| @@ -727,26 +727,56 @@ | ||
| 727 | 727 | wp_die(); |
| 728 | 728 | // Remote database not available |
| 729 | 729 | } |
| 730 | 730 | // Add field filters from shortcode |
| 731 | - // phpcs:disable WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.InputNotValidated | |
| 732 | - $filter_field_name = str_replace( '`', '', sanitize_text_field( wp_unslash( $_REQUEST['filter_field_name'] ) ) ); | |
| 733 | - $filter_field_value = sanitize_text_field( wp_unslash( $_REQUEST['filter_field_value'] ) ); | |
| 734 | - // phpcs:enable WordPress.Security.ValidatedSanitizedInput.MissingUnslash, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.InputNotValidated | |
| 731 | + $filter_field_name = ''; | |
| 732 | + $filter_field_value = ''; | |
| 733 | + if ( isset( $_REQUEST['filter_field_name'], $_REQUEST['filter_field_value'] ) ) { | |
| 734 | + // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 735 | + $filter_field_name_raw = wp_unslash( $_REQUEST['filter_field_name'] ); | |
| 736 | + $filter_field_value_raw = wp_unslash( $_REQUEST['filter_field_value'] ); | |
| 737 | + // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized | |
| 738 | + if ( is_string( $filter_field_name_raw ) && is_string( $filter_field_value_raw ) ) { | |
| 739 | + $filter_field_name = sanitize_text_field( $filter_field_name_raw ); | |
| 740 | + $filter_field_value = sanitize_text_field( $filter_field_value_raw ); | |
| 741 | + } | |
| 742 | + } | |
| 735 | 743 | if ( '' !== $filter_field_name && '' !== $filter_field_value ) { |
| 744 | + if ( '*' === $columns ) { | |
| 745 | + $allowed_columns = array(); | |
| 746 | + $tbl = WPDA_List_Columns_Cache::get_list_columns( $database, $table_name ); | |
| 747 | + $cols = $tbl->get_table_columns(); | |
| 748 | + foreach ( $cols as $col ) { | |
| 749 | + if ( isset( $col['column_name'] ) ) { | |
| 750 | + $allowed_columns[] = $col['column_name']; | |
| 751 | + } | |
| 752 | + } | |
| 753 | + } else { | |
| 754 | + $allowed_columns = explode( ',', $columns ); | |
| 755 | + } | |
| 736 | 756 | $filter_field_name_array = array_map( 'trim', explode( ',', $filter_field_name ) ); |
| 737 | 757 | $filter_field_value_array = array_map( 'trim', explode( ',', $filter_field_value ) ); |
| 738 | 758 | if ( count( $filter_field_name_array ) === count( $filter_field_value_array ) ) { |
| 739 | - // Add filter to where clause | |
| 759 | + $prepare_fields = array(); | |
| 760 | + $prepare_values = array(); | |
| 740 | 761 | for ($i = 0; $i < count( $filter_field_name_array ); $i++) { |
| 762 | + $field_name = $filter_field_name_array[$i]; | |
| 763 | + $field_value = $filter_field_value_array[$i]; | |
| 764 | + if ( !in_array( $field_name, $allowed_columns, true ) ) { | |
| 765 | + continue; | |
| 766 | + } | |
| 767 | + $prepare_fields[] = $field_name; | |
| 768 | + $prepare_values[] = $field_value; | |
| 769 | + } | |
| 770 | + for ($i = 0; $i < count( $prepare_fields ); $i++) { | |
| 741 | 771 | if ( '' === $where ) { |
| 742 | - $where = $wpdadb->prepare( " where `{$filter_field_name_array[$i]}` like %s ", array($filter_field_value_array[$i]) ); | |
| 772 | + $where = $wpdadb->prepare( ' WHERE %i LIKE %s ', array($prepare_fields[$i], $prepare_values[$i]) ); | |
| 743 | 773 | } else { |
| 744 | - $where .= $wpdadb->prepare( " and `{$filter_field_name_array[$i]}` like %s ", array($filter_field_value_array[$i]) ); | |
| 774 | + $where .= $wpdadb->prepare( ' AND %i LIKE %s ', array($prepare_fields[$i], $prepare_values[$i]) ); | |
| 745 | 775 | } |
| 746 | - $_filter['filter_field_name'] = $filter_field_name; | |
| 747 | - $_filter['filter_field_value'] = $filter_field_value; | |
| 748 | 776 | } |
| 777 | + $_filter['filter_field_name'] = $filter_field_name; | |
| 778 | + $_filter['filter_field_value'] = $filter_field_value; | |
| 749 | 779 | } |
| 750 | 780 | } |
| 751 | 781 | // Get all column names from table (must be comma separated string) |
| 752 | 782 | $this->wpda_list_columns = WPDA_List_Columns_Cache::get_list_columns( $database, $table_name ); |
| @@ -985,9 +1015,10 @@ | ||
| 985 | 1015 | } |
| 986 | 1016 | $wpdadb->suppress_errors( true ); |
| 987 | 1017 | $rows = $wpdadb->get_results( $query, 'ARRAY_N' ); |
| 988 | 1018 | if ( '' !== $wpdadb->last_error ) { |
| 989 | - $this->create_empty_response( $wpdadb->last_error, $query ); | |
| 1019 | + $this->create_empty_response( __( 'ERROR: Invalid query', 'wp-data-access' ) ); | |
| 1020 | + WPDA::wpda_log_wp_error( $wpdadb->last_error ); | |
| 990 | 1021 | wp_die(); |
| 991 | 1022 | } |
| 992 | 1023 | $rows_final = array(); |
| 993 | 1024 | foreach ( $rows as $row ) { |
| @@ -1194,9 +1225,11 @@ | ||
| 1194 | 1225 | $obj->draw = ( isset( $_REQUEST['draw'] ) ? intval( $_REQUEST['draw'] ) : 0 ); |
| 1195 | 1226 | $obj->recordsTotal = intval( $count_table ); |
| 1196 | 1227 | $obj->recordsFiltered = intval( $count_table_filtered ); |
| 1197 | 1228 | $obj->data = $rows_final; |
| 1198 | - $obj->error = $wpdadb->last_error; | |
| 1229 | + if ( 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG ) ) { | |
| 1230 | + $obj->error = $wpdadb->last_error; | |
| 1231 | + } | |
| 1199 | 1232 | if ( 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG ) ) { |
| 1200 | 1233 | $obj->debug = array( |
| 1201 | 1234 | 'columns' => $columns, |
| 1202 | 1235 | 'columns_backticks' => $columns_backticks, |
