← All changes | WPDataAccess/Data_Tables/WPDA_Data_Tables.php +58 -23 5.5.77 → 5.5.85 View file →

		@@ -8,8 +8,9 @@
8	8	// phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- verified on page
9	9	namespace WPDataAccess\Data_Tables;
10	10
11	11	use stdClass;
	12	+use WPDataAccess\API\WPDA_Apps;
12	13	use WPDataAccess\Connection\WPDADB;
13	14	use WPDataAccess\Data_Dictionary\WPDA_Dictionary_Exist;
14	15	use WPDataAccess\Data_Dictionary\WPDA_List_Columns_Cache;
15	16	use WPDataAccess\Macro\WPDA_Macro;
		@@ -19,11 +20,8 @@
19	20	use WPDataAccess\List_Table\WPDA_List_Table;
20	21	use WPDataAccess\Premium\WPDAPRO_Data_Publisher\WPDAPRO_Data_Publisher_Manage_Styles;
21	22	use WPDataAccess\Premium\WPDAPRO_Geo_Location\WPDAPRO_Geo_Location_WS;
22	23	use WPDataAccess\Settings\WPDA_Settings_Legacy_DataTables;
23		-use WPDataAccess\Templates\WPDAPRO_Template_Data_Publisher_Color;
24		-use WPDataAccess\Templates\WPDAPRO_Template_Data_Publisher_Space;
25		-use WPDataAccess\Templates\WPDA_Template_Data_Publisher_Corner;
26	24	use WPDataAccess\WPDA;
27	25	/**
28	26	* Class WPDA_Data_Tables
29	27	*
		@@ -30,10 +28,8 @@
30	28	* @author Peter Schulz
31	29	* @since 1.0.0
32	30	*/
33	31	class WPDA_Data_Tables {
34		- const METHODS = array('httpGet', 'httpPost', 'httpRequest');
35		-
36	32	protected static $pub_ids = array();
37	33
38	34	protected $pub_id_seq = '';
39	35
		@@ -390,8 +386,9 @@
390	386	return $use_buttons_extension;
391	387	}
392	388
393	389	protected function get_geolocation_settings() {
	390	+ return null;
394	391	}
395	392
396	393	protected function get_columns( $column_names ) {
397	394	if ( '*' === $column_names ) {
		@@ -476,8 +473,9 @@
476	473	return ( isset( $this->json->wpda_button_caption ) && null !== $this->json->wpda_button_caption ? $this->json->wpda_button_caption : 'label' );
477	474	}
478	475
479	476	protected function add_export_button( $button_type, $icon, $hint ) {
	477	+ return null;
480	478	}
481	479
482	480	protected function add_geolocation(
483	481	$geolocation,
		@@ -547,9 +545,9 @@
547	545	* @param array $hyperlinks Hyperlinks defined in column settings.
548	546	* @param string $header2 Adds an extra header row if TRUE.
549	547	* @param mixed $geolocation
550	548	*
551		- * @return HTML output
	549	+ * @return string output
552	550	*/
553	551	protected function show_header(
554	552	$responsive,
555	553	$responsive_cols,
		@@ -729,26 +727,56 @@
729	727	wp_die();
730	728	// Remote database not available
731	729	}
732	730	// Add field filters from shortcode
733		- // phpcs:disable WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
734		- $filter_field_name = str_replace( '`', '', sanitize_text_field( wp_unslash( $_REQUEST['filter_field_name'] ) ) );
735		- $filter_field_value = sanitize_text_field( wp_unslash( $_REQUEST['filter_field_value'] ) );
736		- // phpcs:enable WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.InputNotValidated
	731	+ $filter_field_name = '';
	732	+ $filter_field_value = '';
	733	+ if ( isset( $_REQUEST['filter_field_name'], $_REQUEST['filter_field_value'] ) ) {
	734	+ // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	735	+ $filter_field_name_raw = wp_unslash( $_REQUEST['filter_field_name'] );
	736	+ $filter_field_value_raw = wp_unslash( $_REQUEST['filter_field_value'] );
	737	+ // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	738	+ if ( is_string( $filter_field_name_raw ) && is_string( $filter_field_value_raw ) ) {
	739	+ $filter_field_name = sanitize_text_field( $filter_field_name_raw );
	740	+ $filter_field_value = sanitize_text_field( $filter_field_value_raw );
	741	+ }
	742	+ }
737	743	if ( '' !== $filter_field_name && '' !== $filter_field_value ) {
	744	+ if ( '*' === $columns ) {
	745	+ $allowed_columns = array();
	746	+ $tbl = WPDA_List_Columns_Cache::get_list_columns( $database, $table_name );
	747	+ $cols = $tbl->get_table_columns();
	748	+ foreach ( $cols as $col ) {
	749	+ if ( isset( $col['column_name'] ) ) {
	750	+ $allowed_columns[] = $col['column_name'];
	751	+ }
	752	+ }
	753	+ } else {
	754	+ $allowed_columns = explode( ',', $columns );
	755	+ }
738	756	$filter_field_name_array = array_map( 'trim', explode( ',', $filter_field_name ) );
739	757	$filter_field_value_array = array_map( 'trim', explode( ',', $filter_field_value ) );
740	758	if ( count( $filter_field_name_array ) === count( $filter_field_value_array ) ) {
741		- // Add filter to where clause
	759	+ $prepare_fields = array();
	760	+ $prepare_values = array();
742	761	for ($i = 0; $i < count( $filter_field_name_array ); $i++) {
	762	+ $field_name = $filter_field_name_array[$i];
	763	+ $field_value = $filter_field_value_array[$i];
	764	+ if ( !in_array( $field_name, $allowed_columns, true ) ) {
	765	+ continue;
	766	+ }
	767	+ $prepare_fields[] = $field_name;
	768	+ $prepare_values[] = $field_value;
	769	+ }
	770	+ for ($i = 0; $i < count( $prepare_fields ); $i++) {
743	771	if ( '' === $where ) {
744		- $where = $wpdadb->prepare( " where `{$filter_field_name_array[$i]}` like %s ", array($filter_field_value_array[$i]) );
	772	+ $where = $wpdadb->prepare( ' WHERE %i LIKE %s ', array($prepare_fields[$i], $prepare_values[$i]) );
745	773	} else {
746		- $where .= $wpdadb->prepare( " and `{$filter_field_name_array[$i]}` like %s ", array($filter_field_value_array[$i]) );
	774	+ $where .= $wpdadb->prepare( ' AND %i LIKE %s ', array($prepare_fields[$i], $prepare_values[$i]) );
747	775	}
748		- $_filter['filter_field_name'] = $filter_field_name;
749		- $_filter['filter_field_value'] = $filter_field_value;
750	776	}
	777	+ $_filter['filter_field_name'] = $filter_field_name;
	778	+ $_filter['filter_field_value'] = $filter_field_value;
751	779	}
752	780	}
753	781	// Get all column names from table (must be comma separated string)
754	782	$this->wpda_list_columns = WPDA_List_Columns_Cache::get_list_columns( $database, $table_name );
		@@ -987,9 +1015,10 @@
987	1015	}
988	1016	$wpdadb->suppress_errors( true );
989	1017	$rows = $wpdadb->get_results( $query, 'ARRAY_N' );
990	1018	if ( '' !== $wpdadb->last_error ) {
991		- $this->create_empty_response( $wpdadb->last_error, $query );
	1019	+ $this->create_empty_response( __( 'ERROR: Invalid query', 'wp-data-access' ) );
	1020	+ WPDA::wpda_log_wp_error( $wpdadb->last_error );
992	1021	wp_die();
993	1022	}
994	1023	$rows_final = array();
995	1024	foreach ( $rows as $row ) {
		@@ -1065,11 +1094,11 @@
1065	1094	if ( 'json' === $hyperlink_definition ) {
1066	1095	$hyperlink = json_decode( (string) $row[$hyperlinks_array[$i]], true );
1067	1096	if ( is_array( $hyperlink ) && isset( $hyperlink['label'] ) && isset( $hyperlink['url'] ) && isset( $hyperlink['target'] ) ) {
1068	1097	if ( '' === $hyperlink['url'] ) {
1069		- $row[$hyperlinks_array[$i]] = $hyperlink['label'];
	1098	+ $row[$hyperlinks_array[$i]] = esc_attr( $hyperlink['label'] );
1070	1099	} else {
1071		- $row[$hyperlinks_array[$i]] = "<a href='{$hyperlink['url']}' target='{$hyperlink['target']}'>{$hyperlink['label']}</a>";
	1100	+ $row[$hyperlinks_array[$i]] = "<a href='" . esc_url_raw( $hyperlink['url'] ) . "' target='" . esc_attr( $hyperlink['target'] ) . "'>" . esc_attr( $hyperlink['label'] ) . "</a>";
1072	1101	}
1073	1102	} else {
1074	1103	$row[$hyperlinks_array[$i]] = '';
1075	1104	}
		@@ -1074,10 +1103,10 @@
1074	1103	$row[$hyperlinks_array[$i]] = '';
1075	1104	}
1076	1105	} else {
1077	1106	if ( null !== $row[$hyperlinks_array[$i]] && '' !== $row[$hyperlinks_array[$i]] ) {
1078		- $hyperlink_label = $this->wpda_list_columns->get_column_label( $hyperlinks_array_col[$i] );
1079		- $row[$hyperlinks_array[$i]] = "<a href='{$row[$hyperlinks_array[$i]]}' target='_blank'>{$hyperlink_label}</a>";
	1107	+ $hyperlink_label = esc_attr( $this->wpda_list_columns->get_column_label( $hyperlinks_array_col[$i] ) );
	1108	+ $row[$hyperlinks_array[$i]] = "<a href='" . esc_url_raw( $row[$hyperlinks_array[$i]] ) . "' target='_blank'>" . esc_attr( $hyperlink_label ) . "</a>";
1080	1109	} else {
1081	1110	$row[$hyperlinks_array[$i]] = '';
1082	1111	}
1083	1112	}
		@@ -1091,9 +1120,9 @@
1091	1120	$url = wp_get_attachment_url( esc_attr( $media_id ) );
1092	1121	if ( false !== $url ) {
1093	1122	$title = get_the_title( esc_attr( $media_id ) );
1094	1123	if ( false !== $url ) {
1095		- $media_links .= '<div class="wpda_tooltip" title="' . $title . '">' . do_shortcode( '[audio src="' . $url . '"]' ) . '</div>';
	1124	+ $media_links .= '<div class="wpda_tooltip" title="' . esc_attr( $title ) . '">' . do_shortcode( '[audio src="' . esc_url_raw( $url ) . '"]' ) . '</div>';
1096	1125	}
1097	1126	}
1098	1127	}
1099	1128	}
		@@ -1106,9 +1135,9 @@
1106	1135	if ( 'video' === substr( get_post_mime_type( $media_id ), 0, 5 ) ) {
1107	1136	$url = wp_get_attachment_url( esc_attr( $media_id ) );
1108	1137	if ( false !== $url ) {
1109	1138	if ( false !== $url ) {
1110		- $media_links .= do_shortcode( '[video src="' . $url . '"]' );
	1139	+ $media_links .= do_shortcode( '[video src="' . esc_url_raw( $url ) . '"]' );
1111	1140	}
1112	1141	}
1113	1142	}
1114	1143	}
		@@ -1196,10 +1225,12 @@
1196	1225	$obj->draw = ( isset( $_REQUEST['draw'] ) ? intval( $_REQUEST['draw'] ) : 0 );
1197	1226	$obj->recordsTotal = intval( $count_table );
1198	1227	$obj->recordsFiltered = intval( $count_table_filtered );
1199	1228	$obj->data = $rows_final;
1200		- $obj->error = $wpdadb->last_error;
1201	1229	if ( 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG ) ) {
	1230	+ $obj->error = $wpdadb->last_error;
	1231	+ }
	1232	+ if ( 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG ) ) {
1202	1233	$obj->debug = array(
1203	1234	'columns' => $columns,
1204	1235	'columns_backticks' => $columns_backticks,
1205	1236	'query' => $query,
		@@ -1233,8 +1264,9 @@
1233	1264	$is_cpt,
1234	1265	$offset,
1235	1266	$limit
1236	1267	) {
	1268	+ return null;
1237	1269	}
1238	1270
1239	1271	private function get_orderby_from_request() {
1240	1272	$orderby = '';
		@@ -1264,14 +1296,17 @@
1264	1296	return $sp;
1265	1297	}
1266	1298
1267	1299	public function qb_group( $data ) {
	1300	+ return null;
1268	1301	}
1269	1302
1270	1303	public function qb_criteria( $crit ) {
	1304	+ return null;
1271	1305	}
1272	1306
1273	1307	private function qb( $labels ) {
	1308	+ return null;
1274	1309	}
1275	1310
1276	1311	private function create_empty_response( $error = '', $debug = '' ) {
1277	1312	$obj = (object) null;