| @@ -3,9 +3,8 @@ | ||
| 3 | 3 | namespace WPDataAccess\API; |
| 4 | 4 | |
| 5 | 5 | use stdClass; |
| 6 | 6 | use WPDataAccess\Connection\WPDADB; |
| 7 | -use WPDataAccess\Data_Apps\WPDA_PWA; | |
| 8 | 7 | use WPDataAccess\Data_Dictionary\WPDA_List_Columns_Cache; |
| 9 | 8 | use WPDataAccess\Plugin_Table_Models\WPDA_App_Container_Model; |
| 10 | 9 | use WPDataAccess\Plugin_Table_Models\WPDA_App_Apps_Model; |
| 11 | 10 | use WPDataAccess\Plugin_Table_Models\WPDA_App_Model; |
| @@ -281,9 +280,13 @@ | ||
| 281 | 280 | 'map' => array( |
| 282 | 281 | 'required' => false, |
| 283 | 282 | 'type' => 'string', |
| 284 | 283 | 'description' => __( 'Map settings - JSON string', 'wp-data-access' ), |
| 285 | - 'sanitize_callback' => 'wp_kses_post', | |
| 284 | + 'sanitize_callback' => function ( $param ) { | |
| 285 | + $sanitized_settings = $this->sanitize_settings( json_decode( (string) $param, true ) ); | |
| 286 | + // Save sanitized JSON as string | |
| 287 | + return json_encode( $sanitized_settings ); | |
| 288 | + }, | |
| 286 | 289 | 'validate_callback' => 'rest_validate_request_arg', |
| 287 | 290 | ), |
| 288 | 291 | 'chart' => array( |
| 289 | 292 | 'required' => false, |
| @@ -515,8 +518,15 @@ | ||
| 515 | 518 | 'permission_callback' => '__return_true', |
| 516 | 519 | 'args' => array( |
| 517 | 520 | 'dbs_source' => $this->get_param( 'dbs' ), |
| 518 | 521 | 'dbs_destination' => $this->get_param( 'dbs' ), |
| 522 | + 'appDbId' => array( | |
| 523 | + 'required' => false, | |
| 524 | + 'type' => 'integer', | |
| 525 | + 'description' => __( 'App Id', 'wp-data-access' ), | |
| 526 | + 'sanitize_callback' => 'absint', | |
| 527 | + 'validate_callback' => 'rest_validate_request_arg', | |
| 528 | + ), | |
| 519 | 529 | ), |
| 520 | 530 | ) ); |
| 521 | 531 | register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/lang/get', array( |
| 522 | 532 | 'methods' => array('POST'), |
| @@ -1014,8 +1024,27 @@ | ||
| 1014 | 1024 | } |
| 1015 | 1025 | } |
| 1016 | 1026 | } |
| 1017 | 1027 | } |
| 1028 | + if ( isset( $settings['columns'] ) && is_array( $settings['columns'] ) && '1' !== $rel_tab ) { | |
| 1029 | + $queryable_columns = array(); | |
| 1030 | + if ( isset( $settings['table']['columns'] ) && is_array( $settings['table']['columns'] ) ) { | |
| 1031 | + foreach ( $settings['table']['columns'] as $column ) { | |
| 1032 | + if ( isset( $column['queryable'] ) && $column['queryable'] ) { | |
| 1033 | + $queryable_columns[] = $column['columnName']; | |
| 1034 | + } | |
| 1035 | + } | |
| 1036 | + } | |
| 1037 | + $app_columns = array(); | |
| 1038 | + foreach ( $settings['columns'] as $column ) { | |
| 1039 | + if ( isset( $column['columnName'], $column['isSelected'] ) && $column['isSelected'] ) { | |
| 1040 | + $app_columns[$column['columnName']] = in_array( $column['columnName'], $queryable_columns ); | |
| 1041 | + } | |
| 1042 | + } | |
| 1043 | + if ( 0 < count( $app_columns ) ) { | |
| 1044 | + $col = $app_columns; | |
| 1045 | + } | |
| 1046 | + } | |
| 1018 | 1047 | $table_api = new WPDA_Table(); |
| 1019 | 1048 | return $table_api->select( |
| 1020 | 1049 | $dbs, |
| 1021 | 1050 | $tbl, |
| @@ -1067,8 +1096,9 @@ | ||
| 1067 | 1096 | return array_map( function ( $value ) { |
| 1068 | 1097 | if ( true === $value['isSelected'] ) { |
| 1069 | 1098 | return $value['columnName']; |
| 1070 | 1099 | } |
| 1100 | + return null; | |
| 1071 | 1101 | }, $columns ); |
| 1072 | 1102 | } |
| 1073 | 1103 | |
| 1074 | 1104 | public function app_get( $request ) { |
| @@ -1342,8 +1372,12 @@ | ||
| 1342 | 1372 | } |
| 1343 | 1373 | } |
| 1344 | 1374 | |
| 1345 | 1375 | public function app_lookup_dbs( $request ) { |
| 1376 | + // Only admins are allowed to configre lookups | |
| 1377 | + if ( !$this->current_user_can_access() ) { | |
| 1378 | + return $this->unauthorized(); | |
| 1379 | + } | |
| 1346 | 1380 | $app_id = $request->get_param( 'app_id' ); |
| 1347 | 1381 | $cnt_id = $request->get_param( 'cnt_id' ); |
| 1348 | 1382 | if ( $this->check_app_access( |
| 1349 | 1383 | $app_id, |
| @@ -1366,8 +1400,12 @@ | ||
| 1366 | 1400 | } |
| 1367 | 1401 | } |
| 1368 | 1402 | |
| 1369 | 1403 | public function app_lookup_tbl( $request ) { |
| 1404 | + // Only admins are allowed to configre lookups | |
| 1405 | + if ( !$this->current_user_can_access() ) { | |
| 1406 | + return $this->unauthorized(); | |
| 1407 | + } | |
| 1370 | 1408 | $app_id = $request->get_param( 'app_id' ); |
| 1371 | 1409 | $cnt_id = $request->get_param( 'cnt_id' ); |
| 1372 | 1410 | $dbs = $request->get_param( 'dbs' ); |
| 1373 | 1411 | if ( $this->check_app_access( |
| @@ -1391,8 +1429,12 @@ | ||
| 1391 | 1429 | } |
| 1392 | 1430 | } |
| 1393 | 1431 | |
| 1394 | 1432 | public function app_lookup_cls( $request ) { |
| 1433 | + // Only admins are allowed to configre lookups | |
| 1434 | + if ( !$this->current_user_can_access() ) { | |
| 1435 | + return $this->unauthorized(); | |
| 1436 | + } | |
| 1395 | 1437 | $app_id = $request->get_param( 'app_id' ); |
| 1396 | 1438 | $cnt_id = $request->get_param( 'cnt_id' ); |
| 1397 | 1439 | $dbs = $request->get_param( 'dbs' ); |
| 1398 | 1440 | $tbl = $request->get_param( 'tbl' ); |
| @@ -1441,8 +1483,68 @@ | ||
| 1441 | 1483 | $renamed = 0; |
| 1442 | 1484 | $debug_mode = 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG ); |
| 1443 | 1485 | $debug = array(); |
| 1444 | 1486 | $errors = array(); |
| 1487 | + if ( $request->get_param( 'appDbId' ) ) { | |
| 1488 | + // Update app only | |
| 1489 | + $appDbId = $request->get_param( 'appDbId' ); | |
| 1490 | + // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table | |
| 1491 | + $sql = $wpdb->prepare( "update `{$wpdb->prefix}wpda_app_container` set `cnt_dbs` = %s where `cnt_dbs` = %s and app_id = %d", array($dbs_destination, $dbs_source, $appDbId) ); | |
| 1492 | + $result = $wpdb->query( $sql ); | |
| 1493 | + // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared | |
| 1494 | + $renamed += $result; | |
| 1495 | + if ( $debug_mode ) { | |
| 1496 | + $debug[] = array( | |
| 1497 | + 'sql' => $sql, | |
| 1498 | + 'result' => $result, | |
| 1499 | + ); | |
| 1500 | + } | |
| 1501 | + if ( '' !== $wpdb->last_error ) { | |
| 1502 | + $errors[] = array( | |
| 1503 | + 'sql' => $sql, | |
| 1504 | + 'error' => $wpdb->last_error, | |
| 1505 | + ); | |
| 1506 | + } | |
| 1507 | + $sql_content = array("update `{$wpdb->prefix}wpda_app_container` set `cnt_table` = replace(`cnt_table`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_table` like '%\"dbs\":\"%1s\"%' and app_id = %d", "update `{$wpdb->prefix}wpda_app_container` set `cnt_form` = replace(`cnt_form`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_form` like '%\"dbs\":\"%1s\"%' and app_id = %d"); | |
| 1508 | + foreach ( $sql_content as $sql ) { | |
| 1509 | + // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table | |
| 1510 | + $result = $wpdb->query( $wpdb->prepare( $sql, array( | |
| 1511 | + $dbs_source, | |
| 1512 | + $dbs_destination, | |
| 1513 | + $dbs_source, | |
| 1514 | + $appDbId | |
| 1515 | + ) ) ); | |
| 1516 | + $renamed += $result; | |
| 1517 | + if ( $debug_mode ) { | |
| 1518 | + $debug[] = array( | |
| 1519 | + 'sql' => $sql, | |
| 1520 | + 'result' => $result, | |
| 1521 | + ); | |
| 1522 | + } | |
| 1523 | + if ( '' !== $wpdb->last_error ) { | |
| 1524 | + $errors[] = array( | |
| 1525 | + 'sql' => $sql, | |
| 1526 | + 'error' => $wpdb->last_error, | |
| 1527 | + ); | |
| 1528 | + } | |
| 1529 | + } | |
| 1530 | + $context = array(); | |
| 1531 | + if ( $debug_mode ) { | |
| 1532 | + $context['debug'] = $debug; | |
| 1533 | + } | |
| 1534 | + if ( 0 < count( $errors ) ) { | |
| 1535 | + $context['errors'] = $errors; | |
| 1536 | + return new \WP_Error('error', 'Failed renaming database', array( | |
| 1537 | + 'status' => 401, | |
| 1538 | + 'context' => $context, | |
| 1539 | + )); | |
| 1540 | + } | |
| 1541 | + return $this->WPDA_Rest_Response( sprintf( | |
| 1542 | + /* translators: %s = number of database substitutions */ | |
| 1543 | + __( 'Successfully renamed %s database occurrences', 'wp-data-access' ), | |
| 1544 | + $renamed | |
| 1545 | + ), null, $context ); | |
| 1546 | + } | |
| 1445 | 1547 | // Rename all occurrences in repository tables and apps |
| 1446 | 1548 | $sqls = array( |
| 1447 | 1549 | "update `{$wpdb->prefix}wpda_publisher` set `pub_schema_name` = %s where `pub_schema_name` = %s", |
| 1448 | 1550 | "update `{$wpdb->prefix}wpda_project_page` set `page_schema_name` = %s where `page_schema_name` = %s", |
| @@ -1539,14 +1641,23 @@ | ||
| 1539 | 1641 | )); |
| 1540 | 1642 | } |
| 1541 | 1643 | $suppress = $wpdadb->suppress_errors( true ); |
| 1542 | 1644 | $chart_data = $wpdadb->get_results( $query, 'ARRAY_A' ); |
| 1645 | + // Add an * before each label to support numeric labels | |
| 1646 | + $chart_data_converted = array(); | |
| 1647 | + foreach ( $chart_data as $data ) { | |
| 1648 | + $row = array(); | |
| 1649 | + foreach ( $data as $key => $value ) { | |
| 1650 | + $row['*' . $key] = $value; | |
| 1651 | + } | |
| 1652 | + $chart_data_converted[] = $row; | |
| 1653 | + } | |
| 1543 | 1654 | $wpdadb->get_results( "create temporary table `wpda_chart_data_types` as {$query}", 'ARRAY_A' ); |
| 1544 | 1655 | $explain = $wpdadb->get_results( "desc `wpda_chart_data_types`", 'ARRAY_A' ); |
| 1545 | 1656 | $wpdadb->get_results( "drop temporary table `wpda_chart_data_types`", 'ARRAY_A' ); |
| 1546 | 1657 | $wpdadb->suppress_errors( $suppress ); |
| 1547 | 1658 | return array( |
| 1548 | - 'data' => $chart_data, | |
| 1659 | + 'data' => $chart_data_converted, | |
| 1549 | 1660 | 'explain' => $explain, |
| 1550 | 1661 | ); |
| 1551 | 1662 | } else { |
| 1552 | 1663 | return new \WP_Error('error', $msg, array( |
| @@ -2027,8 +2138,9 @@ | ||
| 2027 | 2138 | $app_id_details = array_map( function ( $e ) { |
| 2028 | 2139 | if ( isset( $e['app_id_detail'] ) ) { |
| 2029 | 2140 | return $e['app_id_detail']; |
| 2030 | 2141 | } |
| 2142 | + return null; | |
| 2031 | 2143 | }, $apps ); |
| 2032 | 2144 | $app_titles = array(); |
| 2033 | 2145 | foreach ( $app_id_details as $app_id_detail ) { |
| 2034 | 2146 | $app_detail = WPDA_App_Model::get_by_id( $app_id_detail ); |
| @@ -2072,12 +2184,37 @@ | ||
| 2072 | 2184 | 'date_format' => get_option( 'date_format' ), |
| 2073 | 2185 | 'time_format' => get_option( 'time_format' ), |
| 2074 | 2186 | 'scroll_offset' => WPDA::get_option( WPDA::OPTION_APPS_SCROLL_OFFSET ), |
| 2075 | 2187 | 'upload' => @ini_get( 'upload_max_filesize' ), |
| 2188 | + 'uploadBytes' => $this->uploadToBytes( @ini_get( 'upload_max_filesize' ) ), | |
| 2189 | + 'locale' => get_locale(), | |
| 2076 | 2190 | ]; |
| 2077 | 2191 | return $settings; |
| 2078 | 2192 | } |
| 2079 | 2193 | |
| 2194 | + /** | |
| 2195 | + * Convert a PHP shorthand notation (e.g., "2M", "512K", "1G") to bytes. | |
| 2196 | + * | |
| 2197 | + * @param string $val The shorthand size string. | |
| 2198 | + * | |
| 2199 | + * @return int The size in bytes. | |
| 2200 | + */ | |
| 2201 | + private function uploadToBytes( $val ) : int { | |
| 2202 | + $val = trim( $val ); | |
| 2203 | + $lastChar = strtolower( $val[strlen( $val ) - 1] ); | |
| 2204 | + $num = (float) $val; | |
| 2205 | + switch ( $lastChar ) { | |
| 2206 | + case 'g': | |
| 2207 | + $num *= 1024; | |
| 2208 | + case 'm': | |
| 2209 | + $num *= 1024; | |
| 2210 | + case 'k': | |
| 2211 | + $num *= 1024; | |
| 2212 | + break; | |
| 2213 | + } | |
| 2214 | + return (int) round( $num ); | |
| 2215 | + } | |
| 2216 | + | |
| 2080 | 2217 | private function get_app_container_meta( $app_id, $container, $rel_tab = false ) { |
| 2081 | 2218 | $app = WPDA_App_Model::get_by_id( $app_id ); |
| 2082 | 2219 | if ( false === $app ) { |
| 2083 | 2220 | return $this->bad_request(); |
| @@ -2154,8 +2291,17 @@ | ||
| 2154 | 2291 | return $this->get_app_container_meta( $app_id, $container ); |
| 2155 | 2292 | } |
| 2156 | 2293 | } |
| 2157 | 2294 | |
| 2295 | + private function escapeUnicodeForExport( $str ) { | |
| 2296 | + if ( empty( $str ) ) { | |
| 2297 | + return $str; | |
| 2298 | + } | |
| 2299 | + return preg_replace_callback( '/\\\\(u[0-9a-fA-F]{4})/', function ( $matches ) { | |
| 2300 | + return '\\\\' . $matches[1]; | |
| 2301 | + }, $str ); | |
| 2302 | + } | |
| 2303 | + | |
| 2158 | 2304 | private function do_app_export_app( $app_id, $main_app_id ) { |
| 2159 | 2305 | global $wpdb; |
| 2160 | 2306 | $quotes = function ( $value ) { |
| 2161 | 2307 | return str_replace( array( |
| @@ -2165,9 +2311,10 @@ | ||
| 2165 | 2311 | "\\t", |
| 2166 | 2312 | "\\\\n", |
| 2167 | 2313 | "\\n", |
| 2168 | 2314 | "\\r\\n", |
| 2169 | - "\\r" | |
| 2315 | + "\\r", | |
| 2316 | + "\\d" | |
| 2170 | 2317 | ), array( |
| 2171 | 2318 | "''", |
| 2172 | 2319 | '\\\\"', |
| 2173 | 2320 | "\\\\\\t", |
| @@ -2174,9 +2321,10 @@ | ||
| 2174 | 2321 | "\\\\t", |
| 2175 | 2322 | "\\\\\\n", |
| 2176 | 2323 | "\\\\n", |
| 2177 | 2324 | "\\\\r\\\\n", |
| 2178 | - "\\\\r" | |
| 2325 | + "\\\\r", | |
| 2326 | + "\\\\\\\\\\d" | |
| 2179 | 2327 | ), $value ); |
| 2180 | 2328 | }; |
| 2181 | 2329 | $app = WPDA_App_Model::get_by_id( $app_id ); |
| 2182 | 2330 | $app_settings = ( null === $app[0]['app_settings'] ? 'null' : "{$quotes( $app[0]['app_settings'] )}" ); |
| @@ -2223,8 +2371,11 @@ | ||
| 2223 | 2371 | // Replace default WordPress database with conversion string |
| 2224 | 2372 | $cnt_dbs = ( $wpdb->dbname === $container['cnt_dbs'] ? '{wp_schema}' : "{$quotes( $container['cnt_dbs'] )}" ); |
| 2225 | 2373 | $cnt_table = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_table ); |
| 2226 | 2374 | $cnt_form = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_form ); |
| 2375 | + // Replace Unicode characters | |
| 2376 | + $cnt_table = $this->escapeUnicodeForExport( $cnt_table ); | |
| 2377 | + $cnt_form = $this->escapeUnicodeForExport( $cnt_form ); | |
| 2227 | 2378 | // phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed |
| 2228 | 2379 | $containers_sql .= <<<SQL |
| 2229 | 2380 | # Import app container |
| 2230 | 2381 | insert into `{wp_prefix}wpda_app_container` |
| @@ -2532,14 +2683,16 @@ | ||
| 2532 | 2683 | $dynamic_params = array() |
| 2533 | 2684 | ) { |
| 2534 | 2685 | // Process $search_custom > URL parameters |
| 2535 | 2686 | global $wpdb; |
| 2687 | + $replacements = array(); | |
| 2688 | + $nonce = bin2hex( random_bytes( 8 ) ); | |
| 2536 | 2689 | foreach ( self::METHODS as $method ) { |
| 2537 | 2690 | $offset = 0; |
| 2538 | 2691 | $search = $method . '['; |
| 2692 | + // Get filter | |
| 2539 | 2693 | while ( ($pos_start = stripos( $where, $search, $offset )) !== false ) { |
| 2540 | 2694 | if ( ($pos_end = stripos( $where, ']', $pos_start )) !== false ) { |
| 2541 | - // Get filter | |
| 2542 | 2695 | $filter = substr( $where, $pos_start, $pos_end - $pos_start + 1 ); |
| 2543 | 2696 | // Get name |
| 2544 | 2697 | $arg_name = substr( $where, $pos_start + strlen( $search ), $pos_end - $pos_start - strlen( $search ) ); |
| 2545 | 2698 | // Remove quotes from name |
| @@ -2545,64 +2698,34 @@ | ||
| 2545 | 2698 | // Remove quotes from name |
| 2546 | 2699 | if ( substr( $arg_name, 0, 1 ) === "'" && substr( $arg_name, -1 ) === "'" ) { |
| 2547 | 2700 | $arg_name = substr( $arg_name, 1, -1 ); |
| 2548 | 2701 | } |
| 2549 | - // Remove double quotes from name | |
| 2702 | + // Remove quotes from name | |
| 2550 | 2703 | if ( substr( $arg_name, 0, 1 ) === '"' && substr( $arg_name, -1 ) === '"' ) { |
| 2551 | 2704 | $arg_name = substr( $arg_name, 1, -1 ); |
| 2552 | 2705 | } |
| 2706 | + $arg_value = null; | |
| 2553 | 2707 | // Handle GET args |
| 2554 | - // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared | |
| 2555 | - if ( $method === self::METHODS[0] ) { | |
| 2708 | + if ( $method === self::METHODS[0] && isset( $search_custom['get'][$arg_name] ) ) { | |
| 2709 | + $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) ); | |
| 2710 | + } elseif ( $method === self::METHODS[1] && isset( $search_custom['post'][$arg_name] ) ) { | |
| 2711 | + $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) ); | |
| 2712 | + } elseif ( $method === self::METHODS[2] ) { | |
| 2556 | 2713 | if ( isset( $search_custom['get'][$arg_name] ) ) { |
| 2557 | 2714 | $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) ); |
| 2558 | - $where = $wpdb->prepare( substr_replace( | |
| 2559 | - $where, | |
| 2560 | - '%s', | |
| 2561 | - $pos_start, | |
| 2562 | - $pos_end - $pos_start + 1 | |
| 2563 | - ), $arg_value ); | |
| 2564 | - } else { | |
| 2565 | - $where = str_replace( $filter, 'null', $where ); | |
| 2715 | + } elseif ( isset( $search_custom['post'][$arg_name] ) ) { | |
| 2716 | + $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) ); | |
| 2566 | 2717 | } |
| 2567 | 2718 | } |
| 2568 | 2719 | // Handle POST args |
| 2569 | - if ( $method === self::METHODS[1] ) { | |
| 2570 | - if ( isset( $search_custom['post'][$arg_name] ) ) { | |
| 2571 | - $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) ); | |
| 2572 | - $where = $wpdb->prepare( substr_replace( | |
| 2573 | - $where, | |
| 2574 | - '%s', | |
| 2575 | - $pos_start, | |
| 2576 | - $pos_end - $pos_start + 1 | |
| 2577 | - ), $arg_value ); | |
| 2578 | - } else { | |
| 2579 | - $where = str_replace( $filter, 'null', $where ); | |
| 2580 | - } | |
| 2581 | - } | |
| 2720 | + $placeholder = '###URL_PLACEHOLDER_' . $nonce . '_' . md5( $filter ) . '###'; | |
| 2721 | + $where = str_replace( $filter, $placeholder, $where ); | |
| 2582 | 2722 | // Handle REQUEST args |
| 2583 | - if ( $method === self::METHODS[2] ) { | |
| 2584 | - if ( isset( $search_custom['get'][$arg_name] ) ) { | |
| 2585 | - $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) ); | |
| 2586 | - $where = $wpdb->prepare( substr_replace( | |
| 2587 | - $where, | |
| 2588 | - '%s', | |
| 2589 | - $pos_start, | |
| 2590 | - $pos_end - $pos_start + 1 | |
| 2591 | - ), $arg_value ); | |
| 2592 | - } elseif ( isset( $search_custom['post'][$arg_name] ) ) { | |
| 2593 | - $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) ); | |
| 2594 | - $where = $wpdb->prepare( substr_replace( | |
| 2595 | - $where, | |
| 2596 | - '%s', | |
| 2597 | - $pos_start, | |
| 2598 | - $pos_end - $pos_start + 1 | |
| 2599 | - ), $arg_value ); | |
| 2600 | - } else { | |
| 2601 | - $where = str_replace( $filter, 'null', $where ); | |
| 2602 | - } | |
| 2723 | + if ( $arg_value !== null ) { | |
| 2724 | + $replacements[$placeholder] = $wpdb->prepare( '%s', $arg_value ); | |
| 2725 | + } else { | |
| 2726 | + $replacements[$placeholder] = 'null'; | |
| 2603 | 2727 | } |
| 2604 | - // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared | |
| 2605 | 2728 | } |
| 2606 | 2729 | $offset = $pos_start + 1; |
| 2607 | 2730 | if ( $offset > strlen( $where ) ) { |
| 2608 | 2731 | $offset = strlen( $where ) - 1; |
| @@ -2613,19 +2736,17 @@ | ||
| 2613 | 2736 | if ( is_array( $search_params ) && 1 === count( $search_params ) ) { |
| 2614 | 2737 | $filter_field_name = $this->sanitize_db_identifier( array_keys( $search_params )[0] ); |
| 2615 | 2738 | $filter_field_value = sanitize_text_field( $search_params[$filter_field_name] ); |
| 2616 | 2739 | $filter_field_name_array = array_map( 'trim', explode( ',', $filter_field_name ) ); |
| 2617 | - // phpcs:ignore -- 8.1 proof | |
| 2618 | 2740 | $filter_field_value_array = array_map( 'trim', explode( ',', $filter_field_value ) ); |
| 2619 | - // phpcs:ignore -- 8.1 proof | |
| 2620 | 2741 | if ( count( $filter_field_name_array ) === count( $filter_field_value_array ) ) { |
| 2621 | - // phpcs:ignore -- 8.1 proof | |
| 2622 | 2742 | // Add filter to where clause. |
| 2623 | - // phpcs:disable Generic.CodeAnalysis.ForLoopWithTestFunctionCall, Squiz.PHP.DisallowSizeFunctionsInLoops, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder | |
| 2624 | 2743 | for ($i = 0; $i < count( $filter_field_name_array ); $i++) { |
| 2625 | - $where .= (( '' === $where ? '' : ' and ' )) . $wpdb->prepare( ' `%1s` like %s ', array($filter_field_name_array[$i], $filter_field_value_array[$i]) ); | |
| 2744 | + $where .= ( '' === $where ? '' : ' and ' ); | |
| 2745 | + $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $filter_field_name_array[$i] ) . '###'; | |
| 2746 | + $where .= ' `' . $filter_field_name_array[$i] . '` like ' . $placeholder; | |
| 2747 | + $replacements[$placeholder] = $wpdb->prepare( '%s', $filter_field_value_array[$i] ); | |
| 2626 | 2748 | } |
| 2627 | - // phpcs:enable Generic.CodeAnalysis.ForLoopWithTestFunctionCall, Squiz.PHP.DisallowSizeFunctionsInLoops, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder | |
| 2628 | 2749 | } |
| 2629 | 2750 | } |
| 2630 | 2751 | // Substitute all shortcode parameters |
| 2631 | 2752 | if ( is_array( $shortcode_params ) ) { |
| @@ -2631,15 +2752,11 @@ | ||
| 2631 | 2752 | if ( is_array( $shortcode_params ) ) { |
| 2632 | 2753 | foreach ( $shortcode_params as $column_name => $column_value ) { |
| 2633 | 2754 | $occurences = substr_count( strtolower( $where ), strtolower( "shortcodeParam['{$column_name}']" ) ); |
| 2634 | 2755 | if ( 0 < $occurences ) { |
| 2635 | - $column_values = array(); | |
| 2636 | - for ($i = 0; $i < $occurences; $i++) { | |
| 2637 | - $column_values[] = sanitize_text_field( $column_value ); | |
| 2638 | - } | |
| 2639 | - // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| 2640 | - $where = $wpdb->prepare( str_ireplace( "shortcodeParam['{$column_name}']", '%s', $where ), $column_values ); | |
| 2641 | - // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| 2756 | + $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $column_name ) . '###'; | |
| 2757 | + $where = str_ireplace( "shortcodeParam['{$column_name}']", $placeholder, $where ); | |
| 2758 | + $replacements[$placeholder] = $wpdb->prepare( '%s', sanitize_text_field( $column_value ) ); | |
| 2642 | 2759 | } |
| 2643 | 2760 | } |
| 2644 | 2761 | } |
| 2645 | 2762 | // Substitute all unused shortcode parameter calls with null |
| @@ -2657,13 +2774,15 @@ | ||
| 2657 | 2774 | } |
| 2658 | 2775 | // Substitute all dynamic parameters |
| 2659 | 2776 | if ( is_array( $dynamic_params ) && 0 < count( $dynamic_params ) ) { |
| 2660 | 2777 | foreach ( $dynamic_params as $column_name => $column_value ) { |
| 2661 | - // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| 2662 | - $where = $wpdb->prepare( str_ireplace( "{:{$column_name}}", '%s', $where ), $column_value ); | |
| 2663 | - // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared | |
| 2778 | + if ( stripos( $where, "{:{$column_name}}" ) !== false ) { | |
| 2779 | + $placeholder = '###DYNAMIC_PARAM_' . $nonce . '_' . md5( $column_name ) . '###'; | |
| 2780 | + $where = str_ireplace( "{:{$column_name}}", $placeholder, $where ); | |
| 2781 | + $replacements[$placeholder] = $wpdb->prepare( '%s', $column_value ); | |
| 2782 | + } | |
| 2664 | 2783 | } |
| 2665 | 2784 | } |
| 2666 | - return $where; | |
| 2785 | + return strtr( $where, $replacements ); | |
| 2667 | 2786 | } |
| 2668 | 2787 | |
| 2669 | 2788 | } |
