );
2663 2719
@@ -2680,9 +2736,9 @@
2680 2736 } else {
2681 2737 $unique = '';
2682 2738 }
2683 2739 }
2684 - $column_names_array = explode( ',', ( string ) $index->column_names );//phpcs:ignore - 8.1 proof
2740 + $column_names_array = explode( ',', ( string ) $index->column_names ); // phpcs:ignore -- 8.1 proof
2685 2741 $column_names = '`' . implode( '`,`', $column_names_array ) . '`';
2686 2742 $create_index_statement =
2687 2743 "CREATE $unique INDEX `" . str_replace( '`', '', $index->index_name ) . "` ON `{$this->wpda_table_name}` ($column_names)";
2688 2744 $this->create_index_statement .= $create_index_statement . ';' . self::NEW_LINE;
@@ -2691,13 +2747,16 @@
2691 2747 continue;
2692 2748 }
2693 2749
2694 2750 if ( $wpdadb->query( $create_index_statement ) ) {
2751 + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment
2695 2752 $msg = new WPDA_Message_Box(
2696 2753 array(
2754 + /* translators: %s = index name */
2697 2755 'message_text' => sprintf( __( 'Index `%s` created', 'wp-data-access' ), $index->index_name ),
2698 2756 )
2699 2757 );
2758 + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment
2700 2759 $msg->box();
2701 2760 } else {
2702 2761 $msg = new WPDA_Message_Box(
2703 2762 array(