← All changes | WPDataAccess/API/WPDA_Apps.php +236 -70 5.5.79 → 5.5.85 View file →

		@@ -3,9 +3,8 @@
3	3	namespace WPDataAccess\API;
4	4
5	5	use stdClass;
6	6	use WPDataAccess\Connection\WPDADB;
7		-use WPDataAccess\Data_Apps\WPDA_PWA;
8	7	use WPDataAccess\Data_Dictionary\WPDA_List_Columns_Cache;
9	8	use WPDataAccess\Plugin_Table_Models\WPDA_App_Container_Model;
10	9	use WPDataAccess\Plugin_Table_Models\WPDA_App_Apps_Model;
11	10	use WPDataAccess\Plugin_Table_Models\WPDA_App_Model;
		@@ -281,9 +280,13 @@
281	280	'map' => array(
282	281	'required' => false,
283	282	'type' => 'string',
284	283	'description' => __( 'Map settings - JSON string', 'wp-data-access' ),
285		- 'sanitize_callback' => 'wp_kses_post',
	284	+ 'sanitize_callback' => function ( $param ) {
	285	+ $sanitized_settings = $this->sanitize_settings( json_decode( (string) $param, true ) );
	286	+ // Save sanitized JSON as string
	287	+ return json_encode( $sanitized_settings );
	288	+ },
286	289	'validate_callback' => 'rest_validate_request_arg',
287	290	),
288	291	'chart' => array(
289	292	'required' => false,
		@@ -515,8 +518,15 @@
515	518	'permission_callback' => '__return_true',
516	519	'args' => array(
517	520	'dbs_source' => $this->get_param( 'dbs' ),
518	521	'dbs_destination' => $this->get_param( 'dbs' ),
	522	+ 'appDbId' => array(
	523	+ 'required' => false,
	524	+ 'type' => 'integer',
	525	+ 'description' => __( 'App Id', 'wp-data-access' ),
	526	+ 'sanitize_callback' => 'absint',
	527	+ 'validate_callback' => 'rest_validate_request_arg',
	528	+ ),
519	529	),
520	530	) );
521	531	register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/lang/get', array(
522	532	'methods' => array('POST'),
		@@ -590,10 +600,52 @@
590	600	'args' => array(
591	601	'app_id' => $this->get_param( 'app_id' ),
592	602	),
593	603	) );
	604	+ register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/upload', array(
	605	+ 'methods' => array('POST'),
	606	+ 'callback' => array($this, 'app_upload'),
	607	+ 'permission_callback' => '__return_true',
	608	+ 'args' => array(
	609	+ 'app_id' => $this->get_param( 'app_id' ),
	610	+ 'cnt_id' => $this->get_param( 'cnt_id' ),
	611	+ 'pk' => array(
	612	+ 'required' => true,
	613	+ 'type' => 'string',
	614	+ 'description' => __( 'Primary key in JSON format', 'wp-data-access' ),
	615	+ 'sanitize_callback' => 'sanitize_text_field',
	616	+ 'validate_callback' => 'rest_validate_request_arg',
	617	+ ),
	618	+ 'col' => $this->get_param( 'col' ),
	619	+ ),
	620	+ ) );
	621	+ register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/download', array(
	622	+ 'methods' => array('POST'),
	623	+ 'callback' => array($this, 'app_download'),
	624	+ 'permission_callback' => '__return_true',
	625	+ 'args' => array(
	626	+ 'app_id' => $this->get_param( 'app_id' ),
	627	+ 'cnt_id' => $this->get_param( 'cnt_id' ),
	628	+ 'pk' => array(
	629	+ 'required' => true,
	630	+ 'type' => 'string',
	631	+ 'description' => __( 'Primary key in JSON format', 'wp-data-access' ),
	632	+ 'sanitize_callback' => 'sanitize_text_field',
	633	+ 'validate_callback' => 'rest_validate_request_arg',
	634	+ ),
	635	+ 'col' => $this->get_param( 'col' ),
	636	+ ),
	637	+ ) );
594	638	}
595	639
	640	+ public function app_download( $request ) {
	641	+ return $this->WPDA_Rest_Response( 'OK' );
	642	+ }
	643	+
	644	+ public function app_upload( $request ) {
	645	+ return $this->WPDA_Rest_Response( 'OK' );
	646	+ }
	647	+
596	648	public function app_wpa_deactivate( $request ) {
597	649	if ( !$this->current_user_can_access() ) {
598	650	// Only admins
599	651	return $this->unauthorized();
		@@ -922,8 +974,9 @@
922	974	$media = $request->get_param( 'media' );
923	975	$rel_tab = $request->get_param( 'rel_tab' );
924	976	$client_side = '1' === $request->get_param( 'client_side' );
925	977	$geo_radius = $request->get_param( 'geo_radius' );
	978	+ $docs = array();
926	979	$default_where = '';
927	980	$default_orderby = '';
928	981	$lookups = array();
929	982	$m2m_relationship = array();
		@@ -971,8 +1024,27 @@
971	1024	}
972	1025	}
973	1026	}
974	1027	}
	1028	+ if ( isset( $settings['columns'] ) && is_array( $settings['columns'] ) && '1' !== $rel_tab ) {
	1029	+ $queryable_columns = array();
	1030	+ if ( isset( $settings['table']['columns'] ) && is_array( $settings['table']['columns'] ) ) {
	1031	+ foreach ( $settings['table']['columns'] as $column ) {
	1032	+ if ( isset( $column['queryable'] ) && $column['queryable'] ) {
	1033	+ $queryable_columns[] = $column['columnName'];
	1034	+ }
	1035	+ }
	1036	+ }
	1037	+ $app_columns = array();
	1038	+ foreach ( $settings['columns'] as $column ) {
	1039	+ if ( isset( $column['columnName'], $column['isSelected'] ) && $column['isSelected'] ) {
	1040	+ $app_columns[$column['columnName']] = in_array( $column['columnName'], $queryable_columns );
	1041	+ }
	1042	+ }
	1043	+ if ( 0 < count( $app_columns ) ) {
	1044	+ $col = $app_columns;
	1045	+ }
	1046	+ }
975	1047	$table_api = new WPDA_Table();
976	1048	return $table_api->select(
977	1049	$dbs,
978	1050	$tbl,
		@@ -997,9 +1069,10 @@
997	1069	$md,
998	1070	$m2m_relationship,
999	1071	$search_data_types,
1000	1072	$client_side,
1001		- $geo_radius
	1073	+ $geo_radius,
	1074	+ $docs
1002	1075	);
1003	1076	} else {
1004	1077	if ( 'rest_cookie_invalid_nonce' === $msg ) {
1005	1078	return $this->invalid_nonce();
		@@ -1023,8 +1096,9 @@
1023	1096	return array_map( function ( $value ) {
1024	1097	if ( true === $value['isSelected'] ) {
1025	1098	return $value['columnName'];
1026	1099	}
	1100	+ return null;
1027	1101	}, $columns );
1028	1102	}
1029	1103
1030	1104	public function app_get( $request ) {
		@@ -1032,8 +1106,9 @@
1032	1106	$cnt_id = $request->get_param( 'cnt_id' );
1033	1107	$key = $request->get_param( 'key' );
1034	1108	$media = $request->get_param( 'media' );
1035	1109	$rel_tab = $request->get_param( 'rel_tab' );
	1110	+ $docs = array();
1036	1111	if ( $this->check_app_access(
1037	1112	$app_id,
1038	1113	$cnt_id,
1039	1114	'select',
		@@ -1053,9 +1128,10 @@
1053	1128	$tbl,
1054	1129	$key,
1055	1130	$media,
1056	1131	$column_names,
1057		- $default_where
	1132	+ $default_where,
	1133	+ $docs
1058	1134	);
1059	1135	} else {
1060	1136	if ( 'rest_cookie_invalid_nonce' === $msg ) {
1061	1137	return $this->invalid_nonce();
		@@ -1296,8 +1372,12 @@
1296	1372	}
1297	1373	}
1298	1374
1299	1375	public function app_lookup_dbs( $request ) {
	1376	+ // Only admins are allowed to configre lookups
	1377	+ if ( !$this->current_user_can_access() ) {
	1378	+ return $this->unauthorized();
	1379	+ }
1300	1380	$app_id = $request->get_param( 'app_id' );
1301	1381	$cnt_id = $request->get_param( 'cnt_id' );
1302	1382	if ( $this->check_app_access(
1303	1383	$app_id,
		@@ -1320,8 +1400,12 @@
1320	1400	}
1321	1401	}
1322	1402
1323	1403	public function app_lookup_tbl( $request ) {
	1404	+ // Only admins are allowed to configre lookups
	1405	+ if ( !$this->current_user_can_access() ) {
	1406	+ return $this->unauthorized();
	1407	+ }
1324	1408	$app_id = $request->get_param( 'app_id' );
1325	1409	$cnt_id = $request->get_param( 'cnt_id' );
1326	1410	$dbs = $request->get_param( 'dbs' );
1327	1411	if ( $this->check_app_access(
		@@ -1345,8 +1429,12 @@
1345	1429	}
1346	1430	}
1347	1431
1348	1432	public function app_lookup_cls( $request ) {
	1433	+ // Only admins are allowed to configre lookups
	1434	+ if ( !$this->current_user_can_access() ) {
	1435	+ return $this->unauthorized();
	1436	+ }
1349	1437	$app_id = $request->get_param( 'app_id' );
1350	1438	$cnt_id = $request->get_param( 'cnt_id' );
1351	1439	$dbs = $request->get_param( 'dbs' );
1352	1440	$tbl = $request->get_param( 'tbl' );
		@@ -1395,8 +1483,68 @@
1395	1483	$renamed = 0;
1396	1484	$debug_mode = 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG );
1397	1485	$debug = array();
1398	1486	$errors = array();
	1487	+ if ( $request->get_param( 'appDbId' ) ) {
	1488	+ // Update app only
	1489	+ $appDbId = $request->get_param( 'appDbId' );
	1490	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table
	1491	+ $sql = $wpdb->prepare( "update `{$wpdb->prefix}wpda_app_container` set `cnt_dbs` = %s where `cnt_dbs` = %s and app_id = %d", array($dbs_destination, $dbs_source, $appDbId) );
	1492	+ $result = $wpdb->query( $sql );
	1493	+ // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	1494	+ $renamed += $result;
	1495	+ if ( $debug_mode ) {
	1496	+ $debug[] = array(
	1497	+ 'sql' => $sql,
	1498	+ 'result' => $result,
	1499	+ );
	1500	+ }
	1501	+ if ( '' !== $wpdb->last_error ) {
	1502	+ $errors[] = array(
	1503	+ 'sql' => $sql,
	1504	+ 'error' => $wpdb->last_error,
	1505	+ );
	1506	+ }
	1507	+ $sql_content = array("update `{$wpdb->prefix}wpda_app_container` set `cnt_table` = replace(`cnt_table`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_table` like '%\"dbs\":\"%1s\"%' and app_id = %d", "update `{$wpdb->prefix}wpda_app_container` set `cnt_form` = replace(`cnt_form`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_form` like '%\"dbs\":\"%1s\"%' and app_id = %d");
	1508	+ foreach ( $sql_content as $sql ) {
	1509	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table
	1510	+ $result = $wpdb->query( $wpdb->prepare( $sql, array(
	1511	+ $dbs_source,
	1512	+ $dbs_destination,
	1513	+ $dbs_source,
	1514	+ $appDbId
	1515	+ ) ) );
	1516	+ $renamed += $result;
	1517	+ if ( $debug_mode ) {
	1518	+ $debug[] = array(
	1519	+ 'sql' => $sql,
	1520	+ 'result' => $result,
	1521	+ );
	1522	+ }
	1523	+ if ( '' !== $wpdb->last_error ) {
	1524	+ $errors[] = array(
	1525	+ 'sql' => $sql,
	1526	+ 'error' => $wpdb->last_error,
	1527	+ );
	1528	+ }
	1529	+ }
	1530	+ $context = array();
	1531	+ if ( $debug_mode ) {
	1532	+ $context['debug'] = $debug;
	1533	+ }
	1534	+ if ( 0 < count( $errors ) ) {
	1535	+ $context['errors'] = $errors;
	1536	+ return new \WP_Error('error', 'Failed renaming database', array(
	1537	+ 'status' => 401,
	1538	+ 'context' => $context,
	1539	+ ));
	1540	+ }
	1541	+ return $this->WPDA_Rest_Response( sprintf(
	1542	+ /* translators: %s = number of database substitutions */
	1543	+ __( 'Successfully renamed %s database occurrences', 'wp-data-access' ),
	1544	+ $renamed
	1545	+ ), null, $context );
	1546	+ }
1399	1547	// Rename all occurrences in repository tables and apps
1400	1548	$sqls = array(
1401	1549	"update `{$wpdb->prefix}wpda_publisher` set `pub_schema_name` = %s where `pub_schema_name` = %s",
1402	1550	"update `{$wpdb->prefix}wpda_project_page` set `page_schema_name` = %s where `page_schema_name` = %s",
		@@ -1493,14 +1641,23 @@
1493	1641	));
1494	1642	}
1495	1643	$suppress = $wpdadb->suppress_errors( true );
1496	1644	$chart_data = $wpdadb->get_results( $query, 'ARRAY_A' );
	1645	+ // Add an * before each label to support numeric labels
	1646	+ $chart_data_converted = array();
	1647	+ foreach ( $chart_data as $data ) {
	1648	+ $row = array();
	1649	+ foreach ( $data as $key => $value ) {
	1650	+ $row['*' . $key] = $value;
	1651	+ }
	1652	+ $chart_data_converted[] = $row;
	1653	+ }
1497	1654	$wpdadb->get_results( "create temporary table `wpda_chart_data_types` as {$query}", 'ARRAY_A' );
1498	1655	$explain = $wpdadb->get_results( "desc `wpda_chart_data_types`", 'ARRAY_A' );
1499	1656	$wpdadb->get_results( "drop temporary table `wpda_chart_data_types`", 'ARRAY_A' );
1500	1657	$wpdadb->suppress_errors( $suppress );
1501	1658	return array(
1502		- 'data' => $chart_data,
	1659	+ 'data' => $chart_data_converted,
1503	1660	'explain' => $explain,
1504	1661	);
1505	1662	} else {
1506	1663	return new \WP_Error('error', $msg, array(
		@@ -1981,8 +2138,9 @@
1981	2138	$app_id_details = array_map( function ( $e ) {
1982	2139	if ( isset( $e['app_id_detail'] ) ) {
1983	2140	return $e['app_id_detail'];
1984	2141	}
	2142	+ return null;
1985	2143	}, $apps );
1986	2144	$app_titles = array();
1987	2145	foreach ( $app_id_details as $app_id_detail ) {
1988	2146	$app_detail = WPDA_App_Model::get_by_id( $app_id_detail );
		@@ -2025,12 +2183,38 @@
2025	2183	'tables' => array_values( $wpdb->tables() ),
2026	2184	'date_format' => get_option( 'date_format' ),
2027	2185	'time_format' => get_option( 'time_format' ),
2028	2186	'scroll_offset' => WPDA::get_option( WPDA::OPTION_APPS_SCROLL_OFFSET ),
	2187	+ 'upload' => @ini_get( 'upload_max_filesize' ),
	2188	+ 'uploadBytes' => $this->uploadToBytes( @ini_get( 'upload_max_filesize' ) ),
	2189	+ 'locale' => get_locale(),
2029	2190	];
2030	2191	return $settings;
2031	2192	}
2032	2193
	2194	+ /**
	2195	+ * Convert a PHP shorthand notation (e.g., "2M", "512K", "1G") to bytes.
	2196	+ *
	2197	+ * @param string $val The shorthand size string.
	2198	+ *
	2199	+ * @return int The size in bytes.
	2200	+ */
	2201	+ private function uploadToBytes( $val ) : int {
	2202	+ $val = trim( $val );
	2203	+ $lastChar = strtolower( $val[strlen( $val ) - 1] );
	2204	+ $num = (float) $val;
	2205	+ switch ( $lastChar ) {
	2206	+ case 'g':
	2207	+ $num *= 1024;
	2208	+ case 'm':
	2209	+ $num *= 1024;
	2210	+ case 'k':
	2211	+ $num *= 1024;
	2212	+ break;
	2213	+ }
	2214	+ return (int) round( $num );
	2215	+ }
	2216	+
2033	2217	private function get_app_container_meta( $app_id, $container, $rel_tab = false ) {
2034	2218	$app = WPDA_App_Model::get_by_id( $app_id );
2035	2219	if ( false === $app ) {
2036	2220	return $this->bad_request();
		@@ -2107,8 +2291,17 @@
2107	2291	return $this->get_app_container_meta( $app_id, $container );
2108	2292	}
2109	2293	}
2110	2294
	2295	+ private function escapeUnicodeForExport( $str ) {
	2296	+ if ( empty( $str ) ) {
	2297	+ return $str;
	2298	+ }
	2299	+ return preg_replace_callback( '/\\\\(u[0-9a-fA-F]{4})/', function ( $matches ) {
	2300	+ return '\\\\' . $matches[1];
	2301	+ }, $str );
	2302	+ }
	2303	+
2111	2304	private function do_app_export_app( $app_id, $main_app_id ) {
2112	2305	global $wpdb;
2113	2306	$quotes = function ( $value ) {
2114	2307	return str_replace( array(
		@@ -2118,9 +2311,10 @@
2118	2311	"\\t",
2119	2312	"\\\\n",
2120	2313	"\\n",
2121	2314	"\\r\\n",
2122		- "\\r"
	2315	+ "\\r",
	2316	+ "\\d"
2123	2317	), array(
2124	2318	"''",
2125	2319	'\\\\"',
2126	2320	"\\\\\\t",
		@@ -2127,9 +2321,10 @@
2127	2321	"\\\\t",
2128	2322	"\\\\\\n",
2129	2323	"\\\\n",
2130	2324	"\\\\r\\\\n",
2131		- "\\\\r"
	2325	+ "\\\\r",
	2326	+ "\\\\\\\\\\d"
2132	2327	), $value );
2133	2328	};
2134	2329	$app = WPDA_App_Model::get_by_id( $app_id );
2135	2330	$app_settings = ( null === $app[0]['app_settings'] ? 'null' : "{$quotes( $app[0]['app_settings'] )}" );
		@@ -2176,8 +2371,11 @@
2176	2371	// Replace default WordPress database with conversion string
2177	2372	$cnt_dbs = ( $wpdb->dbname === $container['cnt_dbs'] ? '{wp_schema}' : "{$quotes( $container['cnt_dbs'] )}" );
2178	2373	$cnt_table = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_table );
2179	2374	$cnt_form = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_form );
	2375	+ // Replace Unicode characters
	2376	+ $cnt_table = $this->escapeUnicodeForExport( $cnt_table );
	2377	+ $cnt_form = $this->escapeUnicodeForExport( $cnt_form );
2180	2378	// phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed
2181	2379	$containers_sql .= <<<SQL
2182	2380	# Import app container
2183	2381	insert into `{wp_prefix}wpda_app_container`
		@@ -2485,14 +2683,16 @@
2485	2683	$dynamic_params = array()
2486	2684	) {
2487	2685	// Process $search_custom > URL parameters
2488	2686	global $wpdb;
	2687	+ $replacements = array();
	2688	+ $nonce = bin2hex( random_bytes( 8 ) );
2489	2689	foreach ( self::METHODS as $method ) {
2490	2690	$offset = 0;
2491	2691	$search = $method . '[';
	2692	+ // Get filter
2492	2693	while ( ($pos_start = stripos( $where, $search, $offset )) !== false ) {
2493	2694	if ( ($pos_end = stripos( $where, ']', $pos_start )) !== false ) {
2494		- // Get filter
2495	2695	$filter = substr( $where, $pos_start, $pos_end - $pos_start + 1 );
2496	2696	// Get name
2497	2697	$arg_name = substr( $where, $pos_start + strlen( $search ), $pos_end - $pos_start - strlen( $search ) );
2498	2698	// Remove quotes from name
		@@ -2498,64 +2698,34 @@
2498	2698	// Remove quotes from name
2499	2699	if ( substr( $arg_name, 0, 1 ) === "'" && substr( $arg_name, -1 ) === "'" ) {
2500	2700	$arg_name = substr( $arg_name, 1, -1 );
2501	2701	}
2502		- // Remove double quotes from name
	2702	+ // Remove quotes from name
2503	2703	if ( substr( $arg_name, 0, 1 ) === '"' && substr( $arg_name, -1 ) === '"' ) {
2504	2704	$arg_name = substr( $arg_name, 1, -1 );
2505	2705	}
	2706	+ $arg_value = null;
2506	2707	// Handle GET args
2507		- // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared
2508		- if ( $method === self::METHODS[0] ) {
	2708	+ if ( $method === self::METHODS[0] && isset( $search_custom['get'][$arg_name] ) ) {
	2709	+ $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) );
	2710	+ } elseif ( $method === self::METHODS[1] && isset( $search_custom['post'][$arg_name] ) ) {
	2711	+ $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
	2712	+ } elseif ( $method === self::METHODS[2] ) {
2509	2713	if ( isset( $search_custom['get'][$arg_name] ) ) {
2510	2714	$arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) );
2511		- $where = $wpdb->prepare( substr_replace(
2512		- $where,
2513		- '%s',
2514		- $pos_start,
2515		- $pos_end - $pos_start + 1
2516		- ), $arg_value );
2517		- } else {
2518		- $where = str_replace( $filter, 'null', $where );
	2715	+ } elseif ( isset( $search_custom['post'][$arg_name] ) ) {
	2716	+ $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
2519	2717	}
2520	2718	}
2521	2719	// Handle POST args
2522		- if ( $method === self::METHODS[1] ) {
2523		- if ( isset( $search_custom['post'][$arg_name] ) ) {
2524		- $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
2525		- $where = $wpdb->prepare( substr_replace(
2526		- $where,
2527		- '%s',
2528		- $pos_start,
2529		- $pos_end - $pos_start + 1
2530		- ), $arg_value );
2531		- } else {
2532		- $where = str_replace( $filter, 'null', $where );
2533		- }
2534		- }
	2720	+ $placeholder = '###URL_PLACEHOLDER_' . $nonce . '_' . md5( $filter ) . '###';
	2721	+ $where = str_replace( $filter, $placeholder, $where );
2535	2722	// Handle REQUEST args
2536		- if ( $method === self::METHODS[2] ) {
2537		- if ( isset( $search_custom['get'][$arg_name] ) ) {
2538		- $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) );
2539		- $where = $wpdb->prepare( substr_replace(
2540		- $where,
2541		- '%s',
2542		- $pos_start,
2543		- $pos_end - $pos_start + 1
2544		- ), $arg_value );
2545		- } elseif ( isset( $search_custom['post'][$arg_name] ) ) {
2546		- $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
2547		- $where = $wpdb->prepare( substr_replace(
2548		- $where,
2549		- '%s',
2550		- $pos_start,
2551		- $pos_end - $pos_start + 1
2552		- ), $arg_value );
2553		- } else {
2554		- $where = str_replace( $filter, 'null', $where );
2555		- }
	2723	+ if ( $arg_value !== null ) {
	2724	+ $replacements[$placeholder] = $wpdb->prepare( '%s', $arg_value );
	2725	+ } else {
	2726	+ $replacements[$placeholder] = 'null';
2556	2727	}
2557		- // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared
2558	2728	}
2559	2729	$offset = $pos_start + 1;
2560	2730	if ( $offset > strlen( $where ) ) {
2561	2731	$offset = strlen( $where ) - 1;
		@@ -2566,19 +2736,17 @@
2566	2736	if ( is_array( $search_params ) && 1 === count( $search_params ) ) {
2567	2737	$filter_field_name = $this->sanitize_db_identifier( array_keys( $search_params )[0] );
2568	2738	$filter_field_value = sanitize_text_field( $search_params[$filter_field_name] );
2569	2739	$filter_field_name_array = array_map( 'trim', explode( ',', $filter_field_name ) );
2570		- // phpcs:ignore -- 8.1 proof
2571	2740	$filter_field_value_array = array_map( 'trim', explode( ',', $filter_field_value ) );
2572		- // phpcs:ignore -- 8.1 proof
2573	2741	if ( count( $filter_field_name_array ) === count( $filter_field_value_array ) ) {
2574		- // phpcs:ignore -- 8.1 proof
2575	2742	// Add filter to where clause.
2576		- // phpcs:disable Generic.CodeAnalysis.ForLoopWithTestFunctionCall, Squiz.PHP.DisallowSizeFunctionsInLoops, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder
2577	2743	for ($i = 0; $i < count( $filter_field_name_array ); $i++) {
2578		- $where .= (( '' === $where ? '' : ' and ' )) . $wpdb->prepare( ' `%1s` like %s ', array($filter_field_name_array[$i], $filter_field_value_array[$i]) );
	2744	+ $where .= ( '' === $where ? '' : ' and ' );
	2745	+ $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $filter_field_name_array[$i] ) . '###';
	2746	+ $where .= ' `' . $filter_field_name_array[$i] . '` like ' . $placeholder;
	2747	+ $replacements[$placeholder] = $wpdb->prepare( '%s', $filter_field_value_array[$i] );
2579	2748	}
2580		- // phpcs:enable Generic.CodeAnalysis.ForLoopWithTestFunctionCall, Squiz.PHP.DisallowSizeFunctionsInLoops, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder
2581	2749	}
2582	2750	}
2583	2751	// Substitute all shortcode parameters
2584	2752	if ( is_array( $shortcode_params ) ) {
		@@ -2584,15 +2752,11 @@
2584	2752	if ( is_array( $shortcode_params ) ) {
2585	2753	foreach ( $shortcode_params as $column_name => $column_value ) {
2586	2754	$occurences = substr_count( strtolower( $where ), strtolower( "shortcodeParam['{$column_name}']" ) );
2587	2755	if ( 0 < $occurences ) {
2588		- $column_values = array();
2589		- for ($i = 0; $i < $occurences; $i++) {
2590		- $column_values[] = sanitize_text_field( $column_value );
2591		- }
2592		- // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
2593		- $where = $wpdb->prepare( str_ireplace( "shortcodeParam['{$column_name}']", '%s', $where ), $column_values );
2594		- // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	2756	+ $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $column_name ) . '###';
	2757	+ $where = str_ireplace( "shortcodeParam['{$column_name}']", $placeholder, $where );
	2758	+ $replacements[$placeholder] = $wpdb->prepare( '%s', sanitize_text_field( $column_value ) );
2595	2759	}
2596	2760	}
2597	2761	}
2598	2762	// Substitute all unused shortcode parameter calls with null
		@@ -2610,13 +2774,15 @@
2610	2774	}
2611	2775	// Substitute all dynamic parameters
2612	2776	if ( is_array( $dynamic_params ) && 0 < count( $dynamic_params ) ) {
2613	2777	foreach ( $dynamic_params as $column_name => $column_value ) {
2614		- // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
2615		- $where = $wpdb->prepare( str_ireplace( "{:{$column_name}}", '%s', $where ), $column_value );
2616		- // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	2778	+ if ( stripos( $where, "{:{$column_name}}" ) !== false ) {
	2779	+ $placeholder = '###DYNAMIC_PARAM_' . $nonce . '_' . md5( $column_name ) . '###';
	2780	+ $where = str_ireplace( "{:{$column_name}}", $placeholder, $where );
	2781	+ $replacements[$placeholder] = $wpdb->prepare( '%s', $column_value );
	2782	+ }
2617	2783	}
2618	2784	}
2619		- return $where;
	2785	+ return strtr( $where, $replacements );
2620	2786	}
2621	2787
2622	2788	}