PluginProbe
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards / 5.5.85
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards v5.5.85
5.5.85 5.5.84 5.5.83 5.5.82 5.5.81 5.5.80 5.5.79 5.5.77 5.5.76 5.5.75 5.5.73 5.5.72 5.5.22 5.5.23 5.5.29 5.5.3 5.5.31 5.5.32 5.5.34 5.5.35 5.5.36 5.5.37 5.5.4 5.5.40 5.5.41 All 161 releases
← All changes | WPDataProjects/Parent_Child/WPDP_Child_List_Table.php +47 -21 5.5.35 → 5.5.85 View file →
@@ -74,21 +74,21 @@
74 74 public function __construct( $args = array() ) {
75 75 if ( isset( $args['mode'] ) ) {
76 76 $this->mode = $args['mode'];
77 77 } else {
78 - wp_die( __( 'ERROR: Wrong arguments [missing mode]', 'wp-data-access' ) );
78 + wp_die( esc_attr__( 'ERROR: Wrong arguments [missing mode]', 'wp-data-access' ) );
79 79 }
80 80
81 81 if ( isset( $args['parent'] ) ) {
82 82 $this->parent = $args['parent'];
83 83 } else {
84 - wp_die( __( 'ERROR: Wrong arguments [missing parent]', 'wp-data-access' ) );
84 + wp_die( esc_attr__( 'ERROR: Wrong arguments [missing parent]', 'wp-data-access' ) );
85 85 }
86 86
87 87 if ( isset( $args['child'] ) ) {
88 88 $this->child = $args['child'];
89 89 } else {
90 - wp_die( __( 'ERROR: Wrong arguments [missing child]', 'wp-data-access' ) );
90 + wp_die( esc_attr__( 'ERROR: Wrong arguments [missing child]', 'wp-data-access' ) );
91 91 }
92 92
93 93 $args['child_request'] = true;
94 94 $args['allow_insert'] = 'off';
@@ -104,10 +104,10 @@
104 104 } else {
105 105 $args['bulk_actions_enabled'] = false;
106 106 }
107 107
108 - if ( isset( $_REQUEST['child_tab'] ) ) {
109 - $this->child_tab = sanitize_text_field( wp_unslash( $_REQUEST['child_tab'] ) ); // input var okay.
108 + if ( isset( $_REQUEST['child_tab'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- already verified
109 + $this->child_tab = sanitize_text_field( wp_unslash( $_REQUEST['child_tab'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- already verified
110 110 }
111 111
112 112 $this->page_number_item_name = 'child_page_number';
113 113
@@ -208,11 +208,13 @@
208 208 protected function construct_where_clause() {
209 209 $wpdadb = WPDADB::get_db_connection( $this->schema_name );
210 210 if ( null === $wpdadb ) {
211 211 if ( is_admin() ) {
212 - wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
212 + /* translators: %s = database name */
213 + wp_die( sprintf( esc_attr__( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
213 214 } else {
214 - die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
215 + /* translators: %s = database name */
216 + die( sprintf( esc_attr__( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
215 217 }
216 218 }
217 219
218 220 if (
@@ -237,9 +239,9 @@
237 239 $select_column_names = '';
238 240 $index = 0;
239 241
240 242 foreach ( $parent_key as $key ) {
241 - if ( $key === reset( $parent_key ) ) {//phpcs:ignore - 8.1 proof
243 + if ( $key === reset( $parent_key ) ) { // phpcs:ignore -- 8.1 proof
242 244 $parent_key_column_names .= "(`$key`";
243 245 $select_column_names .= '`' . $child_table_select[ $index ] . '`';
244 246 } else {
245 247 $parent_key_column_names .= ",`$key`";
@@ -252,9 +254,9 @@
252 254 $index = 0;
253 255 $where = '';
254 256
255 257 foreach ( $child_table_where as $child_where ) {
256 - if ( $child_where === reset( $child_table_where ) ) {//phpcs:ignore - 8.1 proof
258 + if ( $child_where === reset( $child_table_where ) ) { // phpcs:ignore -- 8.1 proof
257 259 $and = '';
258 260 } else {
259 261 $and = ' and ';
260 262 }
@@ -262,15 +264,15 @@
262 264 $where .=
263 265 $wpdadb->prepare(
264 266 " $and `$child_where` = %f ",
265 267 $this->parent['parent_key_value'][ $this->parent['parent_key'][ $index ] ]
266 - ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
268 + );
267 269 } else {
268 270 $where .=
269 271 $wpdadb->prepare(
270 272 " $and `$child_where` = %s ",
271 273 $this->parent['parent_key_value'][ $this->parent['parent_key'][ $index ] ]
272 - ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
274 + );
273 275 }
274 276 $index ++;
275 277 }
276 278
@@ -281,9 +283,9 @@
281 283 }
282 284
283 285 $this->where =
284 286 " where ($parent_key_column_names {$this->where_in} " .
285 - " (select $select_column_names from $schema_table_name where $where)) "; // phpcs:ignore Standard.Category.SniffName.ErrorCode
287 + " (select $select_column_names from $schema_table_name where $where)) ";
286 288 } elseif ( isset( $this->child['relation_1n'] ) ) {
287 289 $child_key = $this->child['relation_1n']['child_key'];
288 290 $data_type = $this->child['relation_1n']['data_type'];
289 291
@@ -299,9 +301,9 @@
299 301 $index = 0;
300 302 $where = '';
301 303
302 304 foreach ( $child_key as $key ) {
303 - if ( $key === reset( $child_key ) ) {//phpcs:ignore - 8.1 proof
305 + if ( $key === reset( $child_key ) ) { // phpcs:ignore -- 8.1 proof
304 306 $and = '';
305 307 } else {
306 308 $and = ' and ';
307 309 }
@@ -311,15 +313,17 @@
311 313 } else {
312 314 if ( $parent_key == $this->parent['parent_key'] ) {
313 315 $parent_key_value = $this->parent['parent_key_value'][ $this->parent['parent_key'][ $index ] ];
314 316 } else {
317 + // phpcs:disable WordPress.Security.NonceVerification.Recommended -- already verified
315 318 if ( isset( $_REQUEST[ 'WPDA_PARENT_KEY*' . $parent_key[ $index ] ] ) ) {
316 319 $parent_key_value = sanitize_text_field( wp_unslash( $_REQUEST[ 'WPDA_PARENT_KEY*' . $parent_key[ $index ] ] ) ); // input var okay.
317 320 } elseif ( isset( $_REQUEST[ $parent_key[ $index ] ] ) ) {
318 321 $parent_key_value = sanitize_text_field( wp_unslash( $_REQUEST[ $parent_key[ $index ] ] ) ); // input var okay.
319 322 } else {
320 - wp_die( '<p style="clear: both; padding: 10px;">' . __( 'ERROR: No value for parent key found', 'wp-data-access' ) . '</p>' );
323 + wp_die( '<p style="clear: both; padding: 10px;">' . esc_attr__( 'ERROR: No value for parent key found', 'wp-data-access' ) . '</p>' );
321 324 }
325 + // phpcs:enable WordPress.Security.NonceVerification.Recommended
322 326 }
323 327 }
324 328
325 329 if ( isset( $data_type[ $index ] ) && 'number' === strtolower( $data_type[ $index ] ) ) {
@@ -325,20 +329,20 @@
325 329 if ( isset( $data_type[ $index ] ) && 'number' === strtolower( $data_type[ $index ] ) ) {
326 330 $where .= $wpdadb->prepare(
327 331 " $and `$key` = %f ",
328 332 $parent_key_value
329 - ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
333 + );
330 334 } else {
331 335 $where .= $wpdadb->prepare(
332 336 " $and `$key` = %s ",
333 337 $parent_key_value
334 - ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
338 + );
335 339 }
336 340
337 341 $index++;
338 342 }
339 343
340 - $this->where = " where ($where) "; // phpcs:ignore Standard.Category.SniffName.ErrorCode
344 + $this->where = " where ($where) ";
341 345 }
342 346
343 347 // Add default where
344 348 $this->where .= $default_where;
@@ -356,15 +360,35 @@
356 360 isset( $this->child['default_orderby'] ) &&
357 361 null !== $this->child['default_orderby'] &&
358 362 '' !== trim( $this->child['default_orderby'] )
359 363 ) {
360 - $default_orderby = " order by {$this->child['default_orderby']} ";
364 + $columns = $this->get_sortable_columns();
365 + $orderby_columns = explode( ',', $this->child['default_orderby'] );
366 +
367 + $valid = false;
368 + for ( $i = 0; $i < count( $orderby_columns ); $i++ ) {
369 + foreach( $columns as $column_name => $column ) {
370 + if (
371 + $column_name === trim("{$orderby_columns[ $i ]}") ||
372 + $column_name === trim("{$orderby_columns[ $i ]}asc") ||
373 + $column_name === trim("{$orderby_columns[ $i ]}desc") ||
374 + $column_name === trim("`{$orderby_columns[ $i ]}`asc") ||
375 + $column_name === trim("`{$orderby_columns[ $i ]}`desc")
376 + ) {
377 + $valid = true;
378 + }
379 + }
380 + }
381 +
382 + $default_orderby = $valid
383 + ? " order by {$this->child['default_orderby']} "
384 + : '';
361 385 } else {
362 386 $default_orderby = '';
363 387 }
364 388
365 389 // Add default order by
366 - return $default_orderby; // phpcs:ignore Standard.Category.SniffName.ErrorCode
390 + return $default_orderby;
367 391 }
368 392
369 393 /**
370 394 * Overwrites method column_default_add_action
@@ -467,11 +491,13 @@
467 491
468 492 $wpdadb = WPDADB::get_db_connection( $this->schema_name );
469 493 if ( null === $wpdadb ) {
470 494 if ( is_admin() ) {
471 - wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
495 + /* translators: %s = database name */
496 + wp_die( sprintf( esc_attr__( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
472 497 } else {
473 - die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
498 + /* translators: %s = database name */
499 + die( sprintf( esc_attr__( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
474 500 }
475 501 }
476 502
477 503 $row_deleted = $wpdadb->delete( $table_name, $next_row_to_be_deleted ); // db call ok; no-cache ok.