| @@ -4,11 +4,13 @@ | ||
| 4 | 4 | * Suppress "error - 0 - No summary was found for this file" on phpdoc generation |
| 5 | 5 | * |
| 6 | 6 | * @package WPDataAccess\Data_Tables |
| 7 | 7 | */ |
| 8 | +// phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- verified on page | |
| 8 | 9 | namespace WPDataAccess\Data_Tables; |
| 9 | 10 | |
| 10 | 11 | use stdClass; |
| 12 | +use WPDataAccess\API\WPDA_Apps; | |
| 11 | 13 | use WPDataAccess\Connection\WPDADB; |
| 12 | 14 | use WPDataAccess\Data_Dictionary\WPDA_Dictionary_Exist; |
| 13 | 15 | use WPDataAccess\Data_Dictionary\WPDA_List_Columns_Cache; |
| 14 | 16 | use WPDataAccess\Macro\WPDA_Macro; |
| @@ -17,12 +19,9 @@ | ||
| 17 | 19 | use WPDataAccess\Plugin_Table_Models\WPDA_Table_Settings_Model; |
| 18 | 20 | use WPDataAccess\List_Table\WPDA_List_Table; |
| 19 | 21 | use WPDataAccess\Premium\WPDAPRO_Data_Publisher\WPDAPRO_Data_Publisher_Manage_Styles; |
| 20 | 22 | use WPDataAccess\Premium\WPDAPRO_Geo_Location\WPDAPRO_Geo_Location_WS; |
| 21 | -use WPDataAccess\Settings\WPDA_Settings_DataTables; | |
| 22 | -use WPDataAccess\Templates\WPDAPRO_Template_Data_Publisher_Color; | |
| 23 | -use WPDataAccess\Templates\WPDAPRO_Template_Data_Publisher_Space; | |
| 24 | -use WPDataAccess\Templates\WPDA_Template_Data_Publisher_Corner; | |
| 23 | +use WPDataAccess\Settings\WPDA_Settings_Legacy_DataTables; | |
| 25 | 24 | use WPDataAccess\WPDA; |
| 26 | 25 | /** |
| 27 | 26 | * Class WPDA_Data_Tables |
| 28 | 27 | * |
| @@ -29,10 +28,8 @@ | ||
| 29 | 28 | * @author Peter Schulz |
| 30 | 29 | * @since 1.0.0 |
| 31 | 30 | */ |
| 32 | 31 | class WPDA_Data_Tables { |
| 33 | - const METHODS = array('httpGet', 'httpPost', 'httpRequest'); | |
| 34 | - | |
| 35 | 32 | protected static $pub_ids = array(); |
| 36 | 33 | |
| 37 | 34 | protected $pub_id_seq = ''; |
| 38 | 35 | |
| @@ -281,9 +278,8 @@ | ||
| 281 | 278 | $hyperlink_label = ( isset( $hyperlink->hyperlink_label ) ? $hyperlink->hyperlink_label : '' ); |
| 282 | 279 | $hyperlink_html = ( isset( $hyperlink->hyperlink_html ) ? $hyperlink->hyperlink_html : '' ); |
| 283 | 280 | if ( $hyperlink_label !== '' && $hyperlink_html !== '' ) { |
| 284 | 281 | array_push( $hyperlinks, $hyperlink_label ); |
| 285 | - //phpcs:ignore - 8.1 proof | |
| 286 | 282 | } |
| 287 | 283 | } |
| 288 | 284 | } |
| 289 | 285 | // Check for geolocation support |
| @@ -390,8 +386,9 @@ | ||
| 390 | 386 | return $use_buttons_extension; |
| 391 | 387 | } |
| 392 | 388 | |
| 393 | 389 | protected function get_geolocation_settings() { |
| 390 | + return null; | |
| 394 | 391 | } |
| 395 | 392 | |
| 396 | 393 | protected function get_columns( $column_names ) { |
| 397 | 394 | if ( '*' === $column_names ) { |
| @@ -401,9 +398,8 @@ | ||
| 401 | 398 | $columns[] = $column['column_name']; |
| 402 | 399 | } |
| 403 | 400 | return $columns; |
| 404 | 401 | } else { |
| 405 | - //phpcs:ignore - 8.1 proof | |
| 406 | 402 | $columns = explode( ',', (string) $column_names ); |
| 407 | 403 | // Create column ARRAY |
| 408 | 404 | // Check if columns exist to prevent sql injection |
| 409 | 405 | $i = 0; |
| @@ -452,9 +448,8 @@ | ||
| 452 | 448 | $wpda_database_columns_obj->label = $column_label; |
| 453 | 449 | $wpda_database_columns_obj->searchBuilderType = WPDA::get_sb_type( $this->wpda_list_columns->get_column_data_type( $this->columns[$i] ) ); |
| 454 | 450 | $wpda_database_columns .= json_encode( $wpda_database_columns_obj ); |
| 455 | 451 | if ( $i < count( $this->columns ) - 1 ) { |
| 456 | - //phpcs:ignore - 8.1 proof | |
| 457 | 452 | $wpda_database_columns .= ','; |
| 458 | 453 | } |
| 459 | 454 | } |
| 460 | 455 | return $wpda_database_columns; |
| @@ -461,14 +456,14 @@ | ||
| 461 | 456 | } |
| 462 | 457 | |
| 463 | 458 | protected function get_language() { |
| 464 | 459 | // Check data table specific language |
| 465 | - if ( isset( $this->json->wpda_language, WPDA_Settings_DataTables::FRONTEND_LANG[$this->json->wpda_language] ) ) { | |
| 466 | - return WPDA_Settings_DataTables::FRONTEND_LANG[$this->json->wpda_language]; | |
| 460 | + if ( isset( $this->json->wpda_language, WPDA_Settings_Legacy_DataTables::FRONTEND_LANG[$this->json->wpda_language] ) ) { | |
| 461 | + return WPDA_Settings_Legacy_DataTables::FRONTEND_LANG[$this->json->wpda_language]; | |
| 467 | 462 | } |
| 468 | 463 | // Get data table global language |
| 469 | 464 | $language = WPDA::get_option( WPDA::OPTION_DP_LANGUAGE ); |
| 470 | - $language_code = ( isset( WPDA_Settings_DataTables::FRONTEND_LANG[$language] ) ? WPDA_Settings_DataTables::FRONTEND_LANG[$language] : 'en-GB' ); | |
| 465 | + $language_code = ( isset( WPDA_Settings_Legacy_DataTables::FRONTEND_LANG[$language] ) ? WPDA_Settings_Legacy_DataTables::FRONTEND_LANG[$language] : 'en-GB' ); | |
| 471 | 466 | return $language_code; |
| 472 | 467 | } |
| 473 | 468 | |
| 474 | 469 | protected function add_buttons( $use_buttons_extension, $pub_id, $table_name ) { |
| @@ -478,8 +473,9 @@ | ||
| 478 | 473 | return ( isset( $this->json->wpda_button_caption ) && null !== $this->json->wpda_button_caption ? $this->json->wpda_button_caption : 'label' ); |
| 479 | 474 | } |
| 480 | 475 | |
| 481 | 476 | protected function add_export_button( $button_type, $icon, $hint ) { |
| 477 | + return null; | |
| 482 | 478 | } |
| 483 | 479 | |
| 484 | 480 | protected function add_geolocation( |
| 485 | 481 | $geolocation, |
| @@ -549,9 +545,9 @@ | ||
| 549 | 545 | * @param array $hyperlinks Hyperlinks defined in column settings. |
| 550 | 546 | * @param string $header2 Adds an extra header row if TRUE. |
| 551 | 547 | * @param mixed $geolocation |
| 552 | 548 | * |
| 553 | - * @return HTML output | |
| 549 | + * @return string output | |
| 554 | 550 | */ |
| 555 | 551 | protected function show_header( |
| 556 | 552 | $responsive, |
| 557 | 553 | $responsive_cols, |
| @@ -633,26 +629,28 @@ | ||
| 633 | 629 | } |
| 634 | 630 | $this->serverSide = true; |
| 635 | 631 | // Set pagination values. |
| 636 | 632 | $offset = 0; |
| 637 | - if ( isset( $_REQUEST['start'] ) ) { | |
| 638 | - $offset = sanitize_text_field( wp_unslash( $_REQUEST['start'] ) ); | |
| 633 | + // phpcs:disable WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 634 | + if ( isset( $_REQUEST['start'] ) && ctype_digit( $_REQUEST['start'] ) ) { | |
| 635 | + $offset = (int) $_REQUEST['start']; | |
| 639 | 636 | // input var okay. |
| 640 | 637 | } |
| 641 | 638 | $limit = -1; |
| 642 | 639 | // jQuery DataTables default. |
| 643 | - if ( isset( $_REQUEST['length'] ) ) { | |
| 644 | - $limit = sanitize_text_field( wp_unslash( $_REQUEST['length'] ) ); | |
| 640 | + if ( isset( $_REQUEST['length'] ) && ctype_digit( $_REQUEST['length'] ) ) { | |
| 641 | + $limit = (int) $_REQUEST['length']; | |
| 645 | 642 | // input var okay. |
| 646 | 643 | } |
| 647 | 644 | $publication_mode = 'normal'; |
| 648 | - if ( -1 == $limit && isset( $_REQUEST['more_start'] ) && isset( $_REQUEST['more_limit'] ) ) { | |
| 645 | + if ( -1 == $limit && isset( $_REQUEST['more_start'] ) && ctype_digit( $_REQUEST['more_start'] ) && isset( $_REQUEST['more_limit'] ) && ctype_digit( $_REQUEST['more_limit'] ) ) { | |
| 649 | 646 | $publication_mode = 'more'; |
| 650 | - $offset = sanitize_text_field( wp_unslash( $_REQUEST['more_start'] ) ); | |
| 647 | + $offset = (int) $_REQUEST['more_start']; | |
| 651 | 648 | // input var okay. |
| 652 | - $limit = sanitize_text_field( wp_unslash( $_REQUEST['more_limit'] ) ); | |
| 649 | + $limit = (int) $_REQUEST['more_limit']; | |
| 653 | 650 | // input var okay. |
| 654 | 651 | } |
| 652 | + // phpcs:enable WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 655 | 653 | if ( '' !== $pub_id && '0' != $pub_id ) { |
| 656 | 654 | // Get data |
| 657 | 655 | $publication = WPDA_Publisher_Model::get_publication( $pub_id ); |
| 658 | 656 | if ( false === $publication ) { |
| @@ -729,30 +727,56 @@ | ||
| 729 | 727 | wp_die(); |
| 730 | 728 | // Remote database not available |
| 731 | 729 | } |
| 732 | 730 | // Add field filters from shortcode |
| 733 | - $filter_field_name = str_replace( '`', '', sanitize_text_field( wp_unslash( $_REQUEST['filter_field_name'] ) ) ); | |
| 734 | - // input var okay. | |
| 735 | - $filter_field_value = sanitize_text_field( wp_unslash( $_REQUEST['filter_field_value'] ) ); | |
| 736 | - // input var okay. | |
| 731 | + $filter_field_name = ''; | |
| 732 | + $filter_field_value = ''; | |
| 733 | + if ( isset( $_REQUEST['filter_field_name'], $_REQUEST['filter_field_value'] ) ) { | |
| 734 | + // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 735 | + $filter_field_name_raw = wp_unslash( $_REQUEST['filter_field_name'] ); | |
| 736 | + $filter_field_value_raw = wp_unslash( $_REQUEST['filter_field_value'] ); | |
| 737 | + // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 738 | + if ( is_string( $filter_field_name_raw ) && is_string( $filter_field_value_raw ) ) { | |
| 739 | + $filter_field_name = sanitize_text_field( $filter_field_name_raw ); | |
| 740 | + $filter_field_value = sanitize_text_field( $filter_field_value_raw ); | |
| 741 | + } | |
| 742 | + } | |
| 737 | 743 | if ( '' !== $filter_field_name && '' !== $filter_field_value ) { |
| 744 | + if ( '*' === $columns ) { | |
| 745 | + $allowed_columns = array(); | |
| 746 | + $tbl = WPDA_List_Columns_Cache::get_list_columns( $database, $table_name ); | |
| 747 | + $cols = $tbl->get_table_columns(); | |
| 748 | + foreach ( $cols as $col ) { | |
| 749 | + if ( isset( $col['column_name'] ) ) { | |
| 750 | + $allowed_columns[] = $col['column_name']; | |
| 751 | + } | |
| 752 | + } | |
| 753 | + } else { | |
| 754 | + $allowed_columns = explode( ',', $columns ); | |
| 755 | + } | |
| 738 | 756 | $filter_field_name_array = array_map( 'trim', explode( ',', $filter_field_name ) ); |
| 739 | - //phpcs:ignore - 8.1 proof | |
| 740 | 757 | $filter_field_value_array = array_map( 'trim', explode( ',', $filter_field_value ) ); |
| 741 | - //phpcs:ignore - 8.1 proof | |
| 742 | 758 | if ( count( $filter_field_name_array ) === count( $filter_field_value_array ) ) { |
| 743 | - //phpcs:ignore - 8.1 proof | |
| 744 | - // Add filter to where clause | |
| 759 | + $prepare_fields = array(); | |
| 760 | + $prepare_values = array(); | |
| 745 | 761 | for ($i = 0; $i < count( $filter_field_name_array ); $i++) { |
| 746 | - //phpcs:ignore - 8.1 proof | |
| 762 | + $field_name = $filter_field_name_array[$i]; | |
| 763 | + $field_value = $filter_field_value_array[$i]; | |
| 764 | + if ( !in_array( $field_name, $allowed_columns, true ) ) { | |
| 765 | + continue; | |
| 766 | + } | |
| 767 | + $prepare_fields[] = $field_name; | |
| 768 | + $prepare_values[] = $field_value; | |
| 769 | + } | |
| 770 | + for ($i = 0; $i < count( $prepare_fields ); $i++) { | |
| 747 | 771 | if ( '' === $where ) { |
| 748 | - $where = $wpdadb->prepare( " where `{$filter_field_name_array[$i]}` like %s ", array($filter_field_value_array[$i]) ); | |
| 772 | + $where = $wpdadb->prepare( ' WHERE %i LIKE %s ', array($prepare_fields[$i], $prepare_values[$i]) ); | |
| 749 | 773 | } else { |
| 750 | - $where .= $wpdadb->prepare( " and `{$filter_field_name_array[$i]}` like %s ", array($filter_field_value_array[$i]) ); | |
| 774 | + $where .= $wpdadb->prepare( ' AND %i LIKE %s ', array($prepare_fields[$i], $prepare_values[$i]) ); | |
| 751 | 775 | } |
| 752 | - $_filter['filter_field_name'] = $filter_field_name; | |
| 753 | - $_filter['filter_field_value'] = $filter_field_value; | |
| 754 | 776 | } |
| 777 | + $_filter['filter_field_name'] = $filter_field_name; | |
| 778 | + $_filter['filter_field_value'] = $filter_field_value; | |
| 755 | 779 | } |
| 756 | 780 | } |
| 757 | 781 | // Get all column names from table (must be comma separated string) |
| 758 | 782 | $this->wpda_list_columns = WPDA_List_Columns_Cache::get_list_columns( $database, $table_name ); |
| @@ -779,9 +803,8 @@ | ||
| 779 | 803 | } else { |
| 780 | 804 | // Check if columns exist (prevent sql injection). |
| 781 | 805 | $wpda_dictionary_checks = new WPDA_Dictionary_Exist($database, $table_name); |
| 782 | 806 | $column_array = explode( ',', (string) $columns ); |
| 783 | - //phpcs:ignore - 8.1 proof | |
| 784 | 807 | $has_dynamic_hyperlinks = false; |
| 785 | 808 | foreach ( $column_array as $column ) { |
| 786 | 809 | if ( 'wpda_hyperlink_' !== substr( $column, 0, 15 ) ) { |
| 787 | 810 | if ( !$wpda_dictionary_checks->column_exists( $column ) ) { |
| @@ -808,9 +831,8 @@ | ||
| 808 | 831 | } |
| 809 | 832 | } |
| 810 | 833 | foreach ( $hyperlink_substitution_columns as $hyperlink_substitution_column => $val ) { |
| 811 | 834 | if ( !in_array( $hyperlink_substitution_column, $column_array ) ) { |
| 812 | - //phpcs:ignore - 8.1 proof | |
| 813 | 835 | $columns .= ",{$hyperlink_substitution_column}"; |
| 814 | 836 | } |
| 815 | 837 | } |
| 816 | 838 | } |
| @@ -823,10 +845,10 @@ | ||
| 823 | 845 | // input var okay. |
| 824 | 846 | $orderby_columns = array(); |
| 825 | 847 | $orderby_args = array(); |
| 826 | 848 | // Sanitize argument array and write result to temporary sanitizes array for processing: |
| 849 | + // phpcs:disable WordPress.Security.ValidatedSanitizedInput | |
| 827 | 850 | foreach ( $_REQUEST['order'] as $order_column ) { |
| 828 | - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput | |
| 829 | 851 | if ( isset( $order_column['column'] ) ) { |
| 830 | 852 | $orderby_args[] = array( |
| 831 | 853 | 'column' => sanitize_sql_orderby( wp_unslash( $order_column['column'] ) ), |
| 832 | 854 | 'dir' => ( isset( $order_column['dir'] ) && 'desc' === $order_column['dir'] ? 'desc' : 'asc' ), |
| @@ -832,8 +854,9 @@ | ||
| 832 | 854 | 'dir' => ( isset( $order_column['dir'] ) && 'desc' === $order_column['dir'] ? 'desc' : 'asc' ), |
| 833 | 855 | ); |
| 834 | 856 | } |
| 835 | 857 | } |
| 858 | + // phpcs:enable WordPress.Security.ValidatedSanitizedInput | |
| 836 | 859 | foreach ( $orderby_args as $order_column ) { |
| 837 | 860 | // input var okay. |
| 838 | 861 | $column_index = $order_column['column']; |
| 839 | 862 | $column_name = str_replace( '`', '', $column_array[$column_index] ); |
| @@ -875,9 +898,8 @@ | ||
| 875 | 898 | } |
| 876 | 899 | $geo_radius_col = ''; |
| 877 | 900 | // Execute query. |
| 878 | 901 | $column_array = explode( ',', (string) $columns ); |
| 879 | - //phpcs:ignore - 8.1 proof | |
| 880 | 902 | $column_array_orig = $column_array; |
| 881 | 903 | $images_array = array(); |
| 882 | 904 | $imagesurl_array = array(); |
| 883 | 905 | $attachments_array = array(); |
| @@ -902,9 +924,8 @@ | ||
| 902 | 924 | $i = 0; |
| 903 | 925 | foreach ( $column_array as $col ) { |
| 904 | 926 | if ( isset( $column_images[$col] ) ) { |
| 905 | 927 | array_push( $images_array, $i ); |
| 906 | - //phpcs:ignore - 8.1 proof | |
| 907 | 928 | } |
| 908 | 929 | $i++; |
| 909 | 930 | } |
| 910 | 931 | $i = 0; |
| @@ -910,9 +931,8 @@ | ||
| 910 | 931 | $i = 0; |
| 911 | 932 | foreach ( $column_array as $col ) { |
| 912 | 933 | if ( isset( $column_attachments[$col] ) ) { |
| 913 | 934 | array_push( $attachments_array, $i ); |
| 914 | - //phpcs:ignore - 8.1 proof | |
| 915 | 935 | } |
| 916 | 936 | $i++; |
| 917 | 937 | } |
| 918 | 938 | } else { |
| @@ -923,31 +943,24 @@ | ||
| 923 | 943 | foreach ( $column_array as $col ) { |
| 924 | 944 | if ( 'Image' === WPDA_Media_Model::get_column_media( $table_name, $col, $database ) ) { |
| 925 | 945 | if ( !isset( $images_array[$i] ) ) { |
| 926 | 946 | array_push( $images_array, $i ); |
| 927 | - //phpcs:ignore - 8.1 proof | |
| 928 | 947 | } |
| 929 | 948 | } elseif ( 'ImageURL' === WPDA_Media_Model::get_column_media( $table_name, $col, $database ) ) { |
| 930 | 949 | array_push( $imagesurl_array, $i ); |
| 931 | - //phpcs:ignore - 8.1 proof | |
| 932 | 950 | } elseif ( 'Attachment' === WPDA_Media_Model::get_column_media( $table_name, $col, $database ) ) { |
| 933 | 951 | if ( !isset( $attachments_array[$i] ) ) { |
| 934 | 952 | array_push( $attachments_array, $i ); |
| 935 | - //phpcs:ignore - 8.1 proof | |
| 936 | 953 | } |
| 937 | 954 | } elseif ( 'Hyperlink' === WPDA_Media_Model::get_column_media( $table_name, $col, $database ) ) { |
| 938 | 955 | if ( !isset( $hyperlinks_array[$i] ) ) { |
| 939 | 956 | array_push( $hyperlinks_array, $i ); |
| 940 | - //phpcs:ignore - 8.1 proof | |
| 941 | 957 | array_push( $hyperlinks_array_col, $col ); |
| 942 | - //phpcs:ignore - 8.1 proof | |
| 943 | 958 | } |
| 944 | 959 | } elseif ( 'Audio' === WPDA_Media_Model::get_column_media( $table_name, $col, $database ) ) { |
| 945 | 960 | array_push( $audio_array, $i ); |
| 946 | - //phpcs:ignore - 8.1 proof | |
| 947 | 961 | } elseif ( 'Video' === WPDA_Media_Model::get_column_media( $table_name, $col, $database ) ) { |
| 948 | 962 | array_push( $video_array, $i ); |
| 949 | - //phpcs:ignore - 8.1 proof | |
| 950 | 963 | } |
| 951 | 964 | $i++; |
| 952 | 965 | } |
| 953 | 966 | // Change dynamic hyperlinks |
| @@ -969,13 +982,12 @@ | ||
| 969 | 982 | if ( '' !== $orderby ) { |
| 970 | 983 | $query .= " order by {$orderby} "; |
| 971 | 984 | } |
| 972 | 985 | if ( -1 != $limit ) { |
| 973 | - $query .= " limit {$limit} offset {$offset}"; | |
| 986 | + $query .= $wpdadb->prepare( " limit %d offset %d", [$limit, $offset] ); | |
| 974 | 987 | } |
| 975 | 988 | $hyperlinks = array(); |
| 976 | 989 | if ( count( $hyperlinks_column_index ) ) { |
| 977 | - //phpcs:ignore - 8.1 proof | |
| 978 | 990 | if ( isset( $table_settings->hyperlinks ) ) { |
| 979 | 991 | foreach ( $table_settings->hyperlinks as $hyperlink ) { |
| 980 | 992 | $hyperlink_label = ( isset( $hyperlink->hyperlink_label ) ? $hyperlink->hyperlink_label : '' ); |
| 981 | 993 | $hyperlink_target = ( isset( $hyperlink->hyperlink_target ) ? $hyperlink->hyperlink_target : false ); |
| @@ -980,9 +992,8 @@ | ||
| 980 | 992 | $hyperlink_label = ( isset( $hyperlink->hyperlink_label ) ? $hyperlink->hyperlink_label : '' ); |
| 981 | 993 | $hyperlink_target = ( isset( $hyperlink->hyperlink_target ) ? $hyperlink->hyperlink_target : false ); |
| 982 | 994 | $hyperlink_html = ( isset( $hyperlink->hyperlink_html ) ? $hyperlink->hyperlink_html : '' ); |
| 983 | 995 | if ( $hyperlink_label !== '' && $hyperlink_html !== '' ) { |
| 984 | - //phpcs:ignore - 8.1 proof | |
| 985 | 996 | array_push( $hyperlinks, array( |
| 986 | 997 | 'hyperlink_label' => $hyperlink_label, |
| 987 | 998 | 'hyperlink_target' => $hyperlink_target, |
| 988 | 999 | 'hyperlink_html' => $hyperlink_html, |
| @@ -1003,11 +1014,11 @@ | ||
| 1003 | 1014 | } |
| 1004 | 1015 | } |
| 1005 | 1016 | $wpdadb->suppress_errors( true ); |
| 1006 | 1017 | $rows = $wpdadb->get_results( $query, 'ARRAY_N' ); |
| 1007 | - // phpcs:ignore Standard.Category.SniffName.ErrorCode | |
| 1008 | 1018 | if ( '' !== $wpdadb->last_error ) { |
| 1009 | - $this->create_empty_response( $wpdadb->last_error, $query ); | |
| 1019 | + $this->create_empty_response( __( 'ERROR: Invalid query', 'wp-data-access' ) ); | |
| 1020 | + WPDA::wpda_log_wp_error( $wpdadb->last_error ); | |
| 1010 | 1021 | wp_die(); |
| 1011 | 1022 | } |
| 1012 | 1023 | $rows_final = array(); |
| 1013 | 1024 | foreach ( $rows as $row ) { |
| @@ -1014,9 +1025,8 @@ | ||
| 1014 | 1025 | $row_orig = $row; |
| 1015 | 1026 | if ( 'on' === $nl2br && null !== $nl2br ) { |
| 1016 | 1027 | // Replace NL with BR tags |
| 1017 | 1028 | for ($nl = 0; $nl < count( $row ); $nl++) { |
| 1018 | - //phpcs:ignore - 8.1 proof | |
| 1019 | 1029 | $row[$nl] = nl2br( (string) $row[$nl] ); |
| 1020 | 1030 | } |
| 1021 | 1031 | } |
| 1022 | 1032 | foreach ( $hyperlinks_column_index as $key => $value ) { |
| @@ -1048,15 +1058,12 @@ | ||
| 1048 | 1058 | $row[$key] = 'ERROR'; |
| 1049 | 1059 | } |
| 1050 | 1060 | } |
| 1051 | 1061 | for ($i = 0; $i < count( $imagesurl_array ); $i++) { |
| 1052 | - //phpcs:ignore - 8.1 proof | |
| 1053 | 1062 | $row[$imagesurl_array[$i]] = '<img src="' . $row[$imagesurl_array[$i]] . '" width="100%">'; |
| 1054 | 1063 | } |
| 1055 | 1064 | for ($i = 0; $i < count( $images_array ); $i++) { |
| 1056 | - //phpcs:ignore - 8.1 proof | |
| 1057 | 1065 | $image_ids = explode( ',', (string) $row[$images_array[$i]] ); |
| 1058 | - //phpcs:ignore - 8.1 proof | |
| 1059 | 1066 | $image_src = ''; |
| 1060 | 1067 | foreach ( $image_ids as $image_id ) { |
| 1061 | 1068 | $url = wp_get_attachment_url( esc_attr( $image_id ) ); |
| 1062 | 1069 | if ( false !== $url ) { |
| @@ -1066,11 +1073,9 @@ | ||
| 1066 | 1073 | } |
| 1067 | 1074 | $row[$images_array[$i]] = $image_src; |
| 1068 | 1075 | } |
| 1069 | 1076 | for ($i = 0; $i < count( $attachments_array ); $i++) { |
| 1070 | - //phpcs:ignore - 8.1 proof | |
| 1071 | 1077 | $media_ids = explode( ',', (string) $row[$attachments_array[$i]] ); |
| 1072 | - //phpcs:ignore - 8.1 proof | |
| 1073 | 1078 | $media_links = ''; |
| 1074 | 1079 | foreach ( $media_ids as $media_id ) { |
| 1075 | 1080 | $url = wp_get_attachment_url( esc_attr( $media_id ) ); |
| 1076 | 1081 | if ( false !== $url ) { |
| @@ -1085,16 +1090,15 @@ | ||
| 1085 | 1090 | } |
| 1086 | 1091 | if ( isset( $hyperlinks_array ) ) { |
| 1087 | 1092 | $hyperlink_definition = ( isset( $table_settings->table_settings->hyperlink_definition ) && 'text' === $table_settings->table_settings->hyperlink_definition ? 'text' : 'json' ); |
| 1088 | 1093 | for ($i = 0; $i < count( $hyperlinks_array ); $i++) { |
| 1089 | - //phpcs:ignore - 8.1 proof | |
| 1090 | 1094 | if ( 'json' === $hyperlink_definition ) { |
| 1091 | 1095 | $hyperlink = json_decode( (string) $row[$hyperlinks_array[$i]], true ); |
| 1092 | 1096 | if ( is_array( $hyperlink ) && isset( $hyperlink['label'] ) && isset( $hyperlink['url'] ) && isset( $hyperlink['target'] ) ) { |
| 1093 | 1097 | if ( '' === $hyperlink['url'] ) { |
| 1094 | - $row[$hyperlinks_array[$i]] = $hyperlink['label']; | |
| 1098 | + $row[$hyperlinks_array[$i]] = esc_attr( $hyperlink['label'] ); | |
| 1095 | 1099 | } else { |
| 1096 | - $row[$hyperlinks_array[$i]] = "<a href='{$hyperlink['url']}' target='{$hyperlink['target']}'>{$hyperlink['label']}</a>"; | |
| 1100 | + $row[$hyperlinks_array[$i]] = "<a href='" . esc_url_raw( $hyperlink['url'] ) . "' target='" . esc_attr( $hyperlink['target'] ) . "'>" . esc_attr( $hyperlink['label'] ) . "</a>"; | |
| 1097 | 1101 | } |
| 1098 | 1102 | } else { |
| 1099 | 1103 | $row[$hyperlinks_array[$i]] = ''; |
| 1100 | 1104 | } |
| @@ -1099,10 +1103,10 @@ | ||
| 1099 | 1103 | $row[$hyperlinks_array[$i]] = ''; |
| 1100 | 1104 | } |
| 1101 | 1105 | } else { |
| 1102 | 1106 | if ( null !== $row[$hyperlinks_array[$i]] && '' !== $row[$hyperlinks_array[$i]] ) { |
| 1103 | - $hyperlink_label = $this->wpda_list_columns->get_column_label( $hyperlinks_array_col[$i] ); | |
| 1104 | - $row[$hyperlinks_array[$i]] = "<a href='{$row[$hyperlinks_array[$i]]}' target='_blank'>{$hyperlink_label}</a>"; | |
| 1107 | + $hyperlink_label = esc_attr( $this->wpda_list_columns->get_column_label( $hyperlinks_array_col[$i] ) ); | |
| 1108 | + $row[$hyperlinks_array[$i]] = "<a href='" . esc_url_raw( $row[$hyperlinks_array[$i]] ) . "' target='_blank'>" . esc_attr( $hyperlink_label ) . "</a>"; | |
| 1105 | 1109 | } else { |
| 1106 | 1110 | $row[$hyperlinks_array[$i]] = ''; |
| 1107 | 1111 | } |
| 1108 | 1112 | } |
| @@ -1108,11 +1112,9 @@ | ||
| 1108 | 1112 | } |
| 1109 | 1113 | } |
| 1110 | 1114 | } |
| 1111 | 1115 | for ($i = 0; $i < count( $audio_array ); $i++) { |
| 1112 | - //phpcs:ignore - 8.1 proof | |
| 1113 | 1116 | $media_ids = explode( ',', (string) $row[$audio_array[$i]] ); |
| 1114 | - //phpcs:ignore - 8.1 proof | |
| 1115 | 1117 | $media_links = ''; |
| 1116 | 1118 | foreach ( $media_ids as $media_id ) { |
| 1117 | 1119 | if ( 'audio' === substr( get_post_mime_type( $media_id ), 0, 5 ) ) { |
| 1118 | 1120 | $url = wp_get_attachment_url( esc_attr( $media_id ) ); |
| @@ -1118,9 +1120,9 @@ | ||
| 1118 | 1120 | $url = wp_get_attachment_url( esc_attr( $media_id ) ); |
| 1119 | 1121 | if ( false !== $url ) { |
| 1120 | 1122 | $title = get_the_title( esc_attr( $media_id ) ); |
| 1121 | 1123 | if ( false !== $url ) { |
| 1122 | - $media_links .= '<div class="wpda_tooltip" title="' . $title . '">' . do_shortcode( '[audio src="' . $url . '"]' ) . '</div>'; | |
| 1124 | + $media_links .= '<div class="wpda_tooltip" title="' . esc_attr( $title ) . '">' . do_shortcode( '[audio src="' . esc_url_raw( $url ) . '"]' ) . '</div>'; | |
| 1123 | 1125 | } |
| 1124 | 1126 | } |
| 1125 | 1127 | } |
| 1126 | 1128 | } |
| @@ -1126,11 +1128,9 @@ | ||
| 1126 | 1128 | } |
| 1127 | 1129 | $row[$audio_array[$i]] = $media_links; |
| 1128 | 1130 | } |
| 1129 | 1131 | for ($i = 0; $i < count( $video_array ); $i++) { |
| 1130 | - //phpcs:ignore - 8.1 proof | |
| 1131 | 1132 | $media_ids = explode( ',', (string) $row[$video_array[$i]] ); |
| 1132 | - //phpcs:ignore - 8.1 proof | |
| 1133 | 1133 | $media_links = ''; |
| 1134 | 1134 | foreach ( $media_ids as $media_id ) { |
| 1135 | 1135 | if ( 'video' === substr( get_post_mime_type( $media_id ), 0, 5 ) ) { |
| 1136 | 1136 | $url = wp_get_attachment_url( esc_attr( $media_id ) ); |
| @@ -1135,9 +1135,9 @@ | ||
| 1135 | 1135 | if ( 'video' === substr( get_post_mime_type( $media_id ), 0, 5 ) ) { |
| 1136 | 1136 | $url = wp_get_attachment_url( esc_attr( $media_id ) ); |
| 1137 | 1137 | if ( false !== $url ) { |
| 1138 | 1138 | if ( false !== $url ) { |
| 1139 | - $media_links .= do_shortcode( '[video src="' . $url . '"]' ); | |
| 1139 | + $media_links .= do_shortcode( '[video src="' . esc_url_raw( $url ) . '"]' ); | |
| 1140 | 1140 | } |
| 1141 | 1141 | } |
| 1142 | 1142 | } |
| 1143 | 1143 | } |
| @@ -1144,9 +1144,8 @@ | ||
| 1144 | 1144 | $row[$video_array[$i]] = $media_links; |
| 1145 | 1145 | } |
| 1146 | 1146 | // Format date and time columns |
| 1147 | 1147 | for ($i = 0; $i < count( $row ); $i++) { |
| 1148 | - //phpcs:ignore - 8.1 proof | |
| 1149 | 1148 | if ( '' !== $row[$i] && null !== $row[$i] ) { |
| 1150 | 1149 | if ( isset( $column_array_clean[$i] ) ) { |
| 1151 | 1150 | if ( isset( $column_array_ordered[$column_array_clean[$i]] ) ) { |
| 1152 | 1151 | switch ( $column_array_ordered[$column_array_clean[$i]] ) { |
| @@ -1165,13 +1164,11 @@ | ||
| 1165 | 1164 | } |
| 1166 | 1165 | } |
| 1167 | 1166 | // Remove script tags if available |
| 1168 | 1167 | for ($i = 0; $i < count( $row ); $i++) { |
| 1169 | - //phpcs:ignore - 8.1 proof | |
| 1170 | 1168 | $row[$i] = str_replace( array('<script>', '</script>'), array('<script>', '</script>'), (string) $row[$i] ); |
| 1171 | 1169 | } |
| 1172 | 1170 | array_push( $rows_final, $row ); |
| 1173 | - //phpcs:ignore - 8.1 proof | |
| 1174 | 1171 | } |
| 1175 | 1172 | if ( $this->serverSide ) { |
| 1176 | 1173 | if ( isset( $_REQUEST['records_total'] ) && is_numeric( $_REQUEST['records_total'] ) && (!isset( $json->wpda_count_on_each_request ) || false === $json->wpda_count_on_each_request) ) { |
| 1177 | 1174 | // Prevent row count on each request |
| @@ -1184,9 +1181,8 @@ | ||
| 1184 | 1181 | $do_real_count = $row_count_estimate['do_real_count']; |
| 1185 | 1182 | } |
| 1186 | 1183 | } else { |
| 1187 | 1184 | $rows_estimate = count( $rows_final ); |
| 1188 | - //phpcs:ignore - 8.1 proof | |
| 1189 | 1185 | $do_real_count = false; |
| 1190 | 1186 | } |
| 1191 | 1187 | if ( 'more' === $publication_mode ) { |
| 1192 | 1188 | // Use estimate row count |
| @@ -1199,9 +1195,8 @@ | ||
| 1199 | 1195 | } else { |
| 1200 | 1196 | // Count rows in table = real row count |
| 1201 | 1197 | $query2 = "select count(*) from `{$wpdadb->dbname}`.`{$table_name}`"; |
| 1202 | 1198 | $count_rows = $wpdadb->get_results( $query2, 'ARRAY_N' ); |
| 1203 | - // phpcs:ignore Standard.Category.SniffName.ErrorCode | |
| 1204 | 1199 | $count_table = $count_rows[0][0]; |
| 1205 | 1200 | // Number of rows in table. |
| 1206 | 1201 | } |
| 1207 | 1202 | if ( isset( $_REQUEST['wpda_use_estimates_only'] ) && 'true' === $_REQUEST['wpda_use_estimates_only'] ) { |
| @@ -1215,9 +1210,8 @@ | ||
| 1215 | 1210 | } else { |
| 1216 | 1211 | // Count rows in selection (only necessary if a search criteria was entered). |
| 1217 | 1212 | $query3 = "select count(*) from `{$wpdadb->dbname}`.`{$table_name}` {$where}"; |
| 1218 | 1213 | $count_rows_filtered = $wpdadb->get_results( $query3, 'ARRAY_N' ); |
| 1219 | - // phpcs:ignore Standard.Category.SniffName.ErrorCode | |
| 1220 | 1214 | $count_table_filtered = $count_rows_filtered[0][0]; |
| 1221 | 1215 | // Number of rows in table. |
| 1222 | 1216 | } |
| 1223 | 1217 | } else { |
| @@ -1231,10 +1225,12 @@ | ||
| 1231 | 1225 | $obj->draw = ( isset( $_REQUEST['draw'] ) ? intval( $_REQUEST['draw'] ) : 0 ); |
| 1232 | 1226 | $obj->recordsTotal = intval( $count_table ); |
| 1233 | 1227 | $obj->recordsFiltered = intval( $count_table_filtered ); |
| 1234 | 1228 | $obj->data = $rows_final; |
| 1235 | - $obj->error = $wpdadb->last_error; | |
| 1236 | 1229 | if ( 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG ) ) { |
| 1230 | + $obj->error = $wpdadb->last_error; | |
| 1231 | + } | |
| 1232 | + if ( 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG ) ) { | |
| 1237 | 1233 | $obj->debug = array( |
| 1238 | 1234 | 'columns' => $columns, |
| 1239 | 1235 | 'columns_backticks' => $columns_backticks, |
| 1240 | 1236 | 'query' => $query, |
| @@ -1268,17 +1264,17 @@ | ||
| 1268 | 1264 | $is_cpt, |
| 1269 | 1265 | $offset, |
| 1270 | 1266 | $limit |
| 1271 | 1267 | ) { |
| 1268 | + return null; | |
| 1272 | 1269 | } |
| 1273 | 1270 | |
| 1274 | 1271 | private function get_orderby_from_request() { |
| 1275 | 1272 | $orderby = ''; |
| 1276 | 1273 | // Init order by. |
| 1274 | + // phpcs:disable WordPress.Security.ValidatedSanitizedInput | |
| 1277 | 1275 | if ( isset( $_REQUEST['order'] ) && is_array( $_REQUEST['order'] ) ) { |
| 1278 | - // input var okay. | |
| 1279 | 1276 | foreach ( $_REQUEST['order'] as $order_column ) { |
| 1280 | - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput | |
| 1281 | 1277 | if ( isset( $order_column['column'], $order_column['dir'] ) && is_numeric( $order_column['column'] ) && ('asc' === $order_column['dir'] || 'desc' === $order_column['dir']) ) { |
| 1282 | 1278 | $preprend = ( '' === $orderby ? ' order by ' : ',' ); |
| 1283 | 1279 | $orderby .= $preprend . (intval( $order_column['column'] ) + 1) . ' ' . $order_column['dir']; |
| 1284 | 1280 | } |
| @@ -1283,8 +1279,9 @@ | ||
| 1283 | 1279 | $orderby .= $preprend . (intval( $order_column['column'] ) + 1) . ' ' . $order_column['dir']; |
| 1284 | 1280 | } |
| 1285 | 1281 | } |
| 1286 | 1282 | } |
| 1283 | + // phpcs:enable WordPress.Security.ValidatedSanitizedInput | |
| 1287 | 1284 | return $orderby; |
| 1288 | 1285 | } |
| 1289 | 1286 | |
| 1290 | 1287 | private function sp( |
| @@ -1299,14 +1296,17 @@ | ||
| 1299 | 1296 | return $sp; |
| 1300 | 1297 | } |
| 1301 | 1298 | |
| 1302 | 1299 | public function qb_group( $data ) { |
| 1300 | + return null; | |
| 1303 | 1301 | } |
| 1304 | 1302 | |
| 1305 | 1303 | public function qb_criteria( $crit ) { |
| 1304 | + return null; | |
| 1306 | 1305 | } |
| 1307 | 1306 | |
| 1308 | 1307 | private function qb( $labels ) { |
| 1308 | + return null; | |
| 1309 | 1309 | } |
| 1310 | 1310 | |
| 1311 | 1311 | private function create_empty_response( $error = '', $debug = '' ) { |
| 1312 | 1312 | $obj = (object) null; |
| @@ -1314,9 +1314,13 @@ | ||
| 1314 | 1314 | $obj->recordsTotal = 0; |
| 1315 | 1315 | $obj->recordsFiltered = 0; |
| 1316 | 1316 | $obj->data = array(); |
| 1317 | 1317 | $obj->error = $error; |
| 1318 | - $obj->debug = $debug; | |
| 1318 | + if ( 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG ) ) { | |
| 1319 | + $obj->debug = $debug; | |
| 1320 | + } | |
| 1319 | 1321 | echo json_encode( $obj ); |
| 1320 | 1322 | } |
| 1321 | 1323 | |
| 1322 | 1324 | } |
| 1325 | + | |
| 1326 | +// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing | |
