← All changes | WPDataAccess/List_Table/WPDA_List_Table.php +125 -145 5.5.76 → 5.5.85 View file →

		@@ -4,21 +4,18 @@
4	4	* Suppress "error - 0 - No summary was found for this file" on phpdoc generation
5	5	*
6	6	* @package WPDataAccess\List_Table
7	7	*/
	8	+// phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- verified on page
8	9	namespace WPDataAccess\List_Table;
9	10
10	11	use WPDataAccess\Connection\WPDADB;
11		-use WPDataAccess\Dashboard\WPDA_Dashboard;
12	12	use WPDataAccess\Data_Dictionary\WPDA_Dictionary_Exist;
13		-use WPDataAccess\Data_Dictionary\WPDA_Dictionary_Lists;
14	13	use WPDataAccess\Data_Dictionary\WPDA_List_Columns;
15	14	use WPDataAccess\Macro\WPDA_Macro;
16	15	use WPDataAccess\Plugin_Table_Models\WPDA_CSV_Uploads_Model;
17	16	use WPDataAccess\Plugin_Table_Models\WPDA_Media_Model;
18		-use WPDataAccess\Utilities\WPDA_Import;
19	17	use WPDataAccess\Utilities\WPDA_Message_Box;
20		-use WPDataAccess\Utilities\WPDA_Repository;
21	18	use WPDataAccess\Wordpress_Original;
22	19	use WPDataAccess\WPDA;
23	20	use WPDataProjects\WPDP;
24	21	use WPDataAccess\Plugin_Table_Models\WPDA_Table_Settings_Model;
		@@ -209,15 +206,8 @@
209	206	*/
210	207	protected $column_headers;
211	208
212	209	/**
213		- * Reference to import object
214		- *
215		- * @var WPDA_Import
216		- */
217		- protected $wpda_import = null;
218		-
219		- /**
220	210	* Child tab clicked (used for parent child relationships only)
221	211	*
222	212	* @var null
223	213	*/
		@@ -365,9 +355,9 @@
365	355	*
366	356	* A list of rows for a specific table is based on WordPress class WP_List_Table.
367	357	*
368	358	* WPDA_List_Table can be used to build list tables for views as well. View based list tables however, do not
369		- * support insert, update, delete, import and export actions.
	359	+ * support insert, update, delete and export actions.
370	360	*
371	361	* A table name is not the only thing we need to build a list table. We also need to have access to the
372	362	* table columns. If no table columns are provided execution is stopped as well.
373	363	*
		@@ -402,10 +392,8 @@
402	392	* 'allow_update' => (string) on|off
403	393	*
404	394	* 'allow_delete' => (string) on|off
405	395	*
406		- * 'allow_import' => (string) on|off
407		- *
408	396	* 'hide_navigation' => (boolean)
409	397	*
410	398	* 'default_where' => (string)
411	399	*
		@@ -415,13 +403,13 @@
415	403	public function __construct( $args = array() ) {
416	404	global $wpdb;
417	405	if ( !isset( $args['table_name'] ) ) {
418	406	// Calling WPDA_List_Table without a table_name doesn't make sense.
419		- wp_die( __( 'ERROR: Wrong arguments [no table argument]', 'wp-data-access' ) );
	407	+ wp_die( esc_attr__( 'ERROR: Wrong arguments [no table argument]', 'wp-data-access' ) );
420	408	}
421	409	if ( !isset( $args['wpda_list_columns'] ) ) {
422	410	// Calling WPDA_List_Table without a column list is not allowed.
423		- wp_die( __( 'ERROR: Wrong arguments [no columns argument]', 'wp-data-access' ) );
	411	+ wp_die( esc_attr__( 'ERROR: Wrong arguments [no columns argument]', 'wp-data-access' ) );
424	412	}
425	413	parent::__construct( array(
426	414	'singular' => ( isset( $args['singular'] ) ? $args['singular'] : __( 'Row', 'wp-data-access' ) ),
427	415	'plural' => ( isset( $args['plural'] ) ? $args['plural'] : __( 'Rows', 'wp-data-access' ) ),
		@@ -440,9 +428,9 @@
440	428	// Although this check is only needed when a table name is provided through the URL we will perform
441	429	// it in all situations. It is a fast query which makes our application much more safe and reliable.
442	430	$this->wpda_data_dictionary = new WPDA_Dictionary_Exist($this->schema_name, $this->table_name);
443	431	if ( !$this->wpda_data_dictionary->table_exists() ) {
444		- wp_die( __( 'ERROR: Invalid table name or not authorized', 'wp-data-access' ) );
	432	+ wp_die( esc_attr__( 'ERROR: Invalid table name or not authorized', 'wp-data-access' ) );
445	433	}
446	434	}
447	435	$this->pid = ( isset( $args['pid'] ) ? $args['pid'] : '' );
448	436	// Get menu slag of current page.
		@@ -447,12 +435,11 @@
447	435	$this->pid = ( isset( $args['pid'] ) ? $args['pid'] : '' );
448	436	// Get menu slag of current page.
449	437	if ( isset( $_REQUEST['page'] ) ) {
450	438	$this->page = sanitize_text_field( wp_unslash( $_REQUEST['page'] ) );
451		- // input var okay.
452	439	} else {
453	440	// In order to show a list table we need a page.
454		- wp_die( __( 'ERROR: Wrong arguments [no page argument]', 'wp-data-access' ) );
	441	+ wp_die( esc_attr__( 'ERROR: Wrong arguments [no page argument]', 'wp-data-access' ) );
455	442	}
456	443	// Use column list: argument wpda_list_columns (availability already checked).
457	444	$this->wpda_list_columns =& $args['wpda_list_columns'];
458	445	// Set pagination.
		@@ -479,17 +466,8 @@
479	466	} elseif ( WPDA::is_wpda_table( $this->table_name ) ) {
480	467	$this->subtitle = '<span class="dashicons dashicons-warning"></span> ' . WPDA::get_table_type_text( WPDA::TABLE_TYPE_WPDA );
481	468	}
482	469	}
483		- if ( !(isset( $args['allow_import'] ) && 'off' === $args['allow_import']) ) {
484		- try {
485		- // Instantiate WPDA_Import.
486		- $this->wpda_import = new WPDA_Import(( is_admin() ? "?page={$this->page}" : '' ), $this->schema_name, $this->table_name);
487		- } catch ( \Exception $e ) {
488		- // If import is turned off instantiation will fail. Handle is set to null (check in future calls).
489		- $this->wpda_import = null;
490		- }
491		- }
492	470	if ( isset( $args['bulk_export_enabled'] ) ) {
493	471	$this->bulk_export_enabled = $args['bulk_export_enabled'];
494	472	}
495	473	if ( isset( $args['search_box_enabled'] ) ) {
		@@ -539,9 +517,8 @@
539	517	}
540	518	$this->search_value = ( is_scalar( $this->get_search_value() ) ? str_replace( "\\'", '', (string) $this->get_search_value() ) : '' );
541	519	if ( isset( $_REQUEST["{$this->search_item_name}_old_value"] ) ) {
542	520	$this->search_value_old = sanitize_text_field( wp_unslash( $_REQUEST["{$this->search_item_name}_old_value"] ) );
543		- // input var okay.
544	521	} else {
545	522	$this->search_value_old = $this->search_value;
546	523	}
547	524	// Get page number(s).
		@@ -547,15 +524,14 @@
547	524	// Get page number(s).
548	525	if ( 'page_number' !== $this->page_number_item_name ) {
549	526	if ( isset( $_REQUEST['page_number'] ) ) {
550	527	$requested_page_number = sanitize_text_field( wp_unslash( $_REQUEST['page_number'] ) );
551		- // input var okay.
552		- $this->page_number_link = '&page_number=' . $requested_page_number;
553		- $this->page_number_item = "<input type='hidden' name='page_number' value='" . $requested_page_number . "' />";
	528	+ $this->page_number_link = '&page_number=' . esc_attr( $requested_page_number );
	529	+ $this->page_number_item = "<input type='hidden' name='page_number' value='" . esc_attr( $requested_page_number ) . "' />";
554	530	}
555	531	}
556		- $this->page_number_link .= '&paged=' . $this->get_pagenum();
557		- $this->page_number_item .= "<input type='hidden' name='" . esc_attr( $this->page_number_item_name ) . "' value='" . $this->get_pagenum() . "' />";
	532	+ $this->page_number_link .= '&paged=' . esc_attr( $this->get_pagenum() );
	533	+ $this->page_number_item .= "<input type='hidden' name='" . esc_attr( $this->page_number_item_name ) . "' value='" . esc_attr( $this->get_pagenum() ) . "' />";
558	534	// Add search arguments to link to return to same page.
559	535	foreach ( $_REQUEST as $key => $value ) {
560	536	if ( substr( $key, 0, 19 ) === 'wpda_search_column_' && count( array_filter( $this->wpda_list_columns->get_table_columns(), function ( $column ) use($key) {
561	537	return $column['column_name'] === substr( $key, 19 );
		@@ -695,9 +671,9 @@
695	671	*
696	672	* @since 1.0.0
697	673	*/
698	674	public function no_items() {
699		- echo __( 'No data found', 'wp-data-access' );
	675	+ echo esc_attr__( 'No data found', 'wp-data-access' );
700	676	}
701	677
702	678	/**
703	679	* Use this method to build parent child relationships.
		@@ -737,9 +713,9 @@
737	713	public function column_default( $item, $column_name ) {
738	714	if ( $this->wpda_list_columns->get_table_columns()[0]['column_name'] === $column_name || $column_name === $this->first_display_column ) {
739	715	// First column: add row actions.
740	716	$count = count( $this->wpda_list_columns->get_table_primary_key() );
741		- //phpcs:ignore - 8.1 proof
	717	+ // phpcs:ignore -- 8.1 proof
742	718	if ( 0 === $count ) {
743	719	// No actions without a primary key!
744	720	// This automatically covers view processing correctly.
745	721	return $this->render_column_content( $item, $column_name ) . $this->row_actions( array(
		@@ -751,9 +727,9 @@
751	727	// No rights!
752	728	$actions = array();
753	729	$this->column_default_add_action( $item, $column_name, $actions );
754	730	if ( is_array( $actions ) && count( $actions ) > 0 ) {
755		- //phpcs:ignore - 8.1 proof
	731	+ // phpcs:ignore -- 8.1 proof
756	732	return sprintf( '%1$s %2$s', $this->render_column_content( $item, $column_name ), $this->row_actions( $actions ) );
757	733	} else {
758	734	return sprintf( '%1$s', $this->render_column_content( $item, $column_name ) );
759	735	}
		@@ -805,10 +781,11 @@
805	781	?>
806	782
807	783	<script type='text/javascript'>
808	784	jQuery("#wpda_invisible_container").append("<?php
	785	+ // phpcs:disable WordPress.Security.EscapeOutput
809	786	echo $view_form;
810		- // phpcs:ignore WordPress.Security.EscapeOutput
	787	+ // phpcs:enable WordPress.Security.EscapeOutput
811	788	?>");
812	789	</script>
813	790
814	791	<?php
		@@ -847,10 +824,11 @@
847	824	?>
848	825
849	826	<script type='text/javascript'>
850	827	jQuery("#wpda_invisible_container").append("<?php
	828	+ // phpcs:disable WordPress.Security.EscapeOutput
851	829	echo $edit_form;
852		- // phpcs:ignore WordPress.Security.EscapeOutput
	830	+ // phpcs:enable WordPress.Security.EscapeOutput
853	831	?>");
854	832	</script>
855	833
856	834	<?php
		@@ -889,10 +867,11 @@
889	867	?>
890	868
891	869	<script type='text/javascript'>
892	870	jQuery("#wpda_invisible_container").append("<?php
	871	+ // phpcs:disable WordPress.Security.EscapeOutput
893	872	echo $delete_form;
894		- // phpcs:ignore WordPress.Security.EscapeOutput
	873	+ // phpcs:enable WordPress.Security.EscapeOutput
895	874	?>");
896	875	</script>
897	876
898	877	<?php
		@@ -957,9 +936,15 @@
957	936	} else {
958	937	$hyperlink_label = ( isset( $hyperlink->hyperlink_label ) ? $hyperlink->hyperlink_label : '' );
959	938	$hyperlink_target = ( isset( $hyperlink->hyperlink_target ) ? $hyperlink->hyperlink_target : false );
960	939	$target = ( true === $hyperlink_target ? "target='_blank'" : '' );
961		- return "<a href='" . str_replace( ' ', '+', trim( $hyperlink_html ) ) . "' {$target}>{$hyperlink_label}</a>";
	940	+ if ( false === $hyperlink_target ) {
	941	+ $json = json_decode( $hyperlink_html, true );
	942	+ if ( isset( $json['url'] ) ) {
	943	+ $hyperlink_target = $json['url'];
	944	+ }
	945	+ }
	946	+ return "<a href='" . esc_url_raw( $hyperlink_target ) . "' {$target}>" . esc_attr( $hyperlink_label ) . "</a>";
962	947	}
963	948	} else {
964	949	return '';
965	950	}
		@@ -969,9 +954,9 @@
969	954	// Check if column is of type media.
970	955	$media_type = WPDA_Media_Model::get_column_media( $this->table_name, $column_name, $this->schema_name );
971	956	if ( 'Image' === $media_type ) {
972	957	$image_ids = explode( ',', (string) $item[$column_name] );
973		- //phpcs:ignore - 8.1 proof
	958	+ // phpcs:ignore -- 8.1 proof
974	959	$image_src = '';
975	960	foreach ( $image_ids as $image_id ) {
976	961	$url = wp_get_attachment_url( esc_attr( $image_id ) );
977	962	if ( false !== $url ) {
		@@ -976,17 +961,17 @@
976	961	$url = wp_get_attachment_url( esc_attr( $image_id ) );
977	962	if ( false !== $url ) {
978	963	$title = get_the_title( esc_attr( $image_id ) );
979	964	$image_src .= ( '' !== $image_src ? '<br/>' : '' );
980		- $image_src .= sprintf( '<img src="%s" class="wpda_tooltip" title="%s" width="100%%">', $url, $title );
	965	+ $image_src .= sprintf( '<img src="%s" class="wpda_tooltip" title="%s" width="100%%">', esc_url( $url ), esc_attr( $title ) );
981	966	}
982	967	}
983	968	return $image_src;
984	969	} elseif ( 'ImageURL' === $media_type ) {
985		- return sprintf( '<img src="%s" class="wpda_tooltip" width="100%%">', $item[$column_name] );
	970	+ return sprintf( '<img src="%s" class="wpda_tooltip" width="100%%">', esc_url( $item[$column_name] ) );
986	971	} elseif ( 'Attachment' === $media_type ) {
987	972	$media_ids = explode( ',', (string) $item[$column_name] );
988		- //phpcs:ignore - 8.1 proof
	973	+ // phpcs:ignore -- 8.1 proof
989	974	$media_links = '';
990	975	foreach ( $media_ids as $media_id ) {
991	976	$url = wp_get_attachment_url( esc_attr( $media_id ) );
992	977	if ( false !== $url ) {
		@@ -1007,9 +992,9 @@
1007	992	if ( is_array( $hyperlink ) && isset( $hyperlink['label'] ) && isset( $hyperlink['url'] ) && isset( $hyperlink['target'] ) ) {
1008	993	if ( '' === $hyperlink['url'] ) {
1009	994	return '';
1010	995	} else {
1011		- return "<a href='{$hyperlink['url']}' target='{$hyperlink['target']}'>{$hyperlink['label']}</a>";
	996	+ return "<a href='" . esc_url_raw( $hyperlink['url'] ) . "' target='" . esc_attr( $hyperlink['target'] ) . "'>" . esc_attr( $hyperlink['label'] ) . "</a>";
1012	997	}
1013	998	} else {
1014	999	return '';
1015	1000	}
		@@ -1014,14 +999,14 @@
1014	999	return '';
1015	1000	}
1016	1001	} else {
1017	1002	$hyperlink_label = $this->wpda_list_columns->get_column_label( $column_name );
1018		- return "<a href='{$item[$column_name]}' target='_blank'>{$hyperlink_label}</a>";
	1003	+ return "<a href='" . esc_url_raw( $item[$column_name] ) . "' target='_blank'>" . esc_attr( $hyperlink_label ) . "</a>";
1019	1004	}
1020	1005	}
1021	1006	} elseif ( 'Audio' === $media_type ) {
1022	1007	$audio_ids = explode( ',', (string) $item[$column_name] );
1023		- //phpcs:ignore - 8.1 proof
	1008	+ // phpcs:ignore -- 8.1 proof
1024	1009	$audio_src = '';
1025	1010	foreach ( $audio_ids as $audio_id ) {
1026	1011	if ( 'audio' === substr( get_post_mime_type( $audio_id ), 0, 5 ) ) {
1027	1012	$url = wp_get_attachment_url( esc_attr( $audio_id ) );
		@@ -1027,9 +1012,9 @@
1027	1012	$url = wp_get_attachment_url( esc_attr( $audio_id ) );
1028	1013	if ( false !== $url ) {
1029	1014	$title = get_the_title( esc_attr( $audio_id ) );
1030	1015	if ( false !== $url ) {
1031		- $audio_src .= '<div title="' . $title . '" class="wpda_tooltip">' . do_shortcode( '[audio src="' . $url . '"]' ) . '</div>';
	1016	+ $audio_src .= '<div title="' . esc_attr( $title ) . '" class="wpda_tooltip">' . do_shortcode( '[audio src="' . esc_url_raw( $url ) . '"]' ) . '</div>';
1032	1017	}
1033	1018	}
1034	1019	}
1035	1020	}
		@@ -1035,9 +1020,9 @@
1035	1020	}
1036	1021	return $audio_src;
1037	1022	} elseif ( 'Video' === $media_type ) {
1038	1023	$video_ids = explode( ',', (string) $item[$column_name] );
1039		- //phpcs:ignore - 8.1 proof
	1024	+ // phpcs:ignore -- 8.1 proof
1040	1025	$video_src = '';
1041	1026	foreach ( $video_ids as $video_id ) {
1042	1027	if ( 'video' === substr( get_post_mime_type( $video_id ), 0, 5 ) ) {
1043	1028	$url = wp_get_attachment_url( esc_attr( $video_id ) );
		@@ -1042,9 +1027,9 @@
1042	1027	if ( 'video' === substr( get_post_mime_type( $video_id ), 0, 5 ) ) {
1043	1028	$url = wp_get_attachment_url( esc_attr( $video_id ) );
1044	1029	if ( false !== $url ) {
1045	1030	if ( false !== $url ) {
1046		- $video_src .= do_shortcode( '[video src="' . $url . '"]' );
	1031	+ $video_src .= do_shortcode( '[video src="' . esc_url_raw( $url ) . '"]' );
1047	1032	}
1048	1033	}
1049	1034	}
1050	1035	}
		@@ -1070,9 +1055,9 @@
1070	1055	}
1071	1056	if ( 'csv' !== WPDA::get_option( WPDA::OPTION_PLUGIN_SET_FORMAT ) && isset( $this->columns_indexed[$column_name]['data_type'] ) && 'set' === $this->columns_indexed[$column_name]['data_type'] ) {
1072	1057	$list = '<' . WPDA::get_option( WPDA::OPTION_PLUGIN_SET_FORMAT ) . '>';
1073	1058	$listarray = explode( ',', (string) $item[$column_name] );
1074		- //phpcs:ignore - 8.1 proof
	1059	+ // phpcs:ignore -- 8.1 proof
1075	1060	foreach ( $listarray as $listitem ) {
1076	1061	$list .= "<li>{$listitem}</li>";
1077	1062	}
1078	1063	$list .= '</' . WPDA::get_option( WPDA::OPTION_PLUGIN_SET_FORMAT ) . '>';
		@@ -1113,8 +1098,9 @@
1113	1098	$page_number_item = $this->page_number_item;
1114	1099	$case_sensitive_search = ( isset( $_REQUEST['wpda_c'] ) && 'true' === $_REQUEST['wpda_c'] ? "<input type='hidden' name='wpda_c' value='true'>" : '' );
1115	1100	$add_schema_and_table_name = ( !is_admin() ? '' : "\n\t\t\t\t\t<input type='hidden' name='wpdaschema_name' value='{$esc_attr( $schema_name )}' />\n\t\t\t\t\t<input type='hidden' name='table_name' value='{$esc_attr( $table_name )}' />\n\t\t\t\t" );
1116	1101	// Hide schema and table name on front-end
	1102	+ // phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed
1117	1103	$form = <<<EOT
1118	1104	\t\t\t\t<form id='{$esc_attr( $form_id )}' action='{$url}' method='post'>
1119	1105	\t\t\t\t\t{$get_key_input_fields}
1120	1106	\t\t\t\t\t{$add_parent_args_as_string}
		@@ -1120,11 +1106,11 @@
1120	1106	\t\t\t\t\t{$add_parent_args_as_string}
1121	1107	\t\t\t\t\t{$add_schema_and_table_name}
1122	1108	\t\t\t\t\t<input type='hidden' name='action' value='{$esc_attr( $action )}' />
1123	1109	\t\t\t\t\t<input type='hidden' name='_wpnonce' value='{$esc_attr( $wp_nonce )}'>
1124		-\t\t\t\t\t{$row_security_nonce_field}
1125		-\t\t\t\t\t{$page_number_item}
1126		-\t\t\t\t\t{$case_sensitive_search}
	1110	+\t\t\t\t\t{$esc_attr( $row_security_nonce_field )}
	1111	+\t\t\t\t\t{$esc_attr( $page_number_item )}
	1112	+\t\t\t\t\t{$esc_attr( $case_sensitive_search )}
1127	1113	\t\t\t\t</form>
1128	1114	EOT;
1129	1115	return str_replace( array("\n", "\r"), '', $form );
1130	1116	}
		@@ -1151,11 +1137,11 @@
1151	1137	$class = 'dashicons-external';
1152	1138	}
1153	1139	return sprintf(
1154	1140	'<a href="%s" title="%s" target="_blank"><span class="dashicons %s wpda_attachment_icon"></span></a>',
1155		- $url,
1156		- $title,
1157		- $class
	1141	+ esc_url( $url ),
	1142	+ esc_attr( $title ),
	1143	+ esc_attr( $class )
1158	1144	);
1159	1145	}
1160	1146
1161	1147	/**
		@@ -1183,13 +1169,17 @@
1183	1169	*/
1184	1170	protected function render_column_content( $item, $column_name, $substitute_newlines = true ) {
1185	1171	$column_content = ( isset( $item["lookup_value_{$column_name}"] ) ? $item["lookup_value_{$column_name}"] : $item[$column_name] );
1186	1172	if ( 'off' === WPDA::get_option( WPDA::OPTION_BE_TEXT_WRAP_SWITCH ) && WPDA::get_option( WPDA::OPTION_BE_TEXT_WRAP ) < strlen( (string) $column_content ) ) {
1187		- $title = sprintf( __( 'Output limited to %1$s characters', 'wp-data-access' ), WPDA::get_option( WPDA::OPTION_BE_TEXT_WRAP ) );
	1173	+ $title = sprintf(
	1174	+ /* translators: %s = number of characters before text is wrapped */
	1175	+ __( 'Output limited to %1$s characters', 'wp-data-access' ),
	1176	+ WPDA::get_option( WPDA::OPTION_BE_TEXT_WRAP )
	1177	+ );
1188	1178	if ( $substitute_newlines ) {
1189		- return str_replace( "\n", '<br/>', substr( esc_html( str_replace( '&', '&amp;', (string) $column_content ) ), 0, WPDA::get_option( WPDA::OPTION_BE_TEXT_WRAP ) ) . ' <a href="javascript:void(0)" title="' . $title . '">&bull;&bull;&bull;</a>' );
	1179	+ return str_replace( "\n", '<br/>', substr( esc_html( str_replace( '&', '&amp;', (string) $column_content ) ), 0, WPDA::get_option( WPDA::OPTION_BE_TEXT_WRAP ) ) . ' <a href="javascript:void(0)" title="' . esc_attr( $title ) . '">&bull;&bull;&bull;</a>' );
1190	1180	} else {
1191		- return substr( esc_html( str_replace( '&', '&amp;', (string) $column_content ) ), 0, WPDA::get_option( WPDA::OPTION_BE_TEXT_WRAP ) ) . ' <a href="javascript:void(0)" title="' . $title . '">&bull;&bull;&bull;</a>';
	1181	+ return substr( esc_html( str_replace( '&', '&amp;', (string) $column_content ) ), 0, WPDA::get_option( WPDA::OPTION_BE_TEXT_WRAP ) ) . ' <a href="javascript:void(0)" title="' . esc_attr( $title ) . '">&bull;&bull;&bull;</a>';
1192	1182	}
1193	1183	} else {
1194	1184	$column_data_type = $this->wpda_list_columns->get_column_data_type( $column_name );
1195	1185	switch ( $column_data_type ) {
		@@ -1337,12 +1327,8 @@
1337	1327	*
1338	1328	* @see WPDA_List_Table::display()
1339	1329	*/
1340	1330	public function show() {
1341		- // Check for import requested.
1342		- if ( null !== $this->wpda_import ) {
1343		- $this->wpda_import->check_post();
1344		- }
1345	1331	// Prepare list table items.
1346	1332	$this->prepare_items();
1347	1333	// Show list table.
1348	1334	?>
		@@ -1416,12 +1402,8 @@
1416	1402	<input type="text" name="_wpnonce" id="wpda_row_export_form__wpnonce" />
1417	1403	</form>
1418	1404	</div>
1419	1405	<?php
1420		- // Add import container.
1421		- if ( null !== $this->wpda_import ) {
1422		- $this->wpda_import->add_container();
1423		- }
1424	1406	// Add custom code before the list table.
1425	1407	do_action_ref_array( 'wpda_before_list_table', array($this) );
1426	1408	// Prepare url.
1427	1409	if ( is_admin() ) {
		@@ -1474,34 +1456,28 @@
1474	1456	?>
1475	1457	<input id="wpda_main_form_orderby" type="hidden" name="orderby"
1476	1458	value="<?php
1477	1459	echo ( isset( $_REQUEST['orderby'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) ) ) : '' );
1478		- // input var okay.
1479	1460	?>"/>
1480	1461	<input id="wpda_main_form_order" type="hidden" name="order"
1481	1462	value="<?php
1482	1463	echo ( isset( $_REQUEST['order'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) ) : '' );
1483		- // input var okay.
1484	1464	?>"/>
1485	1465	<input id="wpda_main_form_post_mime_type" type="hidden" name="post_mime_type"
1486	1466	value="<?php
1487	1467	echo ( isset( $_REQUEST['post_mime_type'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['post_mime_type'] ) ) ) : '' );
1488		- // input var okay.
1489	1468	?>"/>
1490	1469	<input id="wpda_main_form_detached" type="hidden" name="detached"
1491	1470	value="<?php
1492	1471	echo ( isset( $_REQUEST['detached'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['detached'] ) ) ) : '' );
1493		- // input var okay.
1494	1472	?>"/>
1495	1473	<input id="wpda_main_db_schema" type="hidden" name="wpda_main_db_schema"
1496	1474	value="<?php
1497	1475	echo ( isset( $_REQUEST['wpda_main_db_schema'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['wpda_main_db_schema'] ) ) ) : '' );
1498		- // input var okay.
1499	1476	?>"/>
1500	1477	<input id="wpda_main_favourites" type="hidden" name="wpda_main_favourites"
1501	1478	value="<?php
1502	1479	echo ( isset( $_REQUEST['wpda_main_favourites'] ) ? esc_attr( sanitize_text_field( wp_unslash( $_REQUEST['wpda_main_favourites'] ) ) ) : '' );
1503		- // input var okay.
1504	1480	?>"/>
1505	1481	<?php
1506	1482	wp_nonce_field( 'wpda-export-' . wp_json_encode( $this->table_name ), '_wpnonce', false );
1507	1483	?>
		@@ -1588,20 +1564,16 @@
1588	1564
1589	1565	/**
1590	1566	* Add button to page header
1591	1567	*
1592		- * By default "add new" and "import" buttons are added (depending on the settings). Overwrite this method to
	1568	+ * "Add new" button is added (depending on the settings). Overwrite this method to
1593	1569	* add your own buttons.
1594	1570	*
1595	1571	* @since 1.0.1
1596	1572	*/
1597	1573	protected function add_header_button() {
1598		- if ( 'off' === $this->allow_insert ) {
1599		- if ( null !== $this->wpda_import ) {
1600		- $this->wpda_import->add_button();
1601		- }
1602		- } else {
1603		- //phpcs:ignore - 8.1 proof
	1574	+ if ( 'off' !== $this->allow_insert ) {
	1575	+ // phpcs:ignore -- 8.1 proof
1604	1576	if ( WPDA::is_wpda_table( $this->table_name ) || ('on' === WPDA::get_option( WPDA::OPTION_BE_ALLOW_INSERT ) && count( $this->wpda_list_columns->get_table_primary_key() )) > 0 ) {
1605	1577	$storage_type = ( WPDA::is_wpda_table( $this->table_name ) ? __( 'respository', 'wp-data-access' ) : __( 'table', 'wp-data-access' ) );
1606	1578	// Prepare url.
1607	1579	if ( is_admin() ) {
		@@ -1630,30 +1602,20 @@
1630	1602	?>"/>
1631	1603	<input type="hidden" name="action" value="new">
1632	1604	<button type="submit" class="page-title-action wpda_tooltip"
1633	1605	title="<?php
1634		- echo sprintf( __( 'Add new %1$s to %2$s', 'wp-data-access' ), esc_attr( $this->_args['singular'] ), esc_attr( $storage_type ) );
	1606	+ /* translators: 1 = entiry name; 2: storage type */
	1607	+ echo esc_attr( sprintf( __( 'Add new %1$s to %2$s', 'wp-data-access' ), $this->_args['singular'], $storage_type ) );
1635	1608	?>"
1636	1609	>
1637	1610	<i class="fas fa-plus-circle wpda_icon_on_button"></i>
1638	1611	<?php
1639		- echo __( 'Add New', 'wp-data-access' );
	1612	+ echo esc_attr__( 'Add New', 'wp-data-access' );
1640	1613	?>
1641	1614	</button>
1642		- <?php
1643		- // Add import button to title.
1644		- if ( null !== $this->wpda_import ) {
1645		- $this->wpda_import->add_button();
1646		- }
1647		- ?>
1648	1615	</div>
1649	1616	</form>
1650	1617	<?php
1651		- } else {
1652		- // Add import button to title.
1653		- if ( null !== $this->wpda_import ) {
1654		- $this->wpda_import->add_button();
1655		- }
1656	1618	}
1657	1619	}
1658	1620	}
1659	1621
		@@ -1781,9 +1743,9 @@
1781	1743	case 'delete':
1782	1744	// Check access rights.
1783	1745	if ( 'on' !== $this->allow_delete ) {
1784	1746	// Deleting records from list table is not allowed.
1785		- wp_die( __( 'ERROR: Not authorized [delete not allowed]', 'wp-data-access' ) );
	1747	+ wp_die( esc_attr__( 'ERROR: Not authorized [delete not allowed]', 'wp-data-access' ) );
1786	1748	}
1787	1749	// Prepare wp_nonce action security check.
1788	1750	$wp_nonce_action = "wpda-delete-{$this->table_name}";
1789	1751	$row_to_be_deleted = array();
		@@ -1794,9 +1756,9 @@
1794	1756	foreach ( $this->wpda_list_columns->get_table_primary_key() as $key ) {
1795	1757	// Check if key is available.
1796	1758	if ( !isset( $_REQUEST[$key] ) ) {
1797	1759	// input var okay.
1798		- wp_die( __( 'ERROR: Invalid URL [missing primary key values]', 'wp-data-access' ) );
	1760	+ wp_die( esc_attr__( 'ERROR: Invalid URL [missing primary key values]', 'wp-data-access' ) );
1799	1761	}
1800	1762	// Write key value pair to array.
1801	1763	$row_to_be_deleted[$i]['key'] = $key;
1802	1764	$row_to_be_deleted[$i]['value'] = sanitize_text_field( wp_unslash( $_REQUEST[$key] ) );
		@@ -1809,15 +1771,15 @@
1809	1771	// Check if delete is allowed.
1810	1772	$wp_nonce = ( isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : '' );
1811	1773	// input var okay.
1812	1774	if ( !wp_verify_nonce( $wp_nonce, $wp_nonce_action ) ) {
1813		- wp_die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	1775	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
1814	1776	}
1815	1777	// All key column values available: delete record.
1816	1778	// Prepare named array for delete operation.
1817	1779	$next_row_to_be_deleted = array();
1818	1780	$count_rows = count( $row_to_be_deleted );
1819		- //phpcs:ignore - 8.1 proof
	1781	+ // phpcs:ignore -- 8.1 proof
1820	1782	for ($i = 0; $i < $count_rows; $i++) {
1821	1783	$next_row_to_be_deleted[$row_to_be_deleted[$i]['key']] = $row_to_be_deleted[$i]['value'];
1822	1784	}
1823	1785	$engine = WPDA::get_table_engine( $this->schema_name, $this->table_name );
		@@ -1838,9 +1800,9 @@
1838	1800	case 'bulk-delete':
1839	1801	// Check access rights.
1840	1802	if ( 'on' !== $this->allow_delete ) {
1841	1803	// Deleting records from list table is not allowed.
1842		- die( __( 'ERROR: Not authorized [delete not allowed]', 'wp-data-access' ) );
	1804	+ die( esc_attr__( 'ERROR: Not authorized [delete not allowed]', 'wp-data-access' ) );
1843	1805	}
1844	1806	// We first need to check if all the necessary information is available.
1845	1807	if ( !isset( $_REQUEST['bulk-selected'] ) ) {
1846	1808	// input var okay.
		@@ -1855,14 +1817,15 @@
1855	1817	$wp_nonce_action = "wpda-delete-{$this->table_name}";
1856	1818	$wp_nonce = ( isset( $_REQUEST['_wpnonce2'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce2'] ) ) : '' );
1857	1819	// input var okay.
1858	1820	if ( !wp_verify_nonce( $wp_nonce, $wp_nonce_action ) ) {
1859		- die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	1821	+ die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
1860	1822	}
	1823	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput
1861	1824	$bulk_rows = (array) $_REQUEST['bulk-selected'];
1862		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
	1825	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput
1863	1826	$no_rows = count( $bulk_rows );
1864		- // # rows to be deleted. //phpcs:ignore - 8.1 proof being safe
	1827	+ // # rows to be deleted. // phpcs:ignore -- 8.1 proof being safe
1865	1828	$rows_to_be_deleted = array();
1866	1829	// Gonna hold rows to be deleted.
1867	1830	for ($i = 0; $i < $no_rows; $i++) {
1868	1831	// Write "json" to named array. Need to strip slashes twice. Once for the normal conversion
		@@ -1874,9 +1837,9 @@
1874	1837	// Check all key columns.
1875	1838	foreach ( $this->wpda_list_columns->get_table_primary_key() as $key ) {
1876	1839	// Check if key is available.
1877	1840	if ( !isset( $row_object[$key] ) ) {
1878		- wp_die( __( 'ERROR: Invalid URL [missing primary key values]', 'wp-data-access' ) );
	1841	+ wp_die( esc_attr__( 'ERROR: Invalid URL [missing primary key values]', 'wp-data-access' ) );
1879	1842	}
1880	1843	// Write key value pair to array.
1881	1844	$rows_to_be_deleted[$i][$j]['key'] = $key;
1882	1845	$rows_to_be_deleted[$i][$j]['value'] = $row_object[$key];
		@@ -1885,9 +1848,9 @@
1885	1848	}
1886	1849	}
1887	1850	// Looks like everything is there. Delete records from table...
1888	1851	$no_key_cols = count( $this->wpda_list_columns->get_table_primary_key() );
1889		- //phpcs:ignore - 8.1 proof
	1852	+ // phpcs:ignore -- 8.1 proof
1890	1853	$rows_successfully_deleted = 0;
1891	1854	// Number of rows successfully deleted.
1892	1855	$rows_with_errors = 0;
1893	1856	// Number of rows that could not be deleted.
		@@ -1950,9 +1913,9 @@
1950	1913	// Check access rights.
1951	1914	if ( !WPDA::is_wpda_table( $this->table_name ) ) {
1952	1915	if ( 'on' !== WPDA::get_option( WPDA::OPTION_BE_EXPORT_ROWS ) ) {
1953	1916	// Exporting rows from list table is not allowed.
1954		- die( __( 'ERROR: Not authorized [export not allowed]', 'wp-data-access' ) );
	1917	+ die( esc_attr__( 'ERROR: Not authorized [export not allowed]', 'wp-data-access' ) );
1955	1918	}
1956	1919	}
1957	1920	// We first need to check if all the necessary information is available.
1958	1921	if ( !isset( $_REQUEST['bulk-selected'] ) ) {
		@@ -1967,14 +1930,15 @@
1967	1930	// Check if export is allowed.
1968	1931	$wp_nonce = ( isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : '' );
1969	1932	// input var okay.
1970	1933	if ( !wp_verify_nonce( $wp_nonce, 'wpda-export-' . wp_json_encode( $this->table_name ) ) ) {
1971		- die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	1934	+ die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
1972	1935	}
	1936	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput
1973	1937	$bulk_rows = (array) $_REQUEST['bulk-selected'];
1974		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
	1938	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput
1975	1939	$no_rows = count( $bulk_rows );
1976		- // # rows to be exported. //phpcs:ignore - 8.1 proof being safe
	1940	+ // # rows to be exported. // phpcs:ignore -- 8.1 proof being safe
1977	1941	$format_type = '';
1978	1942	switch ( $this->current_action() ) {
1979	1943	case 'bulk-export-xml':
1980	1944	$format_type = 'xml';
		@@ -2006,9 +1970,9 @@
2006	1970	// Check all key columns.
2007	1971	foreach ( $this->wpda_list_columns->get_table_primary_key() as $key ) {
2008	1972	// Check if key is available.
2009	1973	if ( !isset( $row_object[$key] ) ) {
2010		- wp_die( __( 'ERROR: Invalid URL', 'wp-data-access' ) );
	1974	+ wp_die( esc_attr__( 'ERROR: Invalid URL', 'wp-data-access' ) );
2011	1975	}
2012	1976	if ( !isset( $columns[$key] ) ) {
2013	1977	$columns[$key] = array();
2014	1978	}
		@@ -2064,11 +2028,13 @@
2064	2028	public function delete_row( $where, $engine = '' ) {
2065	2029	$wpdadb = WPDADB::get_db_connection( $this->schema_name );
2066	2030	if ( null === $wpdadb ) {
2067	2031	if ( is_admin() ) {
2068		- wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
	2032	+ /* translators: %s = remote database name */
	2033	+ wp_die( esc_attr( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), $this->schema_name ) ) );
2069	2034	} else {
2070		- die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
	2035	+ /* translators: %s = remote database name */
	2036	+ die( esc_attr( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), $this->schema_name ) ) );
2071	2037	}
2072	2038	}
2073	2039	$row_deleted = $wpdadb->delete( $this->table_name, $where );
2074	2040	if ( 'connect' === strtolower( $engine ) ) {
		@@ -2096,11 +2062,13 @@
2096	2062	// Get real row count.
2097	2063	$wpdadb = WPDADB::get_db_connection( $this->schema_name );
2098	2064	if ( null === $wpdadb ) {
2099	2065	if ( is_admin() ) {
2100		- wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
	2066	+ /* translators: %s = remote database name */
	2067	+ wp_die( esc_attr( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), $this->schema_name ) ) );
2101	2068	} else {
2102		- die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
	2069	+ /* translators: %s = remote database name */
	2070	+ die( esc_attr( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), $this->schema_name ) ) );
2103	2071	}
2104	2072	}
2105	2073	if ( '' === $this->schema_name ) {
2106	2074	$query = "\n\t\t\t\t\tselect count(*)\n\t\t\t\t\tfrom `{$this->table_name}`\n\t\t\t\t\t{$this->where}\n\t\t\t\t";
		@@ -2111,9 +2079,8 @@
2111	2079	$query = "\n\t\t\t\t\t\tselect count(*)\n\t\t\t\t\t\tfrom `{$wpdadb->dbname}`.`{$this->table_name}`\n\t\t\t\t\t\t{$this->where}\n\t\t\t\t\t";
2112	2080	}
2113	2081	}
2114	2082	return $wpdadb->get_var( $query );
2115		- // phpcs:ignore Standard.Category.SniffName.ErrorCode
2116	2083	}
2117	2084
2118	2085	/**
2119	2086	* Perform query to retrieve rows from database
		@@ -2128,11 +2095,13 @@
2128	2095	public function get_rows() {
2129	2096	$wpdadb = WPDADB::get_db_connection( $this->schema_name );
2130	2097	if ( null === $wpdadb ) {
2131	2098	if ( is_admin() ) {
2132		- wp_die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
	2099	+ /* translators: %s = remote database name */
	2100	+ wp_die( esc_attr( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), $this->schema_name ) ) );
2133	2101	} else {
2134		- die( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), esc_attr( $this->schema_name ) ) );
	2102	+ /* translators: %s = remote database name */
	2103	+ die( esc_attr( sprintf( __( 'ERROR - Remote database %s not available', 'wp-data-access' ), $this->schema_name ) ) );
2135	2104	}
2136	2105	}
2137	2106	// Selected columns cannot be changed by the user at this time. No check for SQL injection needed now.
2138	2107	// This might change in the future when users are allowed to change or set this value. A method named
		@@ -2186,9 +2155,8 @@
2186	2155	}
2187	2156	// Debug query.
2188	2157	// var_dump( $query );
2189	2158	$this->items = $wpdadb->get_results( $query, 'ARRAY_A' );
2190		- // phpcs:ignore Standard.Category.SniffName.ErrorCode
2191	2159	}
2192	2160
2193	2161	/**
2194	2162	* Get order by
		@@ -2197,12 +2165,10 @@
2197	2165	*/
2198	2166	protected function get_order_by() {
2199	2167	if ( !empty( $_REQUEST['orderby'] ) ) {
2200	2168	$orderby_arg = sanitize_sql_orderby( wp_unslash( $_REQUEST['orderby'] ) );
2201		- // input var okay.
2202	2169	if ( !empty( $_REQUEST['order'] ) ) {
2203	2170	$order_arg = sanitize_text_field( wp_unslash( $_REQUEST['order'] ) );
2204		- // input var okay.
2205	2171	} else {
2206	2172	$order_arg = '';
2207	2173	}
2208	2174	$columns = $this->get_sortable_columns();
		@@ -2208,9 +2174,9 @@
2208	2174	$columns = $this->get_sortable_columns();
2209	2175	// Check column name for SQL injection.
2210	2176	if ( isset( $columns[$orderby_arg] ) || $this->wpda_data_dictionary->column_exists( $orderby_arg ) ) {
2211	2177	// Column name exists in current table, safely continue...
2212		- $orderby = " order by {$orderby_arg}";
	2178	+ $orderby = ' order by `' . WPDA::remove_backticks( $orderby_arg ) . '`';
2213	2179	// Prevent SQL injection for order. If 'desc' is found result will be ordered desc. In all other
2214	2180	// cases we'll order asc.
2215	2181	$orderby .= ( strtolower( trim( $order_arg ) ) === 'desc' ? ' desc' : ' asc' );
2216	2182	return $orderby;
		@@ -2216,9 +2182,9 @@
2216	2182	return $orderby;
2217	2183	} else {
2218	2184	// The user provided a column name which is not in the table. Most probably the result of a
2219	2185	// SQL injection attack, so let's terminate.
2220		- wp_die( __( 'ERROR: Invalid URL [invalid column name]', 'wp-data-access' ) );
	2186	+ wp_die( esc_attr__( 'ERROR: Invalid URL [invalid column name]', 'wp-data-access' ) );
2221	2187	}
2222	2188	} else {
2223	2189	return '';
2224	2190	}
		@@ -2240,9 +2206,9 @@
2240	2206	// Tables has primary key: bulk actions allowed!
2241	2207	// Primary key is used to ensure uniqueness.
2242	2208	$actions = $this->get_bulk_actions();
2243	2209	if ( is_array( $actions ) && 0 < count( $actions ) ) {
2244		- //phpcs:ignore - 8.1 proof
	2210	+ // phpcs:ignore -- 8.1 proof
2245	2211	$columns = array(
2246	2212	'cb' => '<input type="checkbox" />',
2247	2213	);
2248	2214	}
		@@ -2392,10 +2358,12 @@
2392	2358	*/
2393	2359	protected function get_search_value() {
2394	2360	if ( 'off' === WPDA::get_option( WPDA::OPTION_BE_REMEMBER_SEARCH ) ) {
2395	2361	if ( isset( $_REQUEST[$this->search_item_name] ) ) {
2396		- return wp_filter_nohtml_kses( wp_unslash( $_REQUEST[$this->search_item_name] ) );
2397		- // input var okay.
	2362	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput
	2363	+ $value = wp_filter_nohtml_kses( wp_unslash( $_REQUEST[$this->search_item_name] ) );
	2364	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput
	2365	+ return $value;
2398	2366	}
2399	2367	}
2400	2368	if ( 'wpda_wpdp_' === substr( $this->page, 0, 10 ) ) {
2401	2369	$cookie_name = $this->page;
		@@ -2412,14 +2380,17 @@
2412	2380	} else {
2413	2381	$cookie_name = $this->page . '_search_' . str_replace( '.', '_', $this->table_name );
2414	2382	}
2415	2383	if ( isset( $_REQUEST[$this->search_item_name] ) && '' !== $_REQUEST[$this->search_item_name] ) {
2416		- // input var okay.
2417		- return wp_filter_nohtml_kses( wp_unslash( $_REQUEST[$this->search_item_name] ) );
2418		- // input var okay.
	2384	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput
	2385	+ $value = wp_filter_nohtml_kses( wp_unslash( $_REQUEST[$this->search_item_name] ) );
	2386	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput
	2387	+ return $value;
2419	2388	} elseif ( isset( $_COOKIE[$cookie_name] ) ) {
2420		- return wp_filter_nohtml_kses( wp_unslash( $_COOKIE[$cookie_name] ) );
2421		- // input var okay.
	2389	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput
	2390	+ $value = wp_filter_nohtml_kses( wp_unslash( $_COOKIE[$cookie_name] ) );
	2391	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput
	2392	+ return $value;
2422	2393	} else {
2423	2394	return null;
2424	2395	}
2425	2396	}
		@@ -2437,9 +2408,9 @@
2437	2408	* @staticvar $cb_counter int
2438	2409	*/
2439	2410	public function print_column_headers( $with_id = true ) {
2440	2411	list( $columns, $hidden, $sortable, $primary ) = $this->get_column_info();
2441		- //phpcs:ignore - 8.1 proof
	2412	+ // phpcs:ignore -- 8.1 proof
2442	2413	// *********************
2443	2414	// *** BEGIN CHANGES ***
2444	2415	// *********************
2445	2416	// Code removed.
		@@ -2447,14 +2418,12 @@
2447	2418	// *** END CHANGES ***
2448	2419	// *******************
2449	2420	if ( isset( $_REQUEST['orderby'] ) ) {
2450	2421	$current_orderby = sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) );
2451		- // input var okay.
2452	2422	} else {
2453	2423	$current_orderby = '';
2454	2424	}
2455	2425	if ( isset( $_REQUEST['order'] ) && 'desc' === $_REQUEST['order'] ) {
2456		- // input var okay.
2457	2426	$current_order = 'desc';
2458	2427	} else {
2459	2428	$current_order = 'asc';
2460	2429	}
		@@ -2459,15 +2428,15 @@
2459	2428	$current_order = 'asc';
2460	2429	}
2461	2430	if ( !empty( $columns['cb'] ) ) {
2462	2431	static $cb_counter = 1;
2463		- $columns['cb'] = '<label class="screen-reader-text" for="cb-select-all-' . $cb_counter . '">' . __( 'Select All' ) . '</label>' . '<input id="cb-select-all-' . $cb_counter . '" type="checkbox" />';
	2432	+ $columns['cb'] = '<label class="screen-reader-text" for="cb-select-all-' . $cb_counter . '">' . __( 'Select All', 'wp-data-access' ) . '</label>' . '<input id="cb-select-all-' . $cb_counter . '" type="checkbox" />';
2464	2433	$cb_counter++;
2465	2434	}
2466	2435	foreach ( $columns as $column_key => $column_display_name ) {
2467	2436	$class = array('manage-column', "column-{$column_key}");
2468	2437	if ( in_array( $column_key, (array) $hidden ) ) {
2469		- //phpcs:ignore - 8.1 proof
	2438	+ // phpcs:ignore -- 8.1 proof
2470	2439	$class[] = 'hidden';
2471	2440	}
2472	2441	if ( 'cb' === $column_key ) {
2473	2442	$class[] = 'check-column';
		@@ -2478,9 +2447,9 @@
2478	2447	$class[] = 'column-primary';
2479	2448	}
2480	2449	if ( isset( $sortable[$column_key] ) ) {
2481	2450	list( $orderby, $desc_first ) = (array) $sortable[$column_key];
2482		- //phpcs:ignore - 8.1 proof
	2451	+ // phpcs:ignore -- 8.1 proof
2483	2452	if ( $current_orderby === $orderby ) {
2484	2453	$order = ( 'asc' === $current_order ? 'desc' : 'asc' );
2485	2454	$class[] = 'sorted';
2486	2455	$class[] = $current_order;
		@@ -2617,8 +2586,11 @@
2617	2586	* Add full export to CSV and JSON buttons
2618	2587	* Needs to be granted in project page configuration
2619	2588	*/
2620	2589	protected function add_full_table_downloads() {
	2590	+ if ( !WPDA::current_user_is_admin() ) {
	2591	+ return;
	2592	+ }
2621	2593	}
2622	2594
2623	2595	// Override to add arguments to CSV and JSON full table exports.
2624	2596	protected function add_full_table_downloads_add_args() {
		@@ -2649,9 +2621,14 @@
2649	2621	}
2650	2622	// Add estimate character if row_count_estimate is enabled.
2651	2623	$estimate = ( $this->row_count_estimate['is_estimate'] ? '~' : '' );
2652	2624	/* translators: %s: number of items (2x) */
2653		- $output = '<span class="displaying-num">' . sprintf( _n( '%s item', '%s items', $total_items ), $estimate . number_format_i18n( $total_items ) ) . '</span>';
	2625	+ $output = '<span class="displaying-num">' . sprintf( _n(
	2626	+ '%s item',
	2627	+ '%s items',
	2628	+ $total_items,
	2629	+ 'wp-data-access'
	2630	+ ), $estimate . number_format_i18n( $total_items ) ) . '</span>';
2654	2631	$current = $this->get_pagenum();
2655	2632	if ( $this->search_value !== $this->search_value_old ) {
2656	2633	$current = 1;
2657	2634	}
		@@ -2696,9 +2673,9 @@
2696	2673	$page_links[] = sprintf(
2697	2674	$link_with_post_support,
2698	2675	'first-page button',
2699	2676	'',
2700		- __( 'First page' ),
	2677	+ __( 'First page', 'wp-data-access' ),
2701	2678	'&laquo;'
2702	2679	);
2703	2680	// *******************
2704	2681	// *** END CHANGES ***
		@@ -2713,9 +2690,9 @@
2713	2690	$page_links[] = sprintf(
2714	2691	$link_with_post_support,
2715	2692	'prev-page button',
2716	2693	max( 1, $current - 1 ),
2717		- __( 'Previous page' ),
	2694	+ __( 'Previous page', 'wp-data-access' ),
2718	2695	'&lsaquo;'
2719	2696	);
2720	2697	// *******************
2721	2698	// *** END CHANGES ***
		@@ -2722,13 +2699,13 @@
2722	2699	// *******************
2723	2700	}
2724	2701	if ( 'bottom' === $which ) {
2725	2702	$html_current_page = $current;
2726		- $total_pages_before = '<span class="screen-reader-text">' . __( 'Current Page' ) . '</span><span id="table-paging" class="paging-input"><span class="tablenav-paging-text">';
	2703	+ $total_pages_before = '<span class="screen-reader-text">' . __( 'Current Page', 'wp-data-access' ) . '</span><span id="table-paging" class="paging-input"><span class="tablenav-paging-text">';
2727	2704	} else {
2728	2705	$html_current_page = sprintf(
2729	2706	"%s<input class='current-page' id='current-page-selector' type='text' name='paged' value='%s' size='%d' aria-describedby='table-paging' /><span class='tablenav-paging-text'>",
2730		- '<label for="current-page-selector" class="screen-reader-text">' . __( 'Current Page' ) . '</label>',
	2707	+ '<label for="current-page-selector" class="screen-reader-text">' . __( 'Current Page', 'wp-data-access' ) . '</label>',
2731	2708	$current,
2732	2709	strlen( (string) $total_pages )
2733	2710	);
2734	2711	}
		@@ -2733,9 +2710,9 @@
2733	2710	);
2734	2711	}
2735	2712	$html_total_pages = sprintf( "<span class='total-pages'>%s</span>", number_format_i18n( $total_pages ) );
2736	2713	/* translators: %s: current page/total pages */
2737		- $page_links[] = $total_pages_before . sprintf( _x( '%1$s of %2$s', 'paging' ), $html_current_page, $html_total_pages ) . $total_pages_after;
	2714	+ $page_links[] = $total_pages_before . sprintf( _x( '%1$s of %2$s', 'paging', 'wp-data-access' ), $html_current_page, $html_total_pages ) . $total_pages_after;
2738	2715	if ( $disable_next ) {
2739	2716	$page_links[] = '<span class="tablenav-pages-navspan button disabled" aria-hidden="true">&rsaquo;</span>';
2740	2717	} else {
2741	2718	// *********************
		@@ -2744,9 +2721,9 @@
2744	2721	$page_links[] = sprintf(
2745	2722	$link_with_post_support,
2746	2723	'next-page button',
2747	2724	min( $total_pages, $current + 1 ),
2748		- __( 'Next page' ),
	2725	+ __( 'Next page', 'wp-data-access' ),
2749	2726	'&rsaquo;'
2750	2727	);
2751	2728	// *******************
2752	2729	// *** END CHANGES ***
		@@ -2761,9 +2738,9 @@
2761	2738	$page_links[] = sprintf(
2762	2739	$link_with_post_support,
2763	2740	'last-page button',
2764	2741	$total_pages,
2765		- __( 'Last page' ),
	2742	+ __( 'Last page', 'wp-data-access' ),
2766	2743	'&raquo;'
2767	2744	);
2768	2745	// *******************
2769	2746	// *** END CHANGES ***
		@@ -2779,9 +2756,12 @@
2779	2756	} else {
2780	2757	$page_class = ' no-pages';
2781	2758	}
2782	2759	$this->_pagination = "<div class='tablenav-pages{$page_class}'>{$output}</div>";
	2760	+ // phpcs:disable WordPress.Security.EscapeOutput
2783	2761	echo $this->_pagination;
2784		- // phpcs:ignore WordPress.Security.EscapeOutput
	2762	+ // phpcs:enable WordPress.Security.EscapeOutput
2785	2763	}
2786	2764
2787	2765	}
	2766	+
	2767	+// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing