← All changes | WPDataAccess/Design_Table/WPDA_Design_Table_Form.php +34 -20 5.5.77 → 5.5.84 View file →

		@@ -479,15 +479,22 @@
479	479	if ( ! isset( $_REQUEST['_wpnonce'] ) ) {
480	480	wp_die( esc_attr__( 'Not authorized', 'wp-data-access' ) );
481	481	} else {
482	482	// phpcs:disable WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
483		- if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], "wpda-design-table-form-{$this->wpda_table_name}" ) ) { // direct form access
484		- if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], "wpda-alter-{$this->wpda_table_name}" ) ) { // access from alter table button
485		- $dsg_tbl = 'wpda-query-' . WPDA_Design_Table_Model::get_base_table_name() . '-' . $_POST['wpda_schema_name'] . '-' . $_POST['wpda_table_name']; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated
486		- if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], $dsg_tbl ) ) { // access from list table
487		- wp_die( esc_attr__( 'Not authorized', 'wp-data-access' ) );
488		- }
489		- }
	483	+ if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], "wpda-design-table-form-{$this->wpda_table_name}" )) { // direct form access
	484	+ if (
	485	+ '' === $this->wpda_table_name &&
	486	+ ! wp_verify_nonce( $_REQUEST['_wpnonce'], "wpda-design-table-form-" . WPDA_Design_Table_Model::get_base_table_name() )
	487	+ ) { // insert new table
	488	+ if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], "wpda-alter-{$this->wpda_table_name}" ) ) { // access from alter table button
	489	+ $schema_name = isset( $_POST['wpda_schema_name'] ) ? $_POST['wpda_schema_name'] : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated
	490	+ $table_name = isset( $_POST['wpda_table_name'] ) ? $_POST['wpda_table_name'] : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated
	491	+ $dsg_tbl = 'wpda-query-' . WPDA_Design_Table_Model::get_base_table_name() . '-' . $schema_name . '-' . $table_name;
	492	+ if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], $dsg_tbl ) ) { // access from list table
	493	+ wp_die( esc_attr__( 'Not authorized', 'wp-data-access' ) );
	494	+ }
	495	+ }
	496	+ }
490	497	}
491	498	// phpcs:enable WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
492	499	}
493	500	}
		@@ -1569,9 +1576,9 @@
1569	1576	value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1570	1577	<input type="hidden" name="wpda_schema_name"
1571	1578	value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1572	1579	<input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1573		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	1580	+ <?php $this->create_nonce(); ?>
1574	1581	</form>
1575	1582	<form id="wpda_alter_table_form"
1576	1583	action="?page=<?php echo esc_attr( $this->page ); ?>"
1577	1584	method="post">
		@@ -1581,9 +1588,9 @@
1581	1588	value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1582	1589	<input type="hidden" name="wpda_schema_name"
1583	1590	value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1584	1591	<input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1585		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	1592	+ <?php $this->create_nonce(); ?>
1586	1593	</form>
1587	1594	<form id="wpda_drop_table_form"
1588	1595	action="?page=<?php echo esc_attr( $this->page ); ?>"
1589	1596	method="post">
		@@ -1593,9 +1600,9 @@
1593	1600	value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1594	1601	<input type="hidden" name="wpda_schema_name"
1595	1602	value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1596	1603	<input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1597		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	1604	+ <?php $this->create_nonce(); ?>
1598	1605	</form>
1599	1606	<form id="wpda_create_index_form"
1600	1607	action="?page=<?php echo esc_attr( $this->page ); ?>"
1601	1608	method="post" style="margin-left:1px;margin-right:1px;">
		@@ -1605,9 +1612,9 @@
1605	1612	value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1606	1613	<input type="hidden" name="wpda_schema_name"
1607	1614	value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1608	1615	<input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1609		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	1616	+ <?php $this->create_nonce(); ?>
1610	1617	</form>
1611	1618	<form id="wpda_drop_index_form"
1612	1619	action="?page=<?php echo esc_attr( $this->page ); ?>"
1613	1620	method="post" style="margin-left:1px;margin-right:1px;">
		@@ -1617,9 +1624,9 @@
1617	1624	value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1618	1625	<input type="hidden" name="wpda_schema_name"
1619	1626	value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1620	1627	<input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1621		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	1628	+ <?php $this->create_nonce(); ?>
1622	1629	</form>
1623	1630	</div>
1624	1631	<style>
1625	1632	#overlay_show_create_table {
		@@ -1743,9 +1750,9 @@
1743	1750	onclick="return pre_submit_re()"
1744	1751	>
1745	1752	<a href="javascript:void(0)" onclick="jQuery('#wpda_reverse_engineering').hide()"
1746	1753	class="button"><?php echo esc_attr__( 'Dismiss', 'wp-data-access' ); ?></a>
1747		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	1754	+ <?php $this->create_nonce(); ?>
1748	1755	</form>
1749	1756	</div>
1750	1757	</div>
1751	1758	<?php
		@@ -1763,9 +1770,9 @@
1763	1770	value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1764	1771	<input type="hidden" name="wpda_schema_name_re"
1765	1772	value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1766	1773	<input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1767		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	1774	+ <?php $this->create_nonce(); ?>
1768	1775	</form>
1769	1776	</div>
1770	1777	<?php
1771	1778	}
		@@ -1786,9 +1793,9 @@
1786	1793	value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1787	1794	<input type="hidden" name="wpda_schema_name"
1788	1795	value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1789	1796	<input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1790		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	1797	+ <?php $this->create_nonce(); ?>
1791	1798	</form>
1792	1799	<form id="show_alter_table_form" action="?page=<?php echo esc_attr( $this->page ); ?>"
1793	1800	method="post">
1794	1801	<input type="hidden" name="action" value="edit"/>
		@@ -1797,9 +1804,9 @@
1797	1804	value="<?php echo esc_attr( $this->wpda_table_name ); ?>"/>
1798	1805	<input type="hidden" name="wpda_schema_name"
1799	1806	value="<?php echo esc_attr( $this->wpda_schema_name ); ?>"/>
1800	1807	<input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
1801		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	1808	+ <?php $this->create_nonce(); ?>
1802	1809	</form>
1803	1810	</div>
1804	1811	<form id="design_table_form"
1805	1812	action="?page=<?php echo esc_attr( $this->page ); ?>"
		@@ -2190,9 +2197,9 @@
2190	2197	</tr>
2191	2198	</tfoot>
2192	2199	</table>
2193	2200	</fieldset>
2194		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	2201	+ <?php $this->create_nonce(); ?>
2195	2202	</form>
2196	2203	<form id="wpda_reset_form" action="?page=<?php echo esc_attr( $this->page ); ?>" method="post">
2197	2204	<input type="hidden" name="action" value="edit"/>
2198	2205	<?php
		@@ -2205,9 +2212,9 @@
2205	2212	<?php
2206	2213	}
2207	2214	?>
2208	2215	<input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
2209		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	2216	+ <?php $this->create_nonce(); ?>
2210	2217	</form>
2211	2218	<form id="switch_mode_form" method="post"
2212	2219	action="?page=<?php echo esc_attr( $this->page ); ?>">
2213	2220	<input type="hidden" name="design_mode"
		@@ -2213,9 +2220,9 @@
2213	2220	<input type="hidden" name="design_mode"
2214	2221	value="<?php echo 'basic' === $this->design_mode ? 'advanced' : 'basic'; ?>">
2215	2222	<input type="hidden" name="action" value="edit">
2216	2223	<input type='hidden' name='caller' value='<?php echo esc_attr( $this->caller ); ?>'/>
2217		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	2224	+ <?php $this->create_nonce(); ?>
2218	2225	</form>
2219	2226	</div>
2220	2227	<br/>
2221	2228	<div>
		@@ -2295,9 +2302,9 @@
2295	2302	</tr>
2296	2303	</tfoot>
2297	2304	</table>
2298	2305	</fieldset>
2299		- <?php wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" ) ?>
	2306	+ <?php $this->create_nonce(); ?>
2300	2307	</form>
2301	2308	</div>
2302	2309	<?php
2303	2310	if ( null !== $this->create_table_statement && false === $this->create_table_succeeded ) {
		@@ -2634,8 +2641,15 @@
2634	2641	?>
2635	2642	</script>
2636	2643	<?php
2637	2644	}
	2645	+
	2646	+ private function create_nonce() {
	2647	+ if ( '' === $this->wpda_table_name ) {
	2648	+ return wp_nonce_field( "wpda-design-table-form-" . WPDA_Design_Table_Model::get_base_table_name() );
	2649	+ }
	2650	+ return wp_nonce_field( "wpda-design-table-form-{$this->wpda_table_name}" );
	2651	+ }
2638	2652
2639	2653	/**
2640	2654	* Drop all indexes from database
2641	2655	*