PluginProbe
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards / 5.5.84
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards v5.5.84
5.5.84 5.5.83 5.5.82 5.5.81 5.5.80 5.5.79 5.5.77 5.5.76 5.5.75 5.5.73 5.5.72 5.5.22 5.5.23 5.5.29 5.5.3 5.5.31 5.5.32 5.5.34 5.5.35 5.5.36 5.5.37 5.5.4 5.5.40 5.5.41 5.5.42 All 160 releases
← All changes | WPDataAccess/Simple_Form/WPDA_Simple_Form_Data.php +21 -18 5.5.76 → 5.5.84 View file →
@@ -4,8 +4,9 @@
4 4 * Suppress "error - 0 - No summary was found for this file" on phpdoc generation
5 5 *
6 6 * @package WPDataAccess\Simple_Form
7 7 */
8 +// phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- verified on page
8 9 namespace WPDataAccess\Simple_Form;
9 10
10 11 use WPDataAccess\Connection\WPDADB;
11 12 use WPDataAccess\Data_Dictionary\WPDA_Dictionary_Exist;
@@ -102,9 +103,9 @@
102 103 $this->table_name = $table_name;
103 104 // Table must exist and user must be authorized.
104 105 $this->wpda_data_dictionary = new WPDA_Dictionary_Exist($this->schema_name, $this->table_name);
105 106 if ( !$this->wpda_data_dictionary->table_exists() ) {
106 - wp_die( __( 'ERROR: Invalid table name or not authorized' ) );
107 + wp_die( esc_attr__( 'ERROR: Invalid table name or not authorized', 'wp-data-access' ) );
107 108 }
108 109 $this->calling_form = $calling_form;
109 110 $this->wpda_list_columns = $wpda_list_columns;
110 111 $this->wpda_success_msg = $wpda_success_msg;
@@ -150,9 +151,10 @@
150 151 }
151 152 }
152 153 $wpdadb = WPDADB::get_db_connection( $this->schema_name );
153 154 if ( null === $wpdadb ) {
154 - wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
155 + /* translators: %s = database name */
156 + wp_die( sprintf( esc_attr__( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
155 157 }
156 158 $result = $wpdadb->insert( $this->table_name, $column_values_to_be_inserted );
157 159 // db call ok; no-cache ok.
158 160 if ( 1 === $result ) {
@@ -207,9 +209,9 @@
207 209 // Check action from data entry form (standard behaviour)
208 210 $wp_nonce = ( isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : '' );
209 211 // input var okay.
210 212 if ( !wp_verify_nonce( $wp_nonce, $this->calling_form->get_nonce_action() ) ) {
211 - wp_die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
213 + wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
212 214 }
213 215 }
214 216 }
215 217 }
@@ -214,9 +216,10 @@
214 216 }
215 217 }
216 218 $wpdadb = WPDADB::get_db_connection( $this->schema_name );
217 219 if ( null === $wpdadb ) {
218 - wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
220 + /* translators: %s = database name */
221 + wp_die( sprintf( esc_attr__( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
219 222 }
220 223 $table_columns = array();
221 224 // Get all table columns.
222 225 foreach ( $this->wpda_list_columns->get_table_columns() as $column ) {
@@ -262,15 +265,15 @@
262 265 } else {
263 266 if ( 0 === $wpda_err ) {
264 267 // No errors: use new value.
265 268 if ( $this->calling_form->get_new_value( $pk_column ) === '' ) {
266 - wp_die( __( 'ERROR: Wrong arguments [missing primary key value]', 'wp-data-access' ) );
269 + wp_die( esc_attr__( 'ERROR: Wrong arguments [missing primary key value]', 'wp-data-access' ) );
267 270 }
268 271 $pkvalue = $this->calling_form->get_new_value( $pk_column );
269 272 } else {
270 273 // There are errors: use old values (in case a key value was changed).
271 274 if ( $this->calling_form->get_old_value( $pk_column ) === '' ) {
272 - wp_die( __( 'ERROR: Wrong arguments [missing primary key value]', 'wp-data-access' ) );
275 + wp_die( esc_attr__( 'ERROR: Wrong arguments [missing primary key value]', 'wp-data-access' ) );
273 276 }
274 277 $pkvalue = $this->calling_form->get_old_value( $pk_column );
275 278 }
276 279 }
@@ -278,9 +281,8 @@
278 281 // Convert date and time values
279 282 $pkvalue = self::convert_datetime( $table_columns[$pk_column], $pkvalue, $pkvalue );
280 283 }
281 284 $where .= $wpdadb->prepare( $where_current, $pkvalue );
282 - // phpcs:ignore Standard.Category.SniffName.ErrorCode
283 285 }
284 286 } else {
285 287 $alternative_key_found = false;
286 288 // Check for alternative keys
@@ -298,17 +300,16 @@
298 300 $alternative_keys_found++;
299 301 }
300 302 }
301 303 if ( $alternative_keys_found === count( $alternative_keys ) ) {
302 - //phpcs:ignore - 8.1 proof
304 + // phpcs:ignore -- 8.1 proof
303 305 $alternative_key_found = true;
304 306 }
305 307 }
306 308 if ( !$alternative_key_found ) {
307 - wp_die( __( 'ERROR: Wrong arguments [missing key value]', 'wp-data-access' ) );
309 + wp_die( esc_attr__( 'ERROR: Wrong arguments [missing key value]', 'wp-data-access' ) );
308 310 }
309 311 $where .= $wpdadb->prepare( $where_current, $pkvalue );
310 - // phpcs:ignore Standard.Category.SniffName.ErrorCode
311 312 }
312 313 if ( '' === $this->schema_name ) {
313 314 $query = "\n\t\t\t\t\tselect *\n\t\t\t\t\tfrom `{$this->table_name}`\n\t\t\t\t\t{$where}\n\t\t\t\t";
314 315 } else {
@@ -314,13 +315,12 @@
314 315 } else {
315 316 $query = "\n\t\t\t\t\tselect *\n\t\t\t\t\tfrom `{$wpdadb->dbname}`.`{$this->table_name}`\n\t\t\t\t\t{$where}\n\t\t\t\t";
316 317 }
317 318 $result = $wpdadb->get_results( $query, 'ARRAY_A' );
318 - // phpcs:ignore Standard.Category.SniffName.ErrorCode
319 319 if ( 1 === $wpdadb->num_rows ) {
320 320 return $result;
321 321 } else {
322 - wp_die( __( 'ERROR: Wrong arguments [no data found]', 'wp-data-access' ) );
322 + wp_die( esc_attr__( 'ERROR: Wrong arguments [no data found]', 'wp-data-access' ) );
323 323 }
324 324 }
325 325
326 326 /**
@@ -330,9 +330,10 @@
330 330 */
331 331 public function set_row() {
332 332 $wpdadb = WPDADB::get_db_connection( $this->schema_name );
333 333 if ( null === $wpdadb ) {
334 - wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
334 + /* translators: %s = database name */
335 + wp_die( sprintf( esc_attr__( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
335 336 }
336 337 $column_values_to_be_updated = null;
337 338 foreach ( $this->wpda_list_columns->get_table_columns() as $column ) {
338 339 if ( isset( $column['readonly'] ) ) {
@@ -363,16 +364,16 @@
363 364 }
364 365 }
365 366 if ( null === $column_values_to_be_updated ) {
366 367 // Nothing to update.
368 + // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
367 369 if ( $_REQUEST['wpda_message'] && '' !== $_REQUEST['wpda_message'] ) {
368 - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
369 370 // Happens when inserting new row on parent child page
370 371 $msgtxt = sanitize_text_field( wp_unslash( $_REQUEST['wpda_message'] ) );
371 - // input var okay.
372 372 } else {
373 373 $msgtxt = __( 'Nothing to save', 'wp-data-access' );
374 374 }
375 + // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotValidated, WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
375 376 $msg = new WPDA_Message_Box(array(
376 377 'message_text' => $msgtxt,
377 378 ));
378 379 $msg->box();
@@ -384,9 +385,9 @@
384 385 $action2 = $this->calling_form->get_form_action2();
385 386 if ( 'edit' === $action && 'save' === $action2 ) {
386 387 // Form was submitted after update: use old key value to build where clause.
387 388 if ( '' === $this->calling_form->get_old_value( $pk_column ) ) {
388 - wp_die( __( 'ERROR: Wrong arguments [missing primary key value]', 'wp-data-access' ) );
389 + wp_die( esc_attr__( 'ERROR: Wrong arguments [missing primary key value]', 'wp-data-access' ) );
389 390 }
390 391 $where[$pk_column] = $this->calling_form->get_old_value( $pk_column );
391 392 // Set primary keys value(s).
392 393 $data_type = $this->wpda_list_columns->get_column_data_type( $pk_column );
@@ -396,9 +397,9 @@
396 397 }
397 398 } else {
398 399 // Form submitted a new record: use new value (no old value available).
399 400 if ( $this->calling_form->get_new_value( $pk_column ) === '' ) {
400 - wp_die( __( 'ERROR: Wrong arguments [missing primary key value]', 'wp-data-access' ) );
401 + wp_die( esc_attr__( 'ERROR: Wrong arguments [missing primary key value]', 'wp-data-access' ) );
401 402 }
402 403 $where[$pk_column] = $this->calling_form->get_new_value( $pk_column );
403 404 // Set primary keys value(s).
404 405 }
@@ -415,9 +416,9 @@
415 416 } else {
416 417 if ( 0 === $result && '' === $wpdadb->last_error ) {
417 418 $table_info = WPDA::get_table_values( $this->schema_name, $this->table_name );
418 419 if ( 1 === count( $table_info ) && 'connect' === strtolower( $table_info[0]['engine'] ) ) {
419 - //phpcs:ignore - 8.1 proof
420 + // phpcs:ignore -- 8.1 proof
420 421 // Connect engine does not return number of rows updated
421 422 // Presuming update was successful when no error message was returned
422 423 $msg = new WPDA_Message_Box(array(
423 424 'message_text' => $this->wpda_success_msg,
@@ -469,4 +470,6 @@
469 470 return $converted_value;
470 471 }
471 472
472 473 }
474 +
475 +// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing