← All changes | WPDataAccess/Data_Publisher/WPDA_Publisher_List_Table.php +21 -31 5.5.41 → 5.5.85 View file →

		@@ -119,8 +119,9 @@
119	119	$form_id = '_' . (self::$list_number - 1);
120	120	$esc_attr = 'esc_attr';
121	121	$input_fields = $this->get_key_input_fields( $item );
122	122	$page_field = $this->page_number_item;
	123	+ // phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed
123	124	$copy_form = <<<EOT
124	125	\t\t\t\t<form id='copy_form{$esc_attr( $form_id )}' method='post'
125	126	\t\t\t\t\t action='?page={$esc_attr( $this->page )}'
126	127	\t\t\t\t>
		@@ -134,10 +135,11 @@
134	135	?>
135	136
136	137	<script type='text/javascript'>
137	138	jQuery("#wpda_invisible_container").append("<?php
	139	+ // phpcs:disable WordPress.Security.EscapeOutput
138	140	echo str_replace( array("\n", "\r"), '', $copy_form );
139		- // phpcs:ignore WordPress.Security.EscapeOutput
	141	+ // phpcs:enable WordPress.Security.EscapeOutput
140	142	?>");
141	143	</script>
142	144
143	145	<?php
		@@ -164,9 +166,9 @@
164	166	<div id="wpda_publication_<?php
165	167	echo esc_attr( $item['pub_id'] );
166	168	?>"
167	169	title="<?php
168		- echo __( 'Shortcode', 'wp-data-access' );
	170	+ echo esc_attr__( 'Shortcode', 'wp-data-access' );
169	171	?>"
170	172	style="display:none"
171	173	>
172	174	<p class="wpda_shortcode_content">
		@@ -185,13 +187,13 @@
185	187	data-clipboard-text='[wpdataaccess pub_id="<?php
186	188	echo esc_attr( $item['pub_id'] );
187	189	?>"]'
188	190	onclick="jQuery.notify('<?php
189		- echo __( 'Shortcode successfully copied to clipboard!' );
	191	+ echo esc_attr__( 'Shortcode successfully copied to clipboard!', 'wp-data-access' );
190	192	?>','info')"
191	193	>
192	194	<?php
193		- echo __( 'Copy', 'wp-data-access' );
	195	+ echo esc_attr__( 'Copy', 'wp-data-access' );
194	196	?>
195	197	</button>
196	198	<button class="button button-primary wpda_shortcode_button"
197	199	type="button"
		@@ -197,9 +199,9 @@
197	199	type="button"
198	200	onclick="jQuery('.ui-dialog-content').dialog('close')"
199	201	>
200	202	<?php
201		- echo __( 'Close', 'wp-data-access' );
	203	+ echo esc_attr__( 'Close', 'wp-data-access' );
202	204	?>
203	205	</button>
204	206	</p>
205	207	<?php
		@@ -207,10 +209,9 @@
207	209	?>
208	210	<p>
209	211	Shortcode wpdataaccess is not enabled for all output types.
210	212	<a href="<?php
211		- echo admin_url( 'options-general.php' );
212		- // phpcs:ignore WordPress.Security.EscapeOutput
	213	+ echo esc_url( admin_url( 'options-general.php' ) );
213	214	?>?page=wpdataaccess" class="wpda_shortcode_link">&raquo; Manage settings</a>
214	215	</p>
215	216	<?php
216	217	}
		@@ -255,9 +256,9 @@
255	256	$wp_nonce_action = "wpda-copy-{$this->table_name}";
256	257	$wp_nonce = ( isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : '' );
257	258	// input var okay.
258	259	if ( !wp_verify_nonce( $wp_nonce, $wp_nonce_action ) ) {
259		- die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	260	+ die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
260	261	}
261	262	if ( isset( $_REQUEST['pub_id'] ) ) {
262	263	$pub_id = sanitize_text_field( wp_unslash( $_REQUEST['pub_id'] ) );
263	264	// input var okay.
		@@ -263,17 +264,17 @@
263	264	// input var okay.
264	265	}
265	266	$unique_pu_name = $this->get_unique_pub_name( $pub_id );
266	267	global $wpdb;
267		- $pub_raw = $wpdb->get_results( $wpdb->prepare(
268		- 'SELECT * FROM `%1s` WHERE pub_id = %d',
269		- // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders
270		- array(WPDA::remove_backticks( $this->table_name ), $pub_id)
271		- ), 'ARRAY_A' );
	268	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQLPlaceholders
	269	+ $pub_raw = $wpdb->get_results( $wpdb->prepare( 'SELECT * FROM `%1s` WHERE pub_id = %d', array(WPDA::remove_backticks( $this->table_name ), $pub_id) ), 'ARRAY_A' );
	270	+ // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQLPlaceholders
272	271	if ( $wpdb->num_rows > 0 ) {
273	272	$pub_raw[0]['pub_name'] = $unique_pu_name;
274	273	unset($pub_raw[0]['pub_id']);
	274	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery
275	275	$rows_inserted = $wpdb->insert( $this->table_name, $pub_raw[0] );
	276	+ // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery
276	277	switch ( $rows_inserted ) {
277	278	case 0:
278	279	$msg = new WPDA_Message_Box(array(
279	280	'message_text' => __( 'Could not copy data table [source not found]', 'wp-data-access' ),
		@@ -303,34 +304,24 @@
303	304	}
304	305
305	306	protected function get_unique_pub_name( $pub_id ) {
306	307	global $wpdb;
307		- $db_pub_name = $wpdb->get_results( $wpdb->prepare(
308		- 'select pub_name from `%1s` where pub_id = %d',
309		- // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders
310		- array(WPDA::remove_backticks( WPDA_Publisher_Model::get_base_table_name() ), $pub_id)
311		- ), 'ARRAY_A' );
	308	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQLPlaceholders
	309	+ $db_pub_name = $wpdb->get_results( $wpdb->prepare( 'select pub_name from `%1s` where pub_id = %d', array(WPDA::remove_backticks( WPDA_Publisher_Model::get_base_table_name() ), $pub_id) ), 'ARRAY_A' );
312	310	if ( $wpdb->num_rows !== 1 ) {
313		- wp_die( __( 'ERROR: Data table not found', 'wp-data-access' ) );
	311	+ wp_die( esc_attr__( 'ERROR: Data table not found', 'wp-data-access' ) );
314	312	}
315	313	$i = 2;
316	314	$pub_name = $db_pub_name[0]['pub_name'];
317	315	$unique_pub_name = "{$pub_name}_{$i}";
318		- $wpdb->get_results( $wpdb->prepare(
319		- "select 'x' from `%1s` where pub_name = %s",
320		- // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders
321		- array(WPDA::remove_backticks( WPDA_Publisher_Model::get_base_table_name() ), $unique_pub_name)
322		- ) );
	316	+ $wpdb->get_results( $wpdb->prepare( "select 'x' from `%1s` where pub_name = %s", array(WPDA::remove_backticks( WPDA_Publisher_Model::get_base_table_name() ), $unique_pub_name) ) );
323	317	while ( $wpdb->num_rows > 0 ) {
324	318	// Search until a free options set is found
325	319	$i++;
326	320	$unique_pub_name = "{$pub_name}_{$i}";
327		- $wpdb->get_results( $wpdb->prepare(
328		- "select 'x' from `%1s` where pub_name = %s",
329		- // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders
330		- array(WPDA::remove_backticks( WPDA_Publisher_Model::get_base_table_name() ), $unique_pub_name)
331		- ) );
	321	+ $wpdb->get_results( $wpdb->prepare( "select 'x' from `%1s` where pub_name = %s", array(WPDA::remove_backticks( WPDA_Publisher_Model::get_base_table_name() ), $unique_pub_name) ) );
332	322	}
	323	+ // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQLPlaceholders
333	324	return $unique_pub_name;
334	325	}
335	326
336	327	public static function column_headers_labels() {
		@@ -386,10 +377,9 @@
386	377	} else {
387	378	jQuery.ajax({
388	379	type: "POST",
389	380	url: "<?php
390		- echo admin_url( 'admin-ajax.php?action=wpda_test_publication' );
391		- // phpcs:ignore WordPress.Security.EscapeOutput
	381	+ echo esc_url( admin_url( 'admin-ajax.php?action=wpda_test_publication' ) );
392	382	?>",
393	383	data: {
394	384	wpnonce: wpnonce,
395	385	pub_id: pub_id