| @@ -1,6 +1,7 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | +// phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- verified on page | |
| 3 | 4 | namespace WPDataAccess\Utilities; |
| 4 | 5 | |
| 5 | 6 | use WPDataAccess\API\WPDA_Tree; |
| 6 | 7 | use WPDataAccess\Connection\WPDADB; |
| @@ -25,9 +26,8 @@ | ||
| 25 | 26 | wp_enqueue_script( 'jquery-ui-tooltip' ); |
| 26 | 27 | wp_enqueue_script( 'jquery-ui-autocomplete' ); |
| 27 | 28 | if ( isset( $_REQUEST['page'] ) ) { |
| 28 | 29 | $this->page = sanitize_text_field( wp_unslash( $_REQUEST['page'] ) ); |
| 29 | - // input var okay. | |
| 30 | 30 | } |
| 31 | 31 | $this->user_can_create_db = WPDA_Dictionary_Access::can_create_db(); |
| 32 | 32 | if ( WPDA::current_user_is_admin() ) { |
| 33 | 33 | if ( isset( $_REQUEST['action'] ) ) { |
| @@ -52,9 +52,9 @@ | ||
| 52 | 52 | if ( isset( $_REQUEST['database_location'] ) && 'local' === $_REQUEST['database_location'] ) { |
| 53 | 53 | // Add local database |
| 54 | 54 | if ( !isset( $_REQUEST['local_database'] ) ) { |
| 55 | 55 | $msg = new WPDA_Message_Box(array( |
| 56 | - 'message_text' => sprintf( __( 'Cannot create database [missing argument]', 'wp-data-access' ) ), | |
| 56 | + 'message_text' => __( 'Cannot create database [missing argument]', 'wp-data-access' ), | |
| 57 | 57 | 'message_type' => 'error', |
| 58 | 58 | 'message_is_dismissible' => false, |
| 59 | 59 | )); |
| 60 | 60 | $msg->box(); |
| @@ -60,67 +60,63 @@ | ||
| 60 | 60 | $msg->box(); |
| 61 | 61 | return; |
| 62 | 62 | } |
| 63 | 63 | $database = str_replace( '`', '', sanitize_text_field( wp_unslash( $_REQUEST['local_database'] ) ) ); |
| 64 | - // input var okay. | |
| 65 | 64 | global $wpdb; |
| 66 | - if ( false === $wpdb->query( $wpdb->prepare( | |
| 67 | - 'create database `%1s`', | |
| 68 | - // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders | |
| 69 | - array(WPDA::remove_backticks( $database )) | |
| 70 | - ) ) ) { | |
| 65 | + // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQLPlaceholders, WordPress.DB.DirectDatabaseQuery.SchemaChange | |
| 66 | + if ( false === $wpdb->query( $wpdb->prepare( 'create database `%1s`', array(WPDA::remove_backticks( $database )) ) ) ) { | |
| 71 | 67 | // db call ok; no-cache ok. |
| 68 | + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment | |
| 72 | 69 | $msg = new WPDA_Message_Box(array( |
| 73 | - 'message_text' => sprintf( __( 'Error creating database `%s`', 'wp-data-access' ), $database ), | |
| 70 | + 'message_text' => sprintf( __( 'Error creating database `%s`', 'wp-data-access' ), esc_attr( $database ) ), | |
| 74 | 71 | 'message_type' => 'error', |
| 75 | 72 | 'message_is_dismissible' => false, |
| 76 | 73 | )); |
| 74 | + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment | |
| 77 | 75 | $msg->box(); |
| 78 | 76 | } else { |
| 77 | + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment | |
| 78 | + // phpcs:disable WordPress.Security.ValidatedSanitizedInput | |
| 79 | 79 | $msg = new WPDA_Message_Box(array( |
| 80 | - 'message_text' => sprintf( __( 'Database `%s` created', 'wp-data-access' ), $database ), | |
| 80 | + 'message_text' => sprintf( __( 'Database `%s` created', 'wp-data-access' ), esc_attr( $database ) ), | |
| 81 | 81 | )); |
| 82 | + // phpcs:enable WordPress.Security.ValidatedSanitizedInput | |
| 83 | + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment | |
| 82 | 84 | $msg->box(); |
| 83 | 85 | $this->switch_schema_name = $database; |
| 84 | 86 | } |
| 87 | + // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQLPlaceholders, WordPress.DB.DirectDatabaseQuery.SchemaChange | |
| 85 | 88 | } else { |
| 86 | 89 | // Add remote database |
| 87 | 90 | $database = ( isset( $_REQUEST['remote_database'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['remote_database'] ) ) : '' ); |
| 88 | - // input var okay. | |
| 89 | 91 | if ( false !== WPDADB::get_remote_database( $database ) ) { |
| 92 | + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment | |
| 90 | 93 | $msg = new WPDA_Message_Box(array( |
| 91 | - 'message_text' => sprintf( __( 'Remote database connection already exists', 'wp-data-access' ) ), | |
| 94 | + 'message_text' => __( 'Remote database connection already exists', 'wp-data-access' ), | |
| 92 | 95 | 'message_type' => 'error', |
| 93 | 96 | 'message_is_dismissible' => false, |
| 94 | 97 | )); |
| 98 | + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment | |
| 95 | 99 | $msg->box(); |
| 96 | 100 | return; |
| 97 | 101 | } |
| 98 | 102 | $host = ( isset( $_REQUEST['remote_host'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['remote_host'] ) ) : '' ); |
| 99 | - // input var okay. | |
| 100 | 103 | $user = ( isset( $_REQUEST['remote_user'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['remote_user'] ) ) : '' ); |
| 101 | - // input var okay. | |
| 104 | + // phpcs:disable WordPress.Security.ValidatedSanitizedInput | |
| 102 | 105 | $passwd = ( isset( $_REQUEST['remote_passwd'] ) ? wp_unslash( $_REQUEST['remote_passwd'] ) : '' ); |
| 103 | - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 106 | + // Cannot use sanitize_text_field on password field! | |
| 107 | + // phpcs:enable WordPress.Security.ValidatedSanitizedInput | |
| 104 | 108 | $port = ( isset( $_REQUEST['remote_port'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['remote_port'] ) ) : '' ); |
| 105 | - // input var okay. | |
| 106 | 109 | $schema = ( isset( $_REQUEST['remote_schema'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['remote_schema'] ) ) : '' ); |
| 107 | - // input var okay. | |
| 108 | 110 | $ssl = ( isset( $_REQUEST['remote_ssl'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['remote_ssl'] ) ) : 'off' ); |
| 109 | - // input var okay. | |
| 110 | 111 | $ssl_key = ( isset( $_REQUEST['remote_client_key'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['remote_client_key'] ) ) : '' ); |
| 111 | - // input var okay. | |
| 112 | 112 | $ssl_cert = ( isset( $_REQUEST['remote_client_certificate'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['remote_client_certificate'] ) ) : '' ); |
| 113 | - // input var okay. | |
| 114 | 113 | $ssl_ca = ( isset( $_REQUEST['remote_ca_certificate'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['remote_ca_certificate'] ) ) : '' ); |
| 115 | - // input var okay. | |
| 116 | 114 | $ssl_path = ( isset( $_REQUEST['remote_certificate_path'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['remote_certificate_path'] ) ) : '' ); |
| 117 | - // input var okay. | |
| 118 | 115 | $ssl_cipher = ( isset( $_REQUEST['remote_specified_cipher'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['remote_specified_cipher'] ) ) : '' ); |
| 119 | - // input var okay. | |
| 120 | 116 | if ( '' === $database || '' === $host || '' === $user || '' === $schema ) { |
| 121 | 117 | $msg = new WPDA_Message_Box(array( |
| 122 | - 'message_text' => sprintf( __( 'Cannot add remote database connection [missing argument]', 'wp-data-access' ) ), | |
| 118 | + 'message_text' => __( 'Cannot add remote database connection [missing argument]', 'wp-data-access' ), | |
| 123 | 119 | 'message_type' => 'error', |
| 124 | 120 | 'message_is_dismissible' => false, |
| 125 | 121 | )); |
| 126 | 122 | $msg->box(); |
| @@ -127,9 +123,9 @@ | ||
| 127 | 123 | return; |
| 128 | 124 | } |
| 129 | 125 | if ( 'rdb:' === $database ) { |
| 130 | 126 | $msg = new WPDA_Message_Box(array( |
| 131 | - 'message_text' => sprintf( __( 'Invalid database name [enter a valid database name, for example rdb:remotedb]', 'wp-data-access' ) ), | |
| 127 | + 'message_text' => __( 'Invalid database name [enter a valid database name, for example rdb:remotedb]', 'wp-data-access' ), | |
| 132 | 128 | 'message_type' => 'error', |
| 133 | 129 | 'message_is_dismissible' => false, |
| 134 | 130 | )); |
| 135 | 131 | $msg->box(); |
| @@ -149,17 +145,19 @@ | ||
| 149 | 145 | $ssl_path, |
| 150 | 146 | $ssl_cipher |
| 151 | 147 | ) ) { |
| 152 | 148 | $msg = new WPDA_Message_Box(array( |
| 153 | - 'message_text' => sprintf( __( 'Cannot add remote database connection', 'wp-data-access' ) ), | |
| 149 | + 'message_text' => __( 'Cannot add remote database connection', 'wp-data-access' ), | |
| 154 | 150 | 'message_type' => 'error', |
| 155 | 151 | 'message_is_dismissible' => false, |
| 156 | 152 | )); |
| 157 | 153 | $msg->box(); |
| 158 | 154 | } else { |
| 155 | + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment | |
| 159 | 156 | $msg = new WPDA_Message_Box(array( |
| 160 | - 'message_text' => sprintf( __( 'Remote database connection `%s` added', 'wp-data-access' ), $database ), | |
| 157 | + 'message_text' => sprintf( __( 'Remote database connection `%s` added', 'wp-data-access' ), esc_attr( $database ) ), | |
| 161 | 158 | )); |
| 159 | + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment | |
| 162 | 160 | $msg->box(); |
| 163 | 161 | $this->switch_schema_name = $database; |
| 164 | 162 | } |
| 165 | 163 | } |
| @@ -170,9 +168,9 @@ | ||
| 170 | 168 | return; |
| 171 | 169 | } |
| 172 | 170 | if ( !isset( $_REQUEST['database'], $_REQUEST['disabled'] ) ) { |
| 173 | 171 | $msg = new WPDA_Message_Box(array( |
| 174 | - 'message_text' => sprintf( __( 'Cannot drop database [missing argument]', 'wp-data-access' ) ), | |
| 172 | + 'message_text' => __( 'Cannot drop database [missing argument]', 'wp-data-access' ), | |
| 175 | 173 | 'message_type' => 'error', |
| 176 | 174 | 'message_is_dismissible' => false, |
| 177 | 175 | )); |
| 178 | 176 | $msg->box(); |
| @@ -179,16 +177,15 @@ | ||
| 179 | 177 | return; |
| 180 | 178 | } |
| 181 | 179 | global $wpdb; |
| 182 | 180 | $database = str_replace( '`', '', sanitize_text_field( wp_unslash( $_REQUEST['database'] ) ) ); |
| 183 | - // input var okay. | |
| 184 | 181 | $disabled = $_REQUEST['disabled'] === 'true'; |
| 185 | - // input var okay. | |
| 186 | 182 | if ( 'rdb:' === substr( $database, 0, 4 ) ) { |
| 187 | 183 | // Toogle remote database |
| 184 | + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment | |
| 188 | 185 | if ( false === WPDADB::get_remote_database( $database, true ) ) { |
| 189 | 186 | $msg = new WPDA_Message_Box(array( |
| 190 | - 'message_text' => sprintf( __( 'Cannot disable remote database connection `%s` [remote database connection not found]', 'wp-data-access' ), $database ), | |
| 187 | + 'message_text' => sprintf( __( 'Cannot disable remote database connection `%s` [remote database connection not found]', 'wp-data-access' ), esc_attr( $database ) ), | |
| 191 | 188 | 'message_type' => 'error', |
| 192 | 189 | 'message_is_dismissible' => false, |
| 193 | 190 | )); |
| 194 | 191 | $msg->box(); |
| @@ -194,9 +191,9 @@ | ||
| 194 | 191 | $msg->box(); |
| 195 | 192 | } else { |
| 196 | 193 | if ( false === WPDADB::dis_remote_database( $database, $disabled ) ) { |
| 197 | 194 | $msg = new WPDA_Message_Box(array( |
| 198 | - 'message_text' => sprintf( __( 'Cannot disable remote database connection `%s`', 'wp-data-access' ), $database ), | |
| 195 | + 'message_text' => sprintf( __( 'Cannot disable remote database connection `%s`', 'wp-data-access' ), esc_attr( $database ) ), | |
| 199 | 196 | 'message_type' => 'error', |
| 200 | 197 | 'message_is_dismissible' => false, |
| 201 | 198 | )); |
| 202 | 199 | $msg->box(); |
| @@ -201,14 +198,15 @@ | ||
| 201 | 198 | )); |
| 202 | 199 | $msg->box(); |
| 203 | 200 | } else { |
| 204 | 201 | $msg = new WPDA_Message_Box(array( |
| 205 | - 'message_text' => sprintf( __( 'Remote database connection `%s` disabled', 'wp-data-access' ), $database ), | |
| 202 | + 'message_text' => sprintf( __( 'Remote database connection `%s` disabled', 'wp-data-access' ), esc_attr( $database ) ), | |
| 206 | 203 | )); |
| 207 | 204 | $msg->box(); |
| 208 | 205 | $this->switch_schema_name = $wpdb->dbname; |
| 209 | 206 | } |
| 210 | 207 | } |
| 208 | + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment | |
| 211 | 209 | } |
| 212 | 210 | } |
| 213 | 211 | |
| 214 | 212 | private function drop_db() { |
| @@ -216,9 +214,9 @@ | ||
| 216 | 214 | return; |
| 217 | 215 | } |
| 218 | 216 | if ( !isset( $_REQUEST['database'] ) ) { |
| 219 | 217 | $msg = new WPDA_Message_Box(array( |
| 220 | - 'message_text' => sprintf( __( 'Cannot drop database [missing argument]', 'wp-data-access' ) ), | |
| 218 | + 'message_text' => __( 'Cannot drop database [missing argument]', 'wp-data-access' ), | |
| 221 | 219 | 'message_type' => 'error', |
| 222 | 220 | 'message_is_dismissible' => false, |
| 223 | 221 | )); |
| 224 | 222 | $msg->box(); |
| @@ -225,14 +223,14 @@ | ||
| 225 | 223 | return; |
| 226 | 224 | } |
| 227 | 225 | global $wpdb; |
| 228 | 226 | $database = str_replace( '`', '', sanitize_text_field( wp_unslash( $_REQUEST['database'] ) ) ); |
| 229 | - // input var okay. | |
| 230 | 227 | if ( 'rdb:' === substr( $database, 0, 4 ) ) { |
| 231 | 228 | // Delete remote database |
| 229 | + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment | |
| 232 | 230 | if ( false === WPDADB::get_remote_database( $database ) ) { |
| 233 | 231 | $msg = new WPDA_Message_Box(array( |
| 234 | - 'message_text' => sprintf( __( 'Cannot delete remote database connection `%s` [remote database connection not found]', 'wp-data-access' ), $database ), | |
| 232 | + 'message_text' => sprintf( __( 'Cannot delete remote database connection `%s` [remote database connection not found]', 'wp-data-access' ), esc_attr( $database ) ), | |
| 235 | 233 | 'message_type' => 'error', |
| 236 | 234 | 'message_is_dismissible' => false, |
| 237 | 235 | )); |
| 238 | 236 | $msg->box(); |
| @@ -238,9 +236,9 @@ | ||
| 238 | 236 | $msg->box(); |
| 239 | 237 | } else { |
| 240 | 238 | if ( false === WPDADB::del_remote_database( $database ) ) { |
| 241 | 239 | $msg = new WPDA_Message_Box(array( |
| 242 | - 'message_text' => sprintf( __( 'Cannot delete remote database connection `%s`', 'wp-data-access' ), $database ), | |
| 240 | + 'message_text' => sprintf( __( 'Cannot delete remote database connection `%s`', 'wp-data-access' ), esc_attr( $database ) ), | |
| 243 | 241 | 'message_type' => 'error', |
| 244 | 242 | 'message_is_dismissible' => false, |
| 245 | 243 | )); |
| 246 | 244 | $msg->box(); |
| @@ -245,14 +243,15 @@ | ||
| 245 | 243 | )); |
| 246 | 244 | $msg->box(); |
| 247 | 245 | } else { |
| 248 | 246 | $msg = new WPDA_Message_Box(array( |
| 249 | - 'message_text' => sprintf( __( 'Remote database connection `%s` deleted', 'wp-data-access' ), $database ), | |
| 247 | + 'message_text' => sprintf( __( 'Remote database connection `%s` deleted', 'wp-data-access' ), esc_attr( $database ) ), | |
| 250 | 248 | )); |
| 251 | 249 | $msg->box(); |
| 252 | 250 | $this->switch_schema_name = $wpdb->dbname; |
| 253 | 251 | } |
| 254 | 252 | } |
| 253 | + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment | |
| 255 | 254 | } else { |
| 256 | 255 | // Drop local database |
| 257 | 256 | if ( $wpdb->dbname === $database ) { |
| 258 | 257 | $msg = new WPDA_Message_Box(array( |
| @@ -271,16 +270,14 @@ | ||
| 271 | 270 | )); |
| 272 | 271 | $msg->box(); |
| 273 | 272 | return; |
| 274 | 273 | } |
| 275 | - if ( false === $wpdb->query( $wpdb->prepare( | |
| 276 | - 'drop database `%1s`', | |
| 277 | - // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders | |
| 278 | - array(WPDA::remove_backticks( $database )) | |
| 279 | - ) ) ) { | |
| 274 | + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment | |
| 275 | + // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQLPlaceholders, WordPress.DB.DirectDatabaseQuery.SchemaChange, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder | |
| 276 | + if ( false === $wpdb->query( $wpdb->prepare( 'drop database `%1s`', array(WPDA::remove_backticks( $database )) ) ) ) { | |
| 280 | 277 | // db call ok; no-cache ok. |
| 281 | 278 | $msg = new WPDA_Message_Box(array( |
| 282 | - 'message_text' => sprintf( __( 'Error dropping database `%s`', 'wp-data-access' ), $database ), | |
| 279 | + 'message_text' => sprintf( __( 'Error dropping database `%s`', 'wp-data-access' ), esc_attr( $database ) ), | |
| 283 | 280 | 'message_type' => 'error', |
| 284 | 281 | 'message_is_dismissible' => false, |
| 285 | 282 | )); |
| 286 | 283 | $msg->box(); |
| @@ -285,13 +282,15 @@ | ||
| 285 | 282 | )); |
| 286 | 283 | $msg->box(); |
| 287 | 284 | } else { |
| 288 | 285 | $msg = new WPDA_Message_Box(array( |
| 289 | - 'message_text' => sprintf( __( 'Database `%s` dropped', 'wp-data-access' ), $database ), | |
| 286 | + 'message_text' => sprintf( __( 'Database `%s` dropped', 'wp-data-access' ), esc_attr( $database ) ), | |
| 290 | 287 | )); |
| 291 | 288 | $msg->box(); |
| 292 | 289 | $this->switch_schema_name = $wpdb->dbname; |
| 293 | 290 | } |
| 291 | + // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQLPlaceholders, WordPress.DB.DirectDatabaseQuery.SchemaChange, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder | |
| 292 | + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment | |
| 294 | 293 | } |
| 295 | 294 | } |
| 296 | 295 | |
| 297 | 296 | private function edit_db() { |
| @@ -299,9 +298,9 @@ | ||
| 299 | 298 | return; |
| 300 | 299 | } |
| 301 | 300 | if ( !isset( $_REQUEST['edit_remote_database'] ) ) { |
| 302 | 301 | $msg = new WPDA_Message_Box(array( |
| 303 | - 'message_text' => sprintf( __( 'Cannot update remote database connection [missing argument]', 'wp-data-access' ) ), | |
| 302 | + 'message_text' => __( 'Cannot update remote database connection [missing argument]', 'wp-data-access' ), | |
| 304 | 303 | 'message_type' => 'error', |
| 305 | 304 | 'message_is_dismissible' => false, |
| 306 | 305 | )); |
| 307 | 306 | $msg->box(); |
| @@ -307,16 +306,16 @@ | ||
| 307 | 306 | $msg->box(); |
| 308 | 307 | return; |
| 309 | 308 | } |
| 310 | 309 | $database = sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_database'] ) ); |
| 311 | - // input var okay. | |
| 310 | + // phpcs:disable WordPress.Security.ValidatedSanitizedInput | |
| 312 | 311 | $database_old = sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_database_old'] ) ); |
| 313 | - // input var okay. | |
| 312 | + // phpcs:enable WordPress.Security.ValidatedSanitizedInput | |
| 314 | 313 | if ( $database !== $database_old ) { |
| 315 | 314 | // Update database connection name |
| 316 | 315 | if ( false === WPDADB::get_remote_database( $database_old ) ) { |
| 317 | 316 | $msg = new WPDA_Message_Box(array( |
| 318 | - 'message_text' => sprintf( __( 'Cannot update remote database connection [remote database connection not found]', 'wp-data-access' ) ), | |
| 317 | + 'message_text' => __( 'Cannot update remote database connection [remote database connection not found]', 'wp-data-access' ), | |
| 319 | 318 | 'message_type' => 'error', |
| 320 | 319 | 'message_is_dismissible' => false, |
| 321 | 320 | )); |
| 322 | 321 | $msg->box(); |
| @@ -325,9 +324,9 @@ | ||
| 325 | 324 | } else { |
| 326 | 325 | // Update database connection information |
| 327 | 326 | if ( false === WPDADB::get_remote_database( $database ) ) { |
| 328 | 327 | $msg = new WPDA_Message_Box(array( |
| 329 | - 'message_text' => sprintf( __( 'Cannot update remote database connection [remote database connection not found]', 'wp-data-access' ) ), | |
| 328 | + 'message_text' => __( 'Cannot update remote database connection [remote database connection not found]', 'wp-data-access' ), | |
| 330 | 329 | 'message_type' => 'error', |
| 331 | 330 | 'message_is_dismissible' => false, |
| 332 | 331 | )); |
| 333 | 332 | $msg->box(); |
| @@ -334,32 +333,24 @@ | ||
| 334 | 333 | return; |
| 335 | 334 | } |
| 336 | 335 | } |
| 337 | 336 | $host = ( isset( $_REQUEST['edit_remote_host'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_host'] ) ) : '' ); |
| 338 | - // input var okay. | |
| 339 | 337 | $user = ( isset( $_REQUEST['edit_remote_user'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_user'] ) ) : '' ); |
| 340 | - // input var okay. | |
| 338 | + // Cannot use sanitize_text_field on password field! | |
| 339 | + // phpcs:disable WordPress.Security.ValidatedSanitizedInput | |
| 341 | 340 | $passwd = ( isset( $_REQUEST['edit_remote_passwd'] ) ? wp_unslash( $_REQUEST['edit_remote_passwd'] ) : '' ); |
| 342 | - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 341 | + // phpcs:enable WordPress.Security.ValidatedSanitizedInput | |
| 343 | 342 | $port = ( isset( $_REQUEST['edit_remote_port'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_port'] ) ) : '' ); |
| 344 | - // input var okay. | |
| 345 | 343 | $schema = ( isset( $_REQUEST['edit_remote_schema'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_schema'] ) ) : '' ); |
| 346 | - // input var okay. | |
| 347 | 344 | $ssl = ( isset( $_REQUEST['edit_remote_ssl'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_ssl'] ) ) : 'off' ); |
| 348 | - // input var okay. | |
| 349 | 345 | $ssl_key = ( isset( $_REQUEST['edit_remote_client_key'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_client_key'] ) ) : '' ); |
| 350 | - // input var okay. | |
| 351 | 346 | $ssl_cert = ( isset( $_REQUEST['edit_remote_client_certificate'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_client_certificate'] ) ) : '' ); |
| 352 | - // input var okay. | |
| 353 | 347 | $ssl_ca = ( isset( $_REQUEST['edit_remote_ca_certificate'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_ca_certificate'] ) ) : '' ); |
| 354 | - // input var okay. | |
| 355 | 348 | $ssl_path = ( isset( $_REQUEST['edit_remote_certificate_path'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_certificate_path'] ) ) : '' ); |
| 356 | - // input var okay. | |
| 357 | 349 | $ssl_cipher = ( isset( $_REQUEST['edit_remote_specified_cipher'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['edit_remote_specified_cipher'] ) ) : '' ); |
| 358 | - // input var okay. | |
| 359 | 350 | if ( '' === $database || '' === $host || '' === $user || '' === $schema ) { |
| 360 | 351 | $msg = new WPDA_Message_Box(array( |
| 361 | - 'message_text' => sprintf( __( 'Cannot edit remote database connection [missing arguments]', 'wp-data-access' ) ), | |
| 352 | + 'message_text' => __( 'Cannot edit remote database connection [missing arguments]', 'wp-data-access' ), | |
| 362 | 353 | 'message_type' => 'error', |
| 363 | 354 | 'message_is_dismissible' => false, |
| 364 | 355 | )); |
| 365 | 356 | $msg->box(); |
| @@ -380,18 +371,22 @@ | ||
| 380 | 371 | $ssl_ca, |
| 381 | 372 | $ssl_path, |
| 382 | 373 | $ssl_cipher |
| 383 | 374 | ) ) { |
| 375 | + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment | |
| 384 | 376 | $msg = new WPDA_Message_Box(array( |
| 385 | - 'message_text' => sprintf( __( 'Cannot update remote database connection `%s`', 'wp-data-access' ), $database ), | |
| 377 | + 'message_text' => sprintf( __( 'Cannot update remote database connection `%s`', 'wp-data-access' ), esc_attr( $database ) ), | |
| 386 | 378 | 'message_type' => 'error', |
| 387 | 379 | 'message_is_dismissible' => false, |
| 388 | 380 | )); |
| 381 | + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment | |
| 389 | 382 | $msg->box(); |
| 390 | 383 | } else { |
| 384 | + // phpcs:disable WordPress.WP.I18n.MissingTranslatorsComment | |
| 391 | 385 | $msg = new WPDA_Message_Box(array( |
| 392 | - 'message_text' => sprintf( __( 'Remote database connection `%s` updated', 'wp-data-access' ), $database ), | |
| 386 | + 'message_text' => sprintf( __( 'Remote database connection `%s` updated', 'wp-data-access' ), esc_attr( $database ) ), | |
| 393 | 387 | )); |
| 388 | + // phpcs:enable WordPress.WP.I18n.MissingTranslatorsComment | |
| 394 | 389 | $msg->box(); |
| 395 | 390 | if ( $database !== $database_old ) { |
| 396 | 391 | $this->switch_schema_name = $database; |
| 397 | 392 | } |
| @@ -492,9 +487,9 @@ | ||
| 492 | 487 | ?> |
| 493 | 488 | |
| 494 | 489 | <h3 class="wpda_db_title"> |
| 495 | 490 | <?php |
| 496 | - echo __( 'Manage Databases', 'wp-data-access' ); | |
| 491 | + esc_html_e( 'Manage Databases', 'wp-data-access' ); | |
| 497 | 492 | ?> |
| 498 | 493 | </h3> |
| 499 | 494 | |
| 500 | 495 | <?php |
| @@ -515,9 +510,9 @@ | ||
| 515 | 510 | <?php |
| 516 | 511 | } |
| 517 | 512 | |
| 518 | 513 | private function no_database() { |
| 519 | - echo __( 'No manageable local databases or remote database connections found', 'wp-data-access' ); | |
| 514 | + esc_html_e( 'No manageable local databases or remote database connections found', 'wp-data-access' ); | |
| 520 | 515 | } |
| 521 | 516 | |
| 522 | 517 | private function list_databases( $dbs ) { |
| 523 | 518 | ?> |
| @@ -527,9 +522,9 @@ | ||
| 527 | 522 | <label for="edit_remote_database" class="database_item_label">Select database:</label> |
| 528 | 523 | <select id="manage_db_selection"> |
| 529 | 524 | <?php |
| 530 | 525 | foreach ( $dbs as $db => $db_type ) { |
| 531 | - echo "<option value='{$db}' data-type='{$db_type}'>{$db}</option>"; | |
| 526 | + echo '<option value="' . esc_attr( $db ) . '" data-type="' . esc_attr( $db_type ) . '">' . esc_attr( $db ) . '</option>'; | |
| 532 | 527 | } |
| 533 | 528 | ?> |
| 534 | 529 | </select> |
| 535 | 530 | |
| @@ -538,9 +533,9 @@ | ||
| 538 | 533 | style="display: none" |
| 539 | 534 | href="javascript:void(0)" |
| 540 | 535 | style="vertical-align:middle;" |
| 541 | 536 | title="<?php |
| 542 | - echo __( "Create function wpda_get_wp_user_id() to access the WordPress user ID from database views", 'wp-data-access' ); | |
| 537 | + esc_html_e( "Create function wpda_get_wp_user_id() to access the WordPress user ID from database views", 'wp-data-access' ); | |
| 543 | 538 | ?>"></a> |
| 544 | 539 | |
| 545 | 540 | </div> |
| 546 | 541 | |
| @@ -735,15 +730,15 @@ | ||
| 735 | 730 | ?> |
| 736 | 731 | |
| 737 | 732 | <h3 class="wpda_db_title"> |
| 738 | 733 | <?php |
| 739 | - echo __( 'Create local database', 'wp-data-access' ); | |
| 734 | + esc_html_e( 'Create local database', 'wp-data-access' ); | |
| 740 | 735 | ?> |
| 741 | 736 | </h3> |
| 742 | 737 | |
| 743 | 738 | <?php |
| 744 | 739 | if ( !$this->user_can_create_db ) { |
| 745 | - echo __( 'You are not authorized to create local databases', 'wp-data-access' ); | |
| 740 | + esc_html_e( 'You are not authorized to create local databases', 'wp-data-access' ); | |
| 746 | 741 | } else { |
| 747 | 742 | ?> |
| 748 | 743 | |
| 749 | 744 | <form method="post" |
| @@ -783,9 +778,9 @@ | ||
| 783 | 778 | onsubmit="return createdb_validate_form_remote();"> |
| 784 | 779 | |
| 785 | 780 | <h3 class="wpda_db_title"> |
| 786 | 781 | <?php |
| 787 | - echo __( 'Create remote database connection', 'wp-data-access' ); | |
| 782 | + esc_html_e( 'Create remote database connection', 'wp-data-access' ); | |
| 788 | 783 | ?> |
| 789 | 784 | </h3> |
| 790 | 785 | |
| 791 | 786 | <div> |
| @@ -890,9 +885,9 @@ | ||
| 890 | 885 | <a href="javascript:void(0)" |
| 891 | 886 | onclick="jQuery(this).closest('form').submit()" |
| 892 | 887 | class="button button-primary"><i |
| 893 | 888 | class="fas fa-cloud-upload wpda_icon_on_button"></i> <?php |
| 894 | - echo __( 'Save', 'wp-data-access' ); | |
| 889 | + esc_html_e( 'Save', 'wp-data-access' ); | |
| 895 | 890 | ?> |
| 896 | 891 | </a> |
| 897 | 892 | <a href="javascript:void(0)" |
| 898 | 893 | onclick="jQuery('#wpda_manage_databases').hide()" |
| @@ -897,9 +892,9 @@ | ||
| 897 | 892 | <a href="javascript:void(0)" |
| 898 | 893 | onclick="jQuery('#wpda_manage_databases').hide()" |
| 899 | 894 | class="button button-secondary"><i |
| 900 | 895 | class="fas fa-times-circle wpda_icon_on_button"></i> <?php |
| 901 | - echo __( 'Cancel', 'wp-data-access' ); | |
| 896 | + esc_html_e( 'Cancel', 'wp-data-access' ); | |
| 902 | 897 | ?> |
| 903 | 898 | </a> |
| 904 | 899 | </div> |
| 905 | 900 | |
| @@ -1150,9 +1145,9 @@ | ||
| 1150 | 1145 | |
| 1151 | 1146 | jQuery("#manage_db_create_wp_user_access").on('click', function() { |
| 1152 | 1147 | const selectedDatabase = jQuery("#manage_db_selection").val() |
| 1153 | 1148 | wpda_dbinit_admin( selectedDatabase, '<?php |
| 1154 | - echo wp_create_nonce( 'wpda_dbinit_admin_' . WPDA::get_current_user_login() ); | |
| 1149 | + echo esc_attr( wp_create_nonce( 'wpda_dbinit_admin_' . WPDA::get_current_user_login() ) ); | |
| 1155 | 1150 | ?>' ) |
| 1156 | 1151 | }) |
| 1157 | 1152 | |
| 1158 | 1153 | jQuery("#edit_local_database_action").on('click', function () { |
| @@ -1284,4 +1279,6 @@ | ||
| 1284 | 1279 | <?php |
| 1285 | 1280 | } |
| 1286 | 1281 | |
| 1287 | 1282 | } |
| 1283 | + | |
| 1284 | +// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing | |
