← All changes | WPDataAccess/API/WPDA_Apps.php +295 -69 5.5.77 → 5.5.84 View file →

		@@ -280,9 +280,13 @@
280	280	'map' => array(
281	281	'required' => false,
282	282	'type' => 'string',
283	283	'description' => __( 'Map settings - JSON string', 'wp-data-access' ),
284		- 'sanitize_callback' => 'wp_kses_post',
	284	+ 'sanitize_callback' => function ( $param ) {
	285	+ $sanitized_settings = $this->sanitize_settings( json_decode( (string) $param, true ) );
	286	+ // Save sanitized JSON as string
	287	+ return json_encode( $sanitized_settings );
	288	+ },
285	289	'validate_callback' => 'rest_validate_request_arg',
286	290	),
287	291	'chart' => array(
288	292	'required' => false,
		@@ -514,8 +518,15 @@
514	518	'permission_callback' => '__return_true',
515	519	'args' => array(
516	520	'dbs_source' => $this->get_param( 'dbs' ),
517	521	'dbs_destination' => $this->get_param( 'dbs' ),
	522	+ 'appDbId' => array(
	523	+ 'required' => false,
	524	+ 'type' => 'integer',
	525	+ 'description' => __( 'App Id', 'wp-data-access' ),
	526	+ 'sanitize_callback' => 'absint',
	527	+ 'validate_callback' => 'rest_validate_request_arg',
	528	+ ),
518	529	),
519	530	) );
520	531	register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/lang/get', array(
521	532	'methods' => array('POST'),
		@@ -564,10 +575,110 @@
564	575	'validate_callback' => 'rest_validate_request_arg',
565	576	),
566	577	),
567	578	) );
	579	+ // PWA
	580	+ register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/pwa/get', array(
	581	+ 'methods' => array('POST'),
	582	+ 'callback' => array($this, 'app_wpa_get'),
	583	+ 'permission_callback' => '__return_true',
	584	+ 'args' => array(
	585	+ 'app_id' => $this->get_param( 'app_id' ),
	586	+ ),
	587	+ ) );
	588	+ register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/pwa/activate', array(
	589	+ 'methods' => array('POST'),
	590	+ 'callback' => array($this, 'app_wpa_activate'),
	591	+ 'permission_callback' => '__return_true',
	592	+ 'args' => array(
	593	+ 'app_id' => $this->get_param( 'app_id' ),
	594	+ ),
	595	+ ) );
	596	+ register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/pwa/deactivate', array(
	597	+ 'methods' => array('POST'),
	598	+ 'callback' => array($this, 'app_wpa_deactivate'),
	599	+ 'permission_callback' => '__return_true',
	600	+ 'args' => array(
	601	+ 'app_id' => $this->get_param( 'app_id' ),
	602	+ ),
	603	+ ) );
	604	+ register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/upload', array(
	605	+ 'methods' => array('POST'),
	606	+ 'callback' => array($this, 'app_upload'),
	607	+ 'permission_callback' => '__return_true',
	608	+ 'args' => array(
	609	+ 'app_id' => $this->get_param( 'app_id' ),
	610	+ 'cnt_id' => $this->get_param( 'cnt_id' ),
	611	+ 'pk' => array(
	612	+ 'required' => true,
	613	+ 'type' => 'string',
	614	+ 'description' => __( 'Primary key in JSON format', 'wp-data-access' ),
	615	+ 'sanitize_callback' => 'sanitize_text_field',
	616	+ 'validate_callback' => 'rest_validate_request_arg',
	617	+ ),
	618	+ 'col' => $this->get_param( 'col' ),
	619	+ ),
	620	+ ) );
	621	+ register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/download', array(
	622	+ 'methods' => array('POST'),
	623	+ 'callback' => array($this, 'app_download'),
	624	+ 'permission_callback' => '__return_true',
	625	+ 'args' => array(
	626	+ 'app_id' => $this->get_param( 'app_id' ),
	627	+ 'cnt_id' => $this->get_param( 'cnt_id' ),
	628	+ 'pk' => array(
	629	+ 'required' => true,
	630	+ 'type' => 'string',
	631	+ 'description' => __( 'Primary key in JSON format', 'wp-data-access' ),
	632	+ 'sanitize_callback' => 'sanitize_text_field',
	633	+ 'validate_callback' => 'rest_validate_request_arg',
	634	+ ),
	635	+ 'col' => $this->get_param( 'col' ),
	636	+ ),
	637	+ ) );
568	638	}
569	639
	640	+ public function app_download( $request ) {
	641	+ return $this->WPDA_Rest_Response( 'OK' );
	642	+ }
	643	+
	644	+ public function app_upload( $request ) {
	645	+ return $this->WPDA_Rest_Response( 'OK' );
	646	+ }
	647	+
	648	+ public function app_wpa_deactivate( $request ) {
	649	+ if ( !$this->current_user_can_access() ) {
	650	+ // Only admins
	651	+ return $this->unauthorized();
	652	+ }
	653	+ if ( !$this->current_user_token_valid( $request ) ) {
	654	+ return $this->invalid_nonce();
	655	+ }
	656	+ return $this->WPDA_Rest_Response( 'OK' );
	657	+ }
	658	+
	659	+ public function app_wpa_activate( $request ) {
	660	+ if ( !$this->current_user_can_access() ) {
	661	+ // Only admins
	662	+ return $this->unauthorized();
	663	+ }
	664	+ if ( !$this->current_user_token_valid( $request ) ) {
	665	+ return $this->invalid_nonce();
	666	+ }
	667	+ return $this->WPDA_Rest_Response( 'OK' );
	668	+ }
	669	+
	670	+ public function app_wpa_get( $request ) {
	671	+ if ( !$this->current_user_can_access() ) {
	672	+ // Only admins
	673	+ return $this->unauthorized();
	674	+ }
	675	+ if ( !$this->current_user_token_valid( $request ) ) {
	676	+ return $this->invalid_nonce();
	677	+ }
	678	+ return $this->WPDA_Rest_Response( 'NOT FOUND' );
	679	+ }
	680	+
570	681	public function app_call( $request ) {
571	682	return $this->bad_request();
572	683	}
573	684
		@@ -863,8 +974,9 @@
863	974	$media = $request->get_param( 'media' );
864	975	$rel_tab = $request->get_param( 'rel_tab' );
865	976	$client_side = '1' === $request->get_param( 'client_side' );
866	977	$geo_radius = $request->get_param( 'geo_radius' );
	978	+ $docs = array();
867	979	$default_where = '';
868	980	$default_orderby = '';
869	981	$lookups = array();
870	982	$m2m_relationship = array();
		@@ -912,8 +1024,27 @@
912	1024	}
913	1025	}
914	1026	}
915	1027	}
	1028	+ if ( isset( $settings['columns'] ) && is_array( $settings['columns'] ) && '1' !== $rel_tab ) {
	1029	+ $queryable_columns = array();
	1030	+ if ( isset( $settings['table']['columns'] ) && is_array( $settings['table']['columns'] ) ) {
	1031	+ foreach ( $settings['table']['columns'] as $column ) {
	1032	+ if ( isset( $column['queryable'] ) && $column['queryable'] ) {
	1033	+ $queryable_columns[] = $column['columnName'];
	1034	+ }
	1035	+ }
	1036	+ }
	1037	+ $app_columns = array();
	1038	+ foreach ( $settings['columns'] as $column ) {
	1039	+ if ( isset( $column['columnName'], $column['isSelected'] ) && $column['isSelected'] ) {
	1040	+ $app_columns[$column['columnName']] = in_array( $column['columnName'], $queryable_columns );
	1041	+ }
	1042	+ }
	1043	+ if ( 0 < count( $app_columns ) ) {
	1044	+ $col = $app_columns;
	1045	+ }
	1046	+ }
916	1047	$table_api = new WPDA_Table();
917	1048	return $table_api->select(
918	1049	$dbs,
919	1050	$tbl,
		@@ -938,9 +1069,10 @@
938	1069	$md,
939	1070	$m2m_relationship,
940	1071	$search_data_types,
941	1072	$client_side,
942		- $geo_radius
	1073	+ $geo_radius,
	1074	+ $docs
943	1075	);
944	1076	} else {
945	1077	if ( 'rest_cookie_invalid_nonce' === $msg ) {
946	1078	return $this->invalid_nonce();
		@@ -964,8 +1096,9 @@
964	1096	return array_map( function ( $value ) {
965	1097	if ( true === $value['isSelected'] ) {
966	1098	return $value['columnName'];
967	1099	}
	1100	+ return null;
968	1101	}, $columns );
969	1102	}
970	1103
971	1104	public function app_get( $request ) {
		@@ -973,8 +1106,9 @@
973	1106	$cnt_id = $request->get_param( 'cnt_id' );
974	1107	$key = $request->get_param( 'key' );
975	1108	$media = $request->get_param( 'media' );
976	1109	$rel_tab = $request->get_param( 'rel_tab' );
	1110	+ $docs = array();
977	1111	if ( $this->check_app_access(
978	1112	$app_id,
979	1113	$cnt_id,
980	1114	'select',
		@@ -994,9 +1128,10 @@
994	1128	$tbl,
995	1129	$key,
996	1130	$media,
997	1131	$column_names,
998		- $default_where
	1132	+ $default_where,
	1133	+ $docs
999	1134	);
1000	1135	} else {
1001	1136	if ( 'rest_cookie_invalid_nonce' === $msg ) {
1002	1137	return $this->invalid_nonce();
		@@ -1237,8 +1372,12 @@
1237	1372	}
1238	1373	}
1239	1374
1240	1375	public function app_lookup_dbs( $request ) {
	1376	+ // Only admins are allowed to configre lookups
	1377	+ if ( !$this->current_user_can_access() ) {
	1378	+ return $this->unauthorized();
	1379	+ }
1241	1380	$app_id = $request->get_param( 'app_id' );
1242	1381	$cnt_id = $request->get_param( 'cnt_id' );
1243	1382	if ( $this->check_app_access(
1244	1383	$app_id,
		@@ -1261,8 +1400,12 @@
1261	1400	}
1262	1401	}
1263	1402
1264	1403	public function app_lookup_tbl( $request ) {
	1404	+ // Only admins are allowed to configre lookups
	1405	+ if ( !$this->current_user_can_access() ) {
	1406	+ return $this->unauthorized();
	1407	+ }
1265	1408	$app_id = $request->get_param( 'app_id' );
1266	1409	$cnt_id = $request->get_param( 'cnt_id' );
1267	1410	$dbs = $request->get_param( 'dbs' );
1268	1411	if ( $this->check_app_access(
		@@ -1286,8 +1429,12 @@
1286	1429	}
1287	1430	}
1288	1431
1289	1432	public function app_lookup_cls( $request ) {
	1433	+ // Only admins are allowed to configre lookups
	1434	+ if ( !$this->current_user_can_access() ) {
	1435	+ return $this->unauthorized();
	1436	+ }
1290	1437	$app_id = $request->get_param( 'app_id' );
1291	1438	$cnt_id = $request->get_param( 'cnt_id' );
1292	1439	$dbs = $request->get_param( 'dbs' );
1293	1440	$tbl = $request->get_param( 'tbl' );
		@@ -1336,8 +1483,68 @@
1336	1483	$renamed = 0;
1337	1484	$debug_mode = 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG );
1338	1485	$debug = array();
1339	1486	$errors = array();
	1487	+ if ( $request->get_param( 'appDbId' ) ) {
	1488	+ // Update app only
	1489	+ $appDbId = $request->get_param( 'appDbId' );
	1490	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table
	1491	+ $sql = $wpdb->prepare( "update `{$wpdb->prefix}wpda_app_container` set `cnt_dbs` = %s where `cnt_dbs` = %s and app_id = %d", array($dbs_destination, $dbs_source, $appDbId) );
	1492	+ $result = $wpdb->query( $sql );
	1493	+ // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	1494	+ $renamed += $result;
	1495	+ if ( $debug_mode ) {
	1496	+ $debug[] = array(
	1497	+ 'sql' => $sql,
	1498	+ 'result' => $result,
	1499	+ );
	1500	+ }
	1501	+ if ( '' !== $wpdb->last_error ) {
	1502	+ $errors[] = array(
	1503	+ 'sql' => $sql,
	1504	+ 'error' => $wpdb->last_error,
	1505	+ );
	1506	+ }
	1507	+ $sql_content = array("update `{$wpdb->prefix}wpda_app_container` set `cnt_table` = replace(`cnt_table`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_table` like '%\"dbs\":\"%1s\"%' and app_id = %d", "update `{$wpdb->prefix}wpda_app_container` set `cnt_form` = replace(`cnt_form`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_form` like '%\"dbs\":\"%1s\"%' and app_id = %d");
	1508	+ foreach ( $sql_content as $sql ) {
	1509	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table
	1510	+ $result = $wpdb->query( $wpdb->prepare( $sql, array(
	1511	+ $dbs_source,
	1512	+ $dbs_destination,
	1513	+ $dbs_source,
	1514	+ $appDbId
	1515	+ ) ) );
	1516	+ $renamed += $result;
	1517	+ if ( $debug_mode ) {
	1518	+ $debug[] = array(
	1519	+ 'sql' => $sql,
	1520	+ 'result' => $result,
	1521	+ );
	1522	+ }
	1523	+ if ( '' !== $wpdb->last_error ) {
	1524	+ $errors[] = array(
	1525	+ 'sql' => $sql,
	1526	+ 'error' => $wpdb->last_error,
	1527	+ );
	1528	+ }
	1529	+ }
	1530	+ $context = array();
	1531	+ if ( $debug_mode ) {
	1532	+ $context['debug'] = $debug;
	1533	+ }
	1534	+ if ( 0 < count( $errors ) ) {
	1535	+ $context['errors'] = $errors;
	1536	+ return new \WP_Error('error', 'Failed renaming database', array(
	1537	+ 'status' => 401,
	1538	+ 'context' => $context,
	1539	+ ));
	1540	+ }
	1541	+ return $this->WPDA_Rest_Response( sprintf(
	1542	+ /* translators: %s = number of database substitutions */
	1543	+ __( 'Successfully renamed %s database occurrences', 'wp-data-access' ),
	1544	+ $renamed
	1545	+ ), null, $context );
	1546	+ }
1340	1547	// Rename all occurrences in repository tables and apps
1341	1548	$sqls = array(
1342	1549	"update `{$wpdb->prefix}wpda_publisher` set `pub_schema_name` = %s where `pub_schema_name` = %s",
1343	1550	"update `{$wpdb->prefix}wpda_project_page` set `page_schema_name` = %s where `page_schema_name` = %s",
		@@ -1434,14 +1641,23 @@
1434	1641	));
1435	1642	}
1436	1643	$suppress = $wpdadb->suppress_errors( true );
1437	1644	$chart_data = $wpdadb->get_results( $query, 'ARRAY_A' );
	1645	+ // Add an * before each label to support numeric labels
	1646	+ $chart_data_converted = array();
	1647	+ foreach ( $chart_data as $data ) {
	1648	+ $row = array();
	1649	+ foreach ( $data as $key => $value ) {
	1650	+ $row['*' . $key] = $value;
	1651	+ }
	1652	+ $chart_data_converted[] = $row;
	1653	+ }
1438	1654	$wpdadb->get_results( "create temporary table `wpda_chart_data_types` as {$query}", 'ARRAY_A' );
1439	1655	$explain = $wpdadb->get_results( "desc `wpda_chart_data_types`", 'ARRAY_A' );
1440	1656	$wpdadb->get_results( "drop temporary table `wpda_chart_data_types`", 'ARRAY_A' );
1441	1657	$wpdadb->suppress_errors( $suppress );
1442	1658	return array(
1443		- 'data' => $chart_data,
	1659	+ 'data' => $chart_data_converted,
1444	1660	'explain' => $explain,
1445	1661	);
1446	1662	} else {
1447	1663	return new \WP_Error('error', $msg, array(
		@@ -1922,8 +2138,9 @@
1922	2138	$app_id_details = array_map( function ( $e ) {
1923	2139	if ( isset( $e['app_id_detail'] ) ) {
1924	2140	return $e['app_id_detail'];
1925	2141	}
	2142	+ return null;
1926	2143	}, $apps );
1927	2144	$app_titles = array();
1928	2145	foreach ( $app_id_details as $app_id_detail ) {
1929	2146	$app_detail = WPDA_App_Model::get_by_id( $app_id_detail );
		@@ -1961,16 +2178,43 @@
1961	2178	$settings->wp = [
1962	2179	'roles' => $this->get_wp_roles(),
1963	2180	'users' => $this->get_wp_users(),
1964	2181	'home' => admin_url( 'admin.php' ),
	2182	+ 'siteurl' => site_url(),
1965	2183	'tables' => array_values( $wpdb->tables() ),
1966	2184	'date_format' => get_option( 'date_format' ),
1967	2185	'time_format' => get_option( 'time_format' ),
1968	2186	'scroll_offset' => WPDA::get_option( WPDA::OPTION_APPS_SCROLL_OFFSET ),
	2187	+ 'upload' => @ini_get( 'upload_max_filesize' ),
	2188	+ 'uploadBytes' => $this->uploadToBytes( @ini_get( 'upload_max_filesize' ) ),
	2189	+ 'locale' => get_locale(),
1969	2190	];
1970	2191	return $settings;
1971	2192	}
1972	2193
	2194	+ /**
	2195	+ * Convert a PHP shorthand notation (e.g., "2M", "512K", "1G") to bytes.
	2196	+ *
	2197	+ * @param string $val The shorthand size string.
	2198	+ *
	2199	+ * @return int The size in bytes.
	2200	+ */
	2201	+ private function uploadToBytes( $val ) : int {
	2202	+ $val = trim( $val );
	2203	+ $lastChar = strtolower( $val[strlen( $val ) - 1] );
	2204	+ $num = (float) $val;
	2205	+ switch ( $lastChar ) {
	2206	+ case 'g':
	2207	+ $num *= 1024;
	2208	+ case 'm':
	2209	+ $num *= 1024;
	2210	+ case 'k':
	2211	+ $num *= 1024;
	2212	+ break;
	2213	+ }
	2214	+ return (int) round( $num );
	2215	+ }
	2216	+
1973	2217	private function get_app_container_meta( $app_id, $container, $rel_tab = false ) {
1974	2218	$app = WPDA_App_Model::get_by_id( $app_id );
1975	2219	if ( false === $app ) {
1976	2220	return $this->bad_request();
		@@ -2047,8 +2291,17 @@
2047	2291	return $this->get_app_container_meta( $app_id, $container );
2048	2292	}
2049	2293	}
2050	2294
	2295	+ private function escapeUnicodeForExport( $str ) {
	2296	+ if ( empty( $str ) ) {
	2297	+ return $str;
	2298	+ }
	2299	+ return preg_replace_callback( '/\\\\(u[0-9a-fA-F]{4})/', function ( $matches ) {
	2300	+ return '\\\\' . $matches[1];
	2301	+ }, $str );
	2302	+ }
	2303	+
2051	2304	private function do_app_export_app( $app_id, $main_app_id ) {
2052	2305	global $wpdb;
2053	2306	$quotes = function ( $value ) {
2054	2307	return str_replace( array(
		@@ -2058,9 +2311,10 @@
2058	2311	"\\t",
2059	2312	"\\\\n",
2060	2313	"\\n",
2061	2314	"\\r\\n",
2062		- "\\r"
	2315	+ "\\r",
	2316	+ "\\d"
2063	2317	), array(
2064	2318	"''",
2065	2319	'\\\\"',
2066	2320	"\\\\\\t",
		@@ -2067,9 +2321,10 @@
2067	2321	"\\\\t",
2068	2322	"\\\\\\n",
2069	2323	"\\\\n",
2070	2324	"\\\\r\\\\n",
2071		- "\\\\r"
	2325	+ "\\\\r",
	2326	+ "\\\\\\\\\\d"
2072	2327	), $value );
2073	2328	};
2074	2329	$app = WPDA_App_Model::get_by_id( $app_id );
2075	2330	$app_settings = ( null === $app[0]['app_settings'] ? 'null' : "{$quotes( $app[0]['app_settings'] )}" );
		@@ -2116,8 +2371,11 @@
2116	2371	// Replace default WordPress database with conversion string
2117	2372	$cnt_dbs = ( $wpdb->dbname === $container['cnt_dbs'] ? '{wp_schema}' : "{$quotes( $container['cnt_dbs'] )}" );
2118	2373	$cnt_table = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_table );
2119	2374	$cnt_form = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_form );
	2375	+ // Replace Unicode characters
	2376	+ $cnt_table = $this->escapeUnicodeForExport( $cnt_table );
	2377	+ $cnt_form = $this->escapeUnicodeForExport( $cnt_form );
2120	2378	// phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed
2121	2379	$containers_sql .= <<<SQL
2122	2380	# Import app container
2123	2381	insert into `{wp_prefix}wpda_app_container`
		@@ -2425,14 +2683,16 @@
2425	2683	$dynamic_params = array()
2426	2684	) {
2427	2685	// Process $search_custom > URL parameters
2428	2686	global $wpdb;
	2687	+ $replacements = array();
	2688	+ $nonce = bin2hex( random_bytes( 8 ) );
2429	2689	foreach ( self::METHODS as $method ) {
2430	2690	$offset = 0;
2431	2691	$search = $method . '[';
	2692	+ // Get filter
2432	2693	while ( ($pos_start = stripos( $where, $search, $offset )) !== false ) {
2433	2694	if ( ($pos_end = stripos( $where, ']', $pos_start )) !== false ) {
2434		- // Get filter
2435	2695	$filter = substr( $where, $pos_start, $pos_end - $pos_start + 1 );
2436	2696	// Get name
2437	2697	$arg_name = substr( $where, $pos_start + strlen( $search ), $pos_end - $pos_start - strlen( $search ) );
2438	2698	// Remove quotes from name
		@@ -2438,64 +2698,34 @@
2438	2698	// Remove quotes from name
2439	2699	if ( substr( $arg_name, 0, 1 ) === "'" && substr( $arg_name, -1 ) === "'" ) {
2440	2700	$arg_name = substr( $arg_name, 1, -1 );
2441	2701	}
2442		- // Remove double quotes from name
	2702	+ // Remove quotes from name
2443	2703	if ( substr( $arg_name, 0, 1 ) === '"' && substr( $arg_name, -1 ) === '"' ) {
2444	2704	$arg_name = substr( $arg_name, 1, -1 );
2445	2705	}
	2706	+ $arg_value = null;
2446	2707	// Handle GET args
2447		- // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared
2448		- if ( $method === self::METHODS[0] ) {
	2708	+ if ( $method === self::METHODS[0] && isset( $search_custom['get'][$arg_name] ) ) {
	2709	+ $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) );
	2710	+ } elseif ( $method === self::METHODS[1] && isset( $search_custom['post'][$arg_name] ) ) {
	2711	+ $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
	2712	+ } elseif ( $method === self::METHODS[2] ) {
2449	2713	if ( isset( $search_custom['get'][$arg_name] ) ) {
2450	2714	$arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) );
2451		- $where = $wpdb->prepare( substr_replace(
2452		- $where,
2453		- '%s',
2454		- $pos_start,
2455		- $pos_end - $pos_start + 1
2456		- ), $arg_value );
2457		- } else {
2458		- $where = str_replace( $filter, 'null', $where );
	2715	+ } elseif ( isset( $search_custom['post'][$arg_name] ) ) {
	2716	+ $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
2459	2717	}
2460	2718	}
2461	2719	// Handle POST args
2462		- if ( $method === self::METHODS[1] ) {
2463		- if ( isset( $search_custom['post'][$arg_name] ) ) {
2464		- $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
2465		- $where = $wpdb->prepare( substr_replace(
2466		- $where,
2467		- '%s',
2468		- $pos_start,
2469		- $pos_end - $pos_start + 1
2470		- ), $arg_value );
2471		- } else {
2472		- $where = str_replace( $filter, 'null', $where );
2473		- }
2474		- }
	2720	+ $placeholder = '###URL_PLACEHOLDER_' . $nonce . '_' . md5( $filter ) . '###';
	2721	+ $where = str_replace( $filter, $placeholder, $where );
2475	2722	// Handle REQUEST args
2476		- if ( $method === self::METHODS[2] ) {
2477		- if ( isset( $search_custom['get'][$arg_name] ) ) {
2478		- $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) );
2479		- $where = $wpdb->prepare( substr_replace(
2480		- $where,
2481		- '%s',
2482		- $pos_start,
2483		- $pos_end - $pos_start + 1
2484		- ), $arg_value );
2485		- } elseif ( isset( $search_custom['post'][$arg_name] ) ) {
2486		- $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
2487		- $where = $wpdb->prepare( substr_replace(
2488		- $where,
2489		- '%s',
2490		- $pos_start,
2491		- $pos_end - $pos_start + 1
2492		- ), $arg_value );
2493		- } else {
2494		- $where = str_replace( $filter, 'null', $where );
2495		- }
	2723	+ if ( $arg_value !== null ) {
	2724	+ $replacements[$placeholder] = $wpdb->prepare( '%s', $arg_value );
	2725	+ } else {
	2726	+ $replacements[$placeholder] = 'null';
2496	2727	}
2497		- // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared
2498	2728	}
2499	2729	$offset = $pos_start + 1;
2500	2730	if ( $offset > strlen( $where ) ) {
2501	2731	$offset = strlen( $where ) - 1;
		@@ -2506,19 +2736,17 @@
2506	2736	if ( is_array( $search_params ) && 1 === count( $search_params ) ) {
2507	2737	$filter_field_name = $this->sanitize_db_identifier( array_keys( $search_params )[0] );
2508	2738	$filter_field_value = sanitize_text_field( $search_params[$filter_field_name] );
2509	2739	$filter_field_name_array = array_map( 'trim', explode( ',', $filter_field_name ) );
2510		- // phpcs:ignore -- 8.1 proof
2511	2740	$filter_field_value_array = array_map( 'trim', explode( ',', $filter_field_value ) );
2512		- // phpcs:ignore -- 8.1 proof
2513	2741	if ( count( $filter_field_name_array ) === count( $filter_field_value_array ) ) {
2514		- // phpcs:ignore -- 8.1 proof
2515	2742	// Add filter to where clause.
2516		- // phpcs:disable Generic.CodeAnalysis.ForLoopWithTestFunctionCall, Squiz.PHP.DisallowSizeFunctionsInLoops, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder
2517	2743	for ($i = 0; $i < count( $filter_field_name_array ); $i++) {
2518		- $where .= (( '' === $where ? '' : ' and ' )) . $wpdb->prepare( ' `%1s` like %s ', array($filter_field_name_array[$i], $filter_field_value_array[$i]) );
	2744	+ $where .= ( '' === $where ? '' : ' and ' );
	2745	+ $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $filter_field_name_array[$i] ) . '###';
	2746	+ $where .= ' `' . $filter_field_name_array[$i] . '` like ' . $placeholder;
	2747	+ $replacements[$placeholder] = $wpdb->prepare( '%s', $filter_field_value_array[$i] );
2519	2748	}
2520		- // phpcs:enable Generic.CodeAnalysis.ForLoopWithTestFunctionCall, Squiz.PHP.DisallowSizeFunctionsInLoops, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder
2521	2749	}
2522	2750	}
2523	2751	// Substitute all shortcode parameters
2524	2752	if ( is_array( $shortcode_params ) ) {
		@@ -2524,15 +2752,11 @@
2524	2752	if ( is_array( $shortcode_params ) ) {
2525	2753	foreach ( $shortcode_params as $column_name => $column_value ) {
2526	2754	$occurences = substr_count( strtolower( $where ), strtolower( "shortcodeParam['{$column_name}']" ) );
2527	2755	if ( 0 < $occurences ) {
2528		- $column_values = array();
2529		- for ($i = 0; $i < $occurences; $i++) {
2530		- $column_values[] = sanitize_text_field( $column_value );
2531		- }
2532		- // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
2533		- $where = $wpdb->prepare( str_ireplace( "shortcodeParam['{$column_name}']", '%s', $where ), $column_values );
2534		- // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	2756	+ $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $column_name ) . '###';
	2757	+ $where = str_ireplace( "shortcodeParam['{$column_name}']", $placeholder, $where );
	2758	+ $replacements[$placeholder] = $wpdb->prepare( '%s', sanitize_text_field( $column_value ) );
2535	2759	}
2536	2760	}
2537	2761	}
2538	2762	// Substitute all unused shortcode parameter calls with null
		@@ -2550,13 +2774,15 @@
2550	2774	}
2551	2775	// Substitute all dynamic parameters
2552	2776	if ( is_array( $dynamic_params ) && 0 < count( $dynamic_params ) ) {
2553	2777	foreach ( $dynamic_params as $column_name => $column_value ) {
2554		- // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
2555		- $where = $wpdb->prepare( str_ireplace( "{:{$column_name}}", '%s', $where ), $column_value );
2556		- // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	2778	+ if ( stripos( $where, "{:{$column_name}}" ) !== false ) {
	2779	+ $placeholder = '###DYNAMIC_PARAM_' . $nonce . '_' . md5( $column_name ) . '###';
	2780	+ $where = str_ireplace( "{:{$column_name}}", $placeholder, $where );
	2781	+ $replacements[$placeholder] = $wpdb->prepare( '%s', $column_value );
	2782	+ }
2557	2783	}
2558	2784	}
2559		- return $where;
	2785	+ return strtr( $where, $replacements );
2560	2786	}
2561	2787
2562	2788	}