← All changes | WPDataAccess/Utilities/WPDA_Export_Sql.php +28 -22 5.5.73 → 5.5.85 View file →

		@@ -113,9 +113,9 @@
113	113	$current_memory_limit = @ini_get( 'memory_limit' );
114	114	if ( false === $current_memory_limit ||
115	115	WPDA::convert_memory_to_decimal( $current_memory_limit ) < WPDA::convert_memory_to_decimal( $wp_memory_limit )
116	116	) {
117		- @ini_set( 'memory_limit', $wp_memory_limit );
	117	+ @ini_set( 'memory_limit', $wp_memory_limit ); // phpcs:ignore
118	118	}
119	119	}
120	120
121	121	$this->export_with_prefix = 'on' === WPDA::get_option( WPDA::OPTION_BE_EXPORT_VARIABLE_PREFIX );
		@@ -150,9 +150,10 @@
150	150
151	151	if ( '' !== $schema_name ) {
152	152	$wpdadb = WPDADB::get_db_connection( $schema_name );
153	153	if ( null === $wpdadb ) {
154		- die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
	154	+ /* translators: %s = database name */
	155	+ die( sprintf( esc_attr__( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
155	156	}
156	157
157	158	$this->schema_name = $schema_name;
158	159	$this->schema_name_prefix = "`{$wpdadb->dbname}`.";
		@@ -183,13 +184,16 @@
183	184	*/
184	185	public function export() {
185	186	// Check if export is allowed.
186	187	$table_names = isset( $_REQUEST['table_names'] ) ?
187		- json_encode( WPDA::sanitize_text_field_array( $_REQUEST['table_names'] ) ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
	188	+ json_encode( WPDA::sanitize_text_field_array( $_REQUEST['table_names'] ) ) : ''; // phpcs:ignore
188	189	$wp_nonce = isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : '?'; // input var okay.
189	190	if (
190	191	! wp_verify_nonce( $wp_nonce, "wpda-export-{$table_names}" ) &&
191		- ! wp_verify_nonce( $wp_nonce, 'wpda-export-' . WPDA::get_current_user_login() )
	192	+ ! (
	193	+ WPDA::current_user_is_admin() && // Admins are allowed to export all tables
	194	+ wp_verify_nonce( $wp_nonce, 'wpda-export-' . WPDA::get_current_user_login() )
	195	+ )
192	196	) {
193	197	wp_die();
194	198	}
195	199
		@@ -351,9 +355,9 @@
351	355	// NO_TABLE_OPTIONS is deprecated in V8
352	356	// $wpdadb->query( "SET sql_mode = 'NO_TABLE_OPTIONS'" );
353	357	}
354	358	$query = "show create table {$this->schema_name_prefix}`" . str_replace( '`', '', (string) $table_name ) . '`';
355		- $ctcmd = $wpdadb->get_results( $query, 'ARRAY_A' ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
	359	+ $ctcmd = $wpdadb->get_results( $query, 'ARRAY_A' );
356	360	}
357	361
358	362	$this->output_string = '';
359	363	if ( $wpdadb->num_rows > 0 ) {
		@@ -440,18 +444,20 @@
440	444	$this->output_string = '';
441	445
442	446	$query = "select * from {$this->schema_name_prefix}`" . str_replace( '`', '', (string) $table_name ) . "` $where";
443	447	if ( is_numeric( $query_buffer_size ) && $query_buffer_size > 0 ) {
	448	+ // phpcs:disable Squiz.PHP.DiscouragedFunctions.Discouraged
444	449	set_time_limit(0);
	450	+ // phpcs:enable Squiz.PHP.DiscouragedFunctions.Discouraged
445	451	$i = 0;
446	452	$sql = $query . ' limit ' . $query_buffer_size;
447		- $rows = $wpdadb->get_results( $sql, 'ARRAY_A' ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
	453	+ $rows = $wpdadb->get_results( $sql, 'ARRAY_A' );
448	454	while ( $wpdadb->num_rows > 0 ) {
449	455	$this->insert_rows_buffer( $rows, $table_name, $where, $show_comments );
450	456
451	457	$i++;
452	458	$sql = $query . ' limit ' . $query_buffer_size . ' offset ' . ( $i * $query_buffer_size );
453		- $rows = $wpdadb->get_results( $sql, 'ARRAY_A' ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
	459	+ $rows = $wpdadb->get_results( $sql, 'ARRAY_A' );
454	460	}
455	461
456	462	if ( 1 === $i && 0 == $wpdadb->num_rows ) {
457	463	$this->empty_table( $table_name, $show_comments );
		@@ -456,9 +462,9 @@
456	462	if ( 1 === $i && 0 == $wpdadb->num_rows ) {
457	463	$this->empty_table( $table_name, $show_comments );
458	464	}
459	465	} else {
460		- $rows = $wpdadb->get_results( $query, 'ARRAY_A' ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
	466	+ $rows = $wpdadb->get_results( $query, 'ARRAY_A' );
461	467
462	468	if ( $wpdadb->num_rows > 0 ) {
463	469	$this->insert_rows_buffer( $rows, $table_name, $where, $show_comments );
464	470	} else {
		@@ -563,10 +569,10 @@
563	569
564	570	foreach ( $rows as $row ) {
565	571	$this->output_string .= $insert_statement . '(';
566	572
567		- $keys = array_keys( $row );//phpcs:ignore - 8.1 proof
568		- $last_column = end( $keys );//phpcs:ignore - 8.1 proof
	573	+ $keys = array_keys( $row ); // phpcs:ignore -- 8.1 proof
	574	+ $last_column = end( $keys ); // phpcs:ignore -- 8.1 proof
569	575	foreach ( $row as $column_name => $column_value ) {
570	576	if (
571	577	! (
572	578	WPDA::is_wpda_table( $table_name ) &&
		@@ -638,9 +644,9 @@
638	644	}
639	645
640	646	if ( 'on' === $this->include_table_settings ) {
641	647	// Export column labels
642		- $rows = $wpdb->get_results(
	648	+ $rows = $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin table
643	649	$wpdb->prepare(
644	650	"select * from {$wpdb->prefix}wpda_table_settings where wpda_table_name = %s",
645	651	array(
646	652	$table_name,
		@@ -646,9 +652,9 @@
646	652	$table_name,
647	653	)
648	654	),
649	655	'ARRAY_A'
650		- ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
	656	+ );
651	657	if ( 1 === $wpdb->num_rows ) {
652	658	$this->output_string .=
653	659	'DELETE FROM `{wp_prefix}wpda_table_settings` ' .
654	660	"WHERE `wpda_table_name` = '" . esc_attr( $table_name ) . "';";
		@@ -662,9 +668,9 @@
662	668	$this->output_string .= "\n";
663	669	}
664	670
665	671	// Export media columns
666		- $rows = $wpdb->get_results(
	672	+ $rows = $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin table
667	673	$wpdb->prepare(
668	674	"select * from {$wpdb->prefix}wpda_media where media_table_name = %s",
669	675	array(
670	676	$table_name,
		@@ -670,9 +676,9 @@
670	676	$table_name,
671	677	)
672	678	),
673	679	'ARRAY_A'
674		- ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
	680	+ );
675	681	$this->output_string .=
676	682	'DELETE FROM `{wp_prefix}wpda_media` ' .
677	683	"WHERE `media_table_name` = '" . esc_attr( $table_name ) . "';";
678	684	$this->output_string .= "\n";
		@@ -687,9 +693,9 @@
687	693	$this->output_string .= "\n";
688	694	}
689	695
690	696	// Export table menus
691		- $rows = $wpdb->get_results(
	697	+ $rows = $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin table
692	698	$wpdb->prepare(
693	699	"select * from {$wpdb->prefix}wpda_menus where menu_table_name = %s",
694	700	array(
695	701	$table_name,
		@@ -695,9 +701,9 @@
695	701	$table_name,
696	702	)
697	703	),
698	704	'ARRAY_A'
699		- ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
	705	+ );
700	706	$this->output_string .=
701	707	'DELETE FROM `{wp_prefix}wpda_menus` ' .
702	708	"WHERE `menu_table_name` = '" . esc_attr( $table_name ) . "';";
703	709	$this->output_string .= "\n";
		@@ -819,9 +825,9 @@
819	825
820	826	// Use first column of the primary key to loop through arguments. Add additional arguments in the loop.
821	827	// A mismatch in the number of argument is possible as long as the columns match based on the first column
822	828	// of the primary key. Other mismatches won't be taken into account.
823		- $count_pk = count( ( array ) $_REQUEST[ $table_primary_key[0] ] );//phpcs:ignore - 8.1 proof
	829	+ $count_pk = count( ( array ) $_REQUEST[ $table_primary_key[0] ] ); // phpcs:ignore -- 8.1 proof
824	830	for ( $i = 0; $i < $count_pk; $i ++ ) {
825	831	$and = '';
826	832	foreach ( $table_primary_key as $key ) {
827	833	$and .= '' === $and ? '(' : ' and ';
		@@ -829,19 +835,19 @@
829	835	$and .= $wpdb->prepare(
830	836	'`%1s` = %d', // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders
831	837	array(
832	838	WPDA::remove_backticks( $key ),
833		- sanitize_text_field( wp_unslash( $_REQUEST[ $key ][ $i ] ) ),
	839	+ sanitize_text_field( wp_unslash( $_REQUEST[ $key ][ $i ] ) ), // phpcs:ignore -- nonce veryfied in export function
834	840	)
835		- ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
	841	+ );
836	842	} else {
837	843	$and .= $wpdb->prepare(
838	844	'`%1s` = %s', // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders
839	845	array(
840	846	WPDA::remove_backticks( $key ),
841		- sanitize_text_field( wp_unslash( $_REQUEST[ $key ][ $i ] ) ),
	847	+ sanitize_text_field( wp_unslash( $_REQUEST[ $key ][ $i ] ) ), // phpcs:ignore -- nonce veryfied in export function
842	848	)
843		- ); // phpcs:ignore Standard.Category.SniffName.ErrorCode
	849	+ );
844	850	}
845	851	}
846	852
847	853	$and .= '' === $and ? '' : ')';
		@@ -877,9 +883,9 @@
877	883	protected function write_output() {
878	884	if ( null === $this->output_stream ) {
879	885	echo $this->output_string; // phpcs:ignore WordPress.Security.EscapeOutput
880	886	} else {
881		- fwrite( $this->output_stream, $this->output_string );
	887	+ fwrite( $this->output_stream, $this->output_string ); // phpcs:ignore
882	888	}
883	889	$this->output_string = '';
884	890	}
885	891