← All changes | WPDataAccess/Simple_Form/WPDA_Simple_Form.php +45 -33 5.5.76 → 5.5.85 View file →

		@@ -4,8 +4,9 @@
4	4	* Suppress "error - 0 - No summary was found for this file" on phpdoc generation
5	5	*
6	6	* @package WPDataAccess\Simple_Form
7	7	*/
	8	+// phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- verified on page
8	9	namespace WPDataAccess\Simple_Form;
9	10
10	11	use WPDataAccess\Data_Dictionary\WPDA_List_Columns;
11	12	use WPDataAccess\Plugin_Table_Models\WPDA_Media_Model;
		@@ -346,9 +347,9 @@
346	347	if ( isset( $_REQUEST['page'] ) ) {
347	348	$this->page = sanitize_text_field( wp_unslash( $_REQUEST['page'] ) );
348	349	// input var okay.
349	350	} else {
350		- wp_die( __( 'ERROR: Wrong arguments [missing page argument]', 'wp-data-access' ) );
	351	+ wp_die( esc_attr__( 'ERROR: Wrong arguments [missing page argument]', 'wp-data-access' ) );
351	352	}
352	353	if ( isset( $_REQUEST['action'] ) ) {
353	354	// Possible values: "new", "edit" and "view".
354	355	$this->action = sanitize_text_field( wp_unslash( $_REQUEST['action'] ) );
		@@ -356,9 +357,9 @@
356	357	} else {
357	358	if ( isset( $args['action'] ) ) {
358	359	$this->action = $args['action'];
359	360	} else {
360		- wp_die( __( 'ERROR: Wrong arguments [missing action argument]', 'wp-data-access' ) );
	361	+ wp_die( esc_attr__( 'ERROR: Wrong arguments [missing action argument]', 'wp-data-access' ) );
361	362	}
362	363	}
363	364	if ( isset( $_REQUEST['action2'] ) ) {
364	365	$this->action2 = sanitize_text_field( wp_unslash( $_REQUEST['action2'] ) );
		@@ -367,23 +368,23 @@
367	368	$this->schema_name = $schema_name;
368	369	$this->table_name = $table_name;
369	370	if ( '' === $this->table_name ) {
370	371	// Without a table name it makes no sense to continue.
371		- wp_die( __( 'ERROR: Wrong arguments [missing table_name argument]' ) );
	372	+ wp_die( esc_attr__( 'ERROR: Wrong arguments [missing table_name argument]', 'wp-data-access' ) );
372	373	}
373	374	if ( !WPDA::is_wpda_table( $this->table_name ) ) {
374	375	// Check access rights for tables that do not belong to the plugin.
375	376	if ( 'on' !== WPDA::get_option( WPDA::OPTION_BE_ALLOW_INSERT ) && 'new' === $this->action ) {
376	377	// Insert not allowed.
377		- wp_die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	378	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
378	379	}
379	380	if ( 'on' !== WPDA::get_option( WPDA::OPTION_BE_VIEW_LINK ) && 'view' === $this->action ) {
380	381	// Viewing not allowed.
381		- wp_die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	382	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
382	383	}
383	384	if ( 'on' !== WPDA::get_option( WPDA::OPTION_BE_ALLOW_UPDATE ) && 'edit' === $this->action ) {
384	385	// Update not allowed.
385		- wp_die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	386	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
386	387	}
387	388	}
388	389	// Get columns information.
389	390	$this->wpda_list_columns = $wpda_list_columns;
		@@ -463,10 +464,11 @@
463	464	}
464	465	// Add search arguments to link to return to same page
465	466	foreach ( $_REQUEST as $key => $value ) {
466	467	if ( substr( $key, 0, 19 ) === 'wpda_search_column_' ) {
467		- $this->page_number_link .= "&{$key}={$value}";
468		- $this->page_number_item .= "<input type='hidden' name='{$key}' value='{$value}' />";
	468	+ $esc_attr = 'esc_attr';
	469	+ $this->page_number_link .= "&{$esc_attr( $key )}={$esc_attr( $value )}";
	470	+ $this->page_number_item .= "<input type='hidden' name='{$esc_attr( $key )}' value='{$esc_attr( $value )}' />";
469	471	}
470	472	}
471	473	// Check if button text "back to list" should be changed
472	474	if ( isset( $args['back_to_list_text'] ) && '' !== $args['back_to_list_text'] ) {
		@@ -497,18 +499,17 @@
497	499	* @since 1.5.0
498	500	*/
499	501	protected function get_url_arguments() {
500	502	// Get OLD and NEW values for all items.
	503	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
501	504	foreach ( $this->wpda_list_columns->get_table_columns() as $column ) {
502	505	if ( isset( $_REQUEST[$column['column_name'] . '_old'] ) ) {
503	506	$this->form_items_old_values[$column['column_name']] = wp_unslash( $_REQUEST[$column['column_name'] . '_old'] );
504		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
505	507	}
506	508	if ( isset( $_REQUEST[$column['column_name']] ) ) {
507	509	if ( is_array( $_REQUEST[$column['column_name']] ) ) {
508	510	$column_array = '';
509	511	foreach ( $_REQUEST[$column['column_name']] as $column_value ) {
510		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
511	512	$column_array .= wp_unslash( $column_value ) . ',';
512	513	}
513	514	if ( '' !== $column_array ) {
514	515	$this->form_items_new_values[$column['column_name']] = substr( $column_array, 0, strlen( $column_array ) - 1 );
		@@ -514,12 +515,12 @@
514	515	$this->form_items_new_values[$column['column_name']] = substr( $column_array, 0, strlen( $column_array ) - 1 );
515	516	}
516	517	} else {
517	518	$this->form_items_new_values[$column['column_name']] = wp_unslash( $_REQUEST[$column['column_name']] );
518		- // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
519	519	}
520	520	}
521	521	}
	522	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash
522	523	}
523	524
524	525	/**
525	526	* Prepare form items and handle transactions
		@@ -537,11 +538,15 @@
537	538	// Security check (is action allowed?).
538	539	$wp_nonce = ( isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : '' );
539	540	// input var okay.
540	541	if ( !wp_verify_nonce( $wp_nonce, $this->get_nonce_action() ) ) {
541		- wp_die( __( 'ERROR: Not authorized', 'wp-data-access' ) );
	542	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
542	543	}
543	544	if ( 'new' === $this->action ) {
	545	+ global $wpda_project_mode;
	546	+ if ( 'on' !== WPDA::get_option( WPDA::OPTION_BE_ALLOW_INSERT ) || isset( $wpda_project_mode['allow_insert'] ) && ('off' === $wpda_project_mode['allow_insert'] || 'only' === $wpda_project_mode['allow_insert']) ) {
	547	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
	548	+ }
544	549	// Prepare row and items for validation
545	550	$this->row = $this->row_data->new_row();
546	551	$this->prepare_items( true );
547	552	// Save new record.
		@@ -567,8 +572,12 @@
567	572	$set_back_form_values = true;
568	573	}
569	574	}
570	575	} else {
	576	+ global $wpda_project_mode;
	577	+ if ( 'on' !== WPDA::get_option( WPDA::OPTION_BE_ALLOW_UPDATE ) && (isset( $wpda_project_mode['mode'] ) && 'edit' === $wpda_project_mode['mode']) ) {
	578	+ wp_die( esc_attr__( 'ERROR: Not authorized', 'wp-data-access' ) );
	579	+ }
571	580	// Prepare row and items for validation
572	581	$this->row = $this->row_data->get_row( $this->auto_increment_value, $this->wpda_err );
573	582	$this->prepare_items( true );
574	583	// Update existing record.
		@@ -694,9 +703,8 @@
694	703	<?php
695	704	if ( substr( $this->page, 0, 13 ) === \WP_Data_Access_Admin::PAGE_EXPLORER || !is_admin() ) {
696	705	// Button is available on web pages only
697	706	if ( 'view' !== $this->action && !$this->hide_add_new ) {
698		- //phpcs:ignore - 8.1 proof
699	707	if ( WPDA::is_wpda_table( $this->table_name ) || ('on' === WPDA::get_option( WPDA::OPTION_BE_ALLOW_INSERT ) && count( $this->wpda_list_columns->get_table_primary_key() )) > 0 ) {
700	708	$title = __( 'Add new row to table', 'wp-data-access' );
701	709	?>
702	710	<form
		@@ -727,9 +735,9 @@
727	735	?>"
728	736	>
729	737	<i class="fas fa-plus-circle wpda_icon_on_button"></i>
730	738	<?php
731		- echo __( 'Add New', 'wp-data-access' );
	739	+ esc_html_e( 'Add New', 'wp-data-access' );
732	740	?>
733	741	</button>
734	742	</div>
735	743	</form>
		@@ -772,9 +780,11 @@
772	780	} else {
773	781	$id = '';
774	782	}
775	783	$expandable = ( isset( $fieldset['expandable'] ) && true === $fieldset['expandable'] ? true : false );
	784	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput.MissingUnslash
776	785	$expandable_state = ( isset( $_REQUEST["wpda_fieldset_expand_{$id}"] ) ? sanitize_text_field( $_REQUEST["wpda_fieldset_expand_{$id}"] ) : 'off' );
	786	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput.MissingUnslash
777	787	$expandable_icons = ( 'on' === $expandable_state ? 'minus-circle' : 'plus-circle' );
778	788	?>
779	789	<fieldset class="wpda_fieldset">
780	790	<?php
		@@ -807,9 +817,8 @@
807	817	cellpadding="0"
808	818	>
809	819	<?php
810	820	$fieldset_columns = array_flip( $fieldset['fields'] );
811		- //phpcs:ignore - 8.1 proof
812	821	foreach ( $this->form_items as $item ) {
813	822	if ( isset( $fieldset_columns[$item->get_item_name()] ) ) {
814	823	$item->show( $this->action, $this->update_keys_allowed );
815	824	$js_code .= $item->get_item_js();
		@@ -857,11 +866,12 @@
857	866	}
858	867	?>
859	868	<?php
860	869	$this->add_parent_args();
	870	+ // phpcs:disable WordPress.Security.EscapeOutput
861	871	echo $this->page_number_item;
862		- // phpcs:ignore WordPress.Security.EscapeOutput
863	872	echo $this->add_case_sensitive_search();
	873	+ // phpcs:enable WordPress.Security.EscapeOutput
864	874	wp_nonce_field( $this->get_nonce_action( false ), '_wpnonce', false );
865	875	?>
866	876	<?php
867	877	if ( 'view' !== $this->action ) {
		@@ -871,9 +881,9 @@
871	881	name="submit_button"
872	882	onclick="return submit_form(event)">
873	883	<i class="fas fa-check wpda_icon_on_button"></i>
874	884	<?php
875		- echo __( 'Submit', 'wp-data-access' );
	885	+ esc_html_e( 'Submit', 'wp-data-access' );
876	886	?>
877	887	</button>
878	888	<?php
879	889	if ( $this->show_back_button && $this->show_back_icon ) {
		@@ -883,9 +893,9 @@
883	893	name="submit_button"
884	894	onclick="return submit_form(event)">
885	895	<i class="fas fa-check wpda_icon_on_button"></i>
886	896	<?php
887		- echo __( 'Submit', 'wp-data-access' );
	897	+ esc_html_e( 'Submit', 'wp-data-access' );
888	898	?>
889	899	<i class="fas fa-angle-right wpda_icon_on_button"></i>
890	900	<?php
891	901	echo esc_attr( $this->back_to_list_text );
		@@ -939,11 +949,12 @@
939	949	echo esc_attr( $url_back );
940	950	?>">
941	951	<?php
942	952	$this->add_parent_args();
	953	+ // phpcs:disable WordPress.Security.EscapeOutput
943	954	echo $this->page_number_item;
944		- // phpcs:ignore WordPress.Security.EscapeOutput
945	955	echo $this->add_case_sensitive_search();
	956	+ // phpcs:enable WordPress.Security.EscapeOutput
946	957	?>
947	958	<?php
948	959	if ( is_admin() ) {
949	960	// Hide schema and table name on front-end
		@@ -996,11 +1007,11 @@
996	1007	if (jQuery(obj).val() === '') {
997	1008	objData = jQuery(obj).data();
998	1009	if (objData.dbIsNull===undefined || objData.dbIsNull!==false) {
999	1010	alert(<?php
1000		- echo __( '\'Item\'', 'wp-data-access' );
1001		- ?> +' ' + jQuery(obj).attr('name') + ' ' + <?php
1002		- echo __( '\'must be entered\'', 'wp-data-access' );
	1011	+ echo "'" . esc_attr__( 'Item', 'wp-data-access' ) . "'";
	1012	+ ?> + ' ' + jQuery(obj).attr('name') + ' ' + <?php
	1013	+ echo "'" . esc_attr__( 'must be entered', 'wp-data-access' ) . "'";
1003	1014	?>);
1004	1015	failed = true;
1005	1016	} else {
1006	1017	element_old = jQuery("input[name=" + jQuery(obj).attr("name") + "_old" + "]");
		@@ -1005,11 +1016,11 @@
1005	1016	} else {
1006	1017	element_old = jQuery("input[name=" + jQuery(obj).attr("name") + "_old" + "]");
1007	1018	if (element_old && element_old.val()!=='') {
1008	1019	alert(<?php
1009		- echo __( '\'Item\'', 'wp-data-access' );
	1020	+ echo "'" . esc_attr__( 'Item', 'wp-data-access' ) . "'";
1010	1021	?> +' ' + jQuery(obj).attr('name') + ' ' + <?php
1011		- echo __( '\'must be entered\'', 'wp-data-access' );
	1022	+ echo "'" . esc_attr__( 'must be entered', 'wp-data-access' ) . "'";
1012	1023	?>);
1013	1024	failed = true;
1014	1025	}
1015	1026	}
		@@ -1016,11 +1027,11 @@
1016	1027	}
1017	1028	});
1018	1029	jQuery('.wpda_input_error').each(function(i, obj) {
1019	1030	alert(<?php
1020		- echo __( '\'Column\'', 'wp-data-access' );
1021		- ?> +' ' + jQuery(obj).attr('name') + <?php
1022		- echo __( '\': max size exceeded\'', 'wp-data-access' );
	1031	+ echo "'" . esc_attr__( 'Column', 'wp-data-access' ) . "'";
	1032	+ ?> + ' ' + jQuery(obj).attr('name') + <?php
	1033	+ echo "'" . esc_attr__( ': max size exceeded', 'wp-data-access' ) . "'";
1023	1034	?>);
1024	1035	failed = true;
1025	1036	});
1026	1037	jQuery('.wpda_hyperlink').each(function(i, obj) {
		@@ -1086,9 +1097,9 @@
1086	1097	if (isNaN(this.value) || (numberFormat[0]!='' && this.value.length>numberFormat[0])) {
1087	1098	jQuery(this).addClass('wpda_input_error');
1088	1099	if (this.value.length>numberFormat[0]) {
1089	1100	jQuery.notify('<?php
1090		- echo __( 'Max size exceeded' );
	1101	+ esc_html_e( 'Max size exceeded', 'wp-data-access' );
1091	1102	?>','error');
1092	1103	}
1093	1104	} else {
1094	1105	jQuery(this).removeClass('wpda_input_error');
		@@ -1101,9 +1112,9 @@
1101	1112	if (isNaN(this.value) || this.value>=maxNumber) {
1102	1113	jQuery(this).addClass('wpda_input_error');
1103	1114	if (this.value>=maxNumber) {
1104	1115	jQuery.notify('<?php
1105		- echo __( 'Max size exceeded' );
	1116	+ esc_html_e( 'Max size exceeded', 'wp-data-access' );
1106	1117	?>','error');
1107	1118	}
1108	1119	} else {
1109	1120	jQuery(this).removeClass('wpda_input_error');
		@@ -1114,9 +1125,9 @@
1114	1125	}
1115	1126	if (currentNumber.length===2 && currentNumber[1].length>numberFormat[1]) {
1116	1127	jQuery(this).addClass('wpda_input_error');
1117	1128	jQuery.notify('<?php
1118		- echo __( 'Max size exceeded' );
	1129	+ esc_html_e( 'Max size exceeded', 'wp-data-access' );
1119	1130	?>','error');
1120	1131	}
1121	1132	});
1122	1133	jQuery( '.wpda_tooltip' ).tooltip();
		@@ -1128,10 +1139,11 @@
1128	1139	jQuery("#wpda_new_row").submit();
1129	1140	});
1130	1141	});
1131	1142	<?php
	1143	+ // phpcs:disable WordPress.Security.EscapeOutput
1132	1144	echo $js_code;
1133		- // phpcs:ignore WordPress.Security.EscapeOutput
	1145	+ // phpcs:enable WordPress.Security.EscapeOutput
1134	1146	?>
1135	1147	</script>
1136	1148	<?php
1137	1149	}
		@@ -1263,9 +1275,8 @@
1263	1275	* @since 1.0.0
1264	1276	*/
1265	1277	protected function prepare_items( $set_back_form_values = false ) {
1266	1278	$count_cols = count( $this->table_columns );
1267		- //phpcs:ignore - 8.1 proof
1268	1279	for ($i = 0; $i < $count_cols; $i++) {
1269	1280	$column_name = $this->table_columns[$i]['column_name'];
1270	1281	$item_enum = '';
1271	1282	if ( 'enum' === $this->table_columns[$i]['data_type'] || 'set' === $this->table_columns[$i]['data_type'] ) {
		@@ -1514,9 +1525,8 @@
1514	1525	if ( !is_array( $column_array ) ) {
1515	1526	return -1;
1516	1527	}
1517	1528	$count_cols = count( $column_array );
1518		- //phpcs:ignore - 8.1 proof
1519	1529	for ($i = 0; $i < $count_cols; $i++) {
1520	1530	if ( $column_array[$i]['column_name'] === $column_name ) {
1521	1531	return $i;
1522	1532	}
		@@ -1633,4 +1643,6 @@
1633	1643	return $this->row;
1634	1644	}
1635	1645
1636	1646	}
	1647	+
	1648	+// phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing