| @@ -435,10 +435,21 @@ | ||
| 435 | 435 | } |
| 436 | 436 | } |
| 437 | 437 | $dynamic_where = array(); |
| 438 | 438 | if ( is_array( $column_dynamic_values ) && 0 < count( $column_dynamic_values ) ) { |
| 439 | + $dynamic_allowed = array(); | |
| 440 | + $dynamic_table = WPDA_List_Columns_Cache::get_list_columns( $dbs, $tbl ); | |
| 441 | + $dynamic_columns = $dynamic_table->get_table_columns(); | |
| 442 | + foreach ( $dynamic_columns as $column ) { | |
| 443 | + if ( isset( $column['column_name'] ) ) { | |
| 444 | + $dynamic_allowed[] = $column['column_name']; | |
| 445 | + } | |
| 446 | + } | |
| 439 | 447 | foreach ( $column_dynamic_values as $key => $value ) { |
| 440 | - $dynamic_where[] = $wpdadb->prepare( " `{$key}` = %s ", $value ); | |
| 448 | + if ( !in_array( $key, $dynamic_allowed, true ) ) { | |
| 449 | + continue; | |
| 450 | + } | |
| 451 | + $dynamic_where[] = $wpdadb->prepare( " %i = %s ", array($key, $value) ); | |
| 441 | 452 | } |
| 442 | 453 | $where .= (( '' === $where ? ' where ' : ' and ' )) . ' (' . implode( ' and ', $dynamic_where ) . ') '; |
| 443 | 454 | } |
| 444 | 455 | $column_count = ( '' === $subquery ? '' : ", stats.total_rows as 'count'" ); |
| @@ -540,9 +551,9 @@ | ||
| 540 | 551 | // Prepare selected column list |
| 541 | 552 | $columns_selected = array(); |
| 542 | 553 | $search_data_types = array(); |
| 543 | 554 | foreach ( $table_columns as $table_column ) { |
| 544 | - if ( isset( $table_column['column_name'], $table_column['data_type'] ) ) { | |
| 555 | + if ( isset( $table_column['column_name'], $table_column['data_type'] ) && (in_array( $table_column['column_name'], $column_names ) || empty( $column_names )) ) { | |
| 545 | 556 | $columns_selected[$table_column['column_name']] = true; |
| 546 | 557 | $search_data_types[$table_column['column_name']] = $table_column['data_type']; |
| 547 | 558 | } |
| 548 | 559 | } |
| @@ -1343,9 +1354,9 @@ | ||
| 1343 | 1354 | if ( isset( $table[$action]['authorized_users'] ) && is_array( $table[$action]['authorized_users'] ) && 0 < count( $table[$action]['authorized_users'] ) && in_array( (string) $this->get_user_login(), $table[$action]['authorized_users'] ) ) { |
| 1344 | 1355 | return $table[$action]['methods']; |
| 1345 | 1356 | } |
| 1346 | 1357 | // Check authorized roles |
| 1347 | - if ( isset( $table[$action]['authorized_roles'] ) && is_array( $table[$action]['authorized_roles'] ) && 0 < count( $table[$action]['authorized_roles'] ) && 0 < count( array_intersect( $this->get_user_roles(), $table[$action]['authorized_roles'] ) ) ) { | |
| 1358 | + if ( isset( $table[$action]['authorized_roles'] ) && is_array( $table[$action]['authorized_roles'] ) && 0 < count( $table[$action]['authorized_roles'] ) && 0 < count( array_intersect( ( is_array( $this->get_user_roles() ) ? $this->get_user_roles() : array() ), $table[$action]['authorized_roles'] ) ) ) { | |
| 1348 | 1359 | return $table[$action]['methods']; |
| 1349 | 1360 | } |
| 1350 | 1361 | } |
| 1351 | 1362 | } |
