← All changes | public/class-wp-data-access-public.php +99 -199 5.5.83 → 5.5.85 View file →

		@@ -452,26 +452,14 @@
452	452	global $wpdb;
453	453	$atts = array_change_key_case( (array) $atts, CASE_LOWER );
454	454	//phpcs:ignore - 8.1 proof
455	455	$wp_atts = shortcode_atts( array(
456		- 'project_id' => '',
457		- 'page_id' => '',
458		- 'schema_name' => $wpdb->dbname,
459		- 'table_name' => '',
460		- 'title' => '',
461		- 'subtitle' => '',
462		- 'bulk_actions_enabled' => false,
463		- 'search_box_enabled' => false,
464		- 'bulk_export_enabled' => false,
465		- 'show_view_link' => 'on',
466		- 'allow_insert' => 'off',
467		- 'allow_update' => 'off',
468		- 'allow_delete' => 'off',
469		- 'allow_import' => 'off',
	456	+ 'project_id' => '',
	457	+ 'page_id' => '',
470	458	), $atts );
471		- if ( '' === $wp_atts['project_id'] && '' === $wp_atts['page_id'] && '' === $wp_atts['table_name'] ) {
472		- // Either a Data Project page (project_id and page_id) or a table name must be provided.
473		- return __( 'ERROR: Missing argument(s) [(project_id and page_id) or table_name]', 'wp-data-access' );
	459	+ if ( '' === $wp_atts['project_id'] && '' === $wp_atts['page_id'] ) {
	460	+ // Dashboard menu feature was removed. Parameter table_name no longer valid.
	461	+ return __( 'ERROR: Missing argument(s) [project_id and page_id]', 'wp-data-access' );
474	462	}
475	463	// Sanitize database values.
476	464	$wp_atts['project_id'] = sanitize_text_field( wp_unslash( $wp_atts['project_id'] ) );
477	465	// input var okay.
		@@ -476,46 +464,8 @@
476	464	$wp_atts['project_id'] = sanitize_text_field( wp_unslash( $wp_atts['project_id'] ) );
477	465	// input var okay.
478	466	$wp_atts['page_id'] = sanitize_text_field( wp_unslash( $wp_atts['page_id'] ) );
479	467	// input var okay.
480		- $wp_atts['schema_name'] = sanitize_text_field( wp_unslash( $wp_atts['schema_name'] ) );
481		- // input var okay.
482		- $wp_atts['table_name'] = sanitize_text_field( wp_unslash( $wp_atts['table_name'] ) );
483		- // input var okay.
484		- // Set default parameter values.
485		- $bulk_actions_enabled = false;
486		- $search_box_enabled = false;
487		- $bulk_export_enabled = false;
488		- $show_view_link = 'on';
489		- $allow_insert = 'off';
490		- $allow_update = 'off';
491		- $allow_delete = 'off';
492		- $allow_import = 'off';
493		- // Check arguments.
494		- if ( 'true' === $wp_atts['bulk_actions_enabled'] ) {
495		- $bulk_actions_enabled = true;
496		- }
497		- if ( 'true' === $wp_atts['search_box_enabled'] ) {
498		- $search_box_enabled = true;
499		- }
500		- if ( 'true' === $wp_atts['bulk_export_enabled'] ) {
501		- $bulk_export_enabled = true;
502		- }
503		- if ( 'false' === $wp_atts['show_view_link'] ) {
504		- $show_view_link = 'off';
505		- }
506		- if ( 'true' === $wp_atts['allow_insert'] ) {
507		- $allow_insert = 'on';
508		- }
509		- if ( 'true' === $wp_atts['allow_update'] ) {
510		- $allow_update = 'on';
511		- }
512		- if ( 'true' === $wp_atts['allow_delete'] ) {
513		- $allow_delete = 'on';
514		- }
515		- if ( 'true' === $wp_atts['allow_import'] ) {
516		- $allow_import = 'on';
517		- }
518	468	$default_where = '';
519	469	if ( isset( $atts['filter_field_name'] ) && isset( $atts['filter_field_value'] ) ) {
520	470	$filter_field_name = str_replace( '`', '', sanitize_text_field( wp_unslash( $atts['filter_field_name'] ) ) );
521	471	// input var okay.
		@@ -534,31 +484,8 @@
534	484	}
535	485	// phpcs:enable Generic.CodeAnalysis.ForLoopWithTestFunctionCall, Squiz.PHP.DisallowSizeFunctionsInLoops, WordPress.DB.PreparedSQLPlaceholders
536	486	}
537	487	}
538		- // Is this a Data Projects page or a table administration page?
539		- if ( '' !== $wp_atts['project_id'] && '' !== $wp_atts['page_id'] ) {
540		- // phpcs:ignore Generic.CodeAnalysis.EmptyStatement
541		- // Request for Data Projects page (check is performed in WPDP_List_Page).
542		- } else {
543		- // Request for table administration page.
544		- // Check schema name.
545		- if ( 'sys' === $wp_atts['schema_name'] || 'mysql' === $wp_atts['schema_name'] || 'information_schema' === $wp_atts['schema_name'] ) {
546		- // No access to MySQL databases (meta data)!
547		- return __( 'ERROR: No access to MySQL meta data', 'wp-data-access' );
548		- }
549		- // Check database table name.
550		- if ( '' === $wp_atts['table_name'] ) {
551		- // Table name must be provided! No database administration in the public area!
552		- return __( 'ERROR: Missing argument [table_name]', 'wp-data-access' );
553		- }
554		- // Check if table exists (to prevent sql injection) and access is granted.
555		- $wpda_dictionary_checks = new WPDA_Dictionary_Exist($wp_atts['schema_name'], $wp_atts['table_name']);
556		- if ( !$wpda_dictionary_checks->table_exists( true, false ) ) {
557		- // Table not found.
558		- return '<p>' . __( 'ERROR: Invalid table name or not authorized', 'wp-data-access' ) . '</p>';
559		- }
560		- }
561	488	// Make sure user has access to necessary (fake) classes and functions in the frontend.
562	489	require_once plugin_dir_path( __DIR__ ) . 'wp-data-access-diehard.php';
563	490	// Make sure all style and JS is available.
564	491	wp_enqueue_script( 'wpda_admin_scripts' );
		@@ -585,136 +512,109 @@
585	512	do_action( 'wpda_wpdadiehard_prepare' );
586	513	ob_start();
587	514	// Set page argument to allow public access.
588	515	$_REQUEST['page'] = 'diehard';
589		- if ( '' !== $wp_atts['project_id'] && '' !== $wp_atts['page_id'] ) {
590		- // Show Data Projects page (check is performed in WPDP_List_Page).
591		- // Get page values.
592		- // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin table
593		- $project_page = $wpdb->get_results( $wpdb->prepare( "\n select * from {$wpdb->prefix}wpda_project_page\n where project_id = %d\n and page_id = %d\n \t", array($wp_atts['project_id'], $wp_atts['page_id']) ), 'ARRAY_A' );
594		- // db call ok; no-cache ok.
595		- // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
596		- if ( 0 === $wpdb->num_rows ) {
597		- // This should never happen as it was already tested before.
598		- return __( 'ERROR: Data Project page not found [need a valid project_id and page_id]', 'wp-data-access' );
599		- }
600		- if ( 'off' !== WPDA::get_option( WPDA::OPTION_WPDA_USE_ROLES_IN_SHORTCODE ) ) {
601		- // Check if user has role.
602		- $user_roles = WPDA::get_current_user_roles();
603		- if ( false === $user_roles ) {
604		- // Cannot determine the user role(s). Not able to show project menus.
605		- return __( 'ERROR: No access [could not determine user role]', 'wp-data-access' );
	516	+ // Show Data Projects page (check is performed in WPDP_List_Page).
	517	+ // Get page values.
	518	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- plugin table
	519	+ $project_page = $wpdb->get_results( $wpdb->prepare( "\n select * from {$wpdb->prefix}wpda_project_page\n where project_id = %d\n and page_id = %d\n \t", array($wp_atts['project_id'], $wp_atts['page_id']) ), 'ARRAY_A' );
	520	+ // db call ok; no-cache ok.
	521	+ // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
	522	+ if ( 0 === $wpdb->num_rows ) {
	523	+ // This should never happen as it was already tested before.
	524	+ return __( 'ERROR: Data Project page not found [need a valid project_id and page_id]', 'wp-data-access' );
	525	+ }
	526	+ // Check if user has role.
	527	+ $user_roles = WPDA::get_current_user_roles();
	528	+ if ( false === $user_roles ) {
	529	+ // Cannot determine the user role(s). Not able to show project menus.
	530	+ return __( 'ERROR: No access [could not determine user role]', 'wp-data-access' );
	531	+ }
	532	+ $user_has_role = in_array( 'administrator', $user_roles, true );
	533	+ if ( !$user_has_role && '' !== $project_page[0]['page_role'] && null !== $project_page[0]['page_role'] ) {
	534	+ $user_role_array = explode( ',', $project_page[0]['page_role'] );
	535	+ foreach ( $user_role_array as $user_role_array_item ) {
	536	+ $user_has_role = in_array( $user_role_array_item, $user_roles, true );
	537	+ if ( $user_has_role ) {
	538	+ break;
606	539	}
607		- $user_has_role = false;
608		- if ( '' === $project_page[0]['page_role'] || null === $project_page[0]['page_role'] ) {
609		- $user_has_role = in_array( 'administrator', $user_roles, true );
610		- //phpcs:ignore - 8.1 proof
611		- } else {
612		- $user_role_array = explode( ',', $project_page[0]['page_role'] );
613		- //phpcs:ignore - 8.1 proof
614		- foreach ( $user_role_array as $user_role_array_item ) {
615		- $user_has_role = in_array( $user_role_array_item, $user_roles, true );
616		- //phpcs:ignore - 8.1 proof
617		- if ( $user_has_role ) {
618		- break;
619		- }
620		- }
621		- }
622		- if ( !$user_has_role ) {
623		- return __( 'ERROR: No access [missing role]', 'wp-data-access' );
624		- }
625	540	}
626		- // Determine plugin classes to be used.
627		- if ( 'static' === $project_page[0]['page_type'] ) {
628		- return '';
629		- } elseif ( 'table' === $project_page[0]['page_type'] ) {
630		- $list_view_class = 'WPDataProjects\\List_Table\\WPDP_List_View';
631		- $list_table_class = 'WPDataProjects\\List_Table\\WPDP_List_Table';
632		- $edit_form_class = 'WPDataProjects\\Simple_Form\\WPDP_Simple_Form';
	541	+ }
	542	+ if ( !$user_has_role ) {
	543	+ return __( 'ERROR: No access [missing role]', 'wp-data-access' );
	544	+ }
	545	+ // Determine plugin classes to be used.
	546	+ if ( 'static' === $project_page[0]['page_type'] ) {
	547	+ return '';
	548	+ } elseif ( 'table' === $project_page[0]['page_type'] ) {
	549	+ $list_view_class = 'WPDataProjects\\List_Table\\WPDP_List_View';
	550	+ $list_table_class = 'WPDataProjects\\List_Table\\WPDP_List_Table';
	551	+ $edit_form_class = 'WPDataProjects\\Simple_Form\\WPDP_Simple_Form';
	552	+ } else {
	553	+ $list_view_class = 'WPDataProjects\\Parent_Child\\WPDP_Parent_List_View';
	554	+ $list_table_class = 'WPDataProjects\\Parent_Child\\WPDP_Parent_List_Table';
	555	+ $edit_form_class = 'WPDataProjects\\Parent_Child\\WPDP_Parent_Form';
	556	+ }
	557	+ if ( null !== $project_page[0]['page_where'] && '' !== $project_page[0]['page_where'] ) {
	558	+ if ( 'where' === substr( str_replace( ' ', '', $project_page[0]['page_where'] ), 0, 5 ) ) {
	559	+ $where_clause = " {$project_page[0]['page_where']}";
633	560	} else {
634		- $list_view_class = 'WPDataProjects\\Parent_Child\\WPDP_Parent_List_View';
635		- $list_table_class = 'WPDataProjects\\Parent_Child\\WPDP_Parent_List_Table';
636		- $edit_form_class = 'WPDataProjects\\Parent_Child\\WPDP_Parent_Form';
	561	+ $where_clause = " where {$project_page[0]['page_where']} ";
637	562	}
638		- if ( null !== $project_page[0]['page_where'] && '' !== $project_page[0]['page_where'] ) {
639		- if ( 'where' === substr( str_replace( ' ', '', $project_page[0]['page_where'] ), 0, 5 ) ) {
640		- $where_clause = " {$project_page[0]['page_where']}";
641		- } else {
642		- $where_clause = " where {$project_page[0]['page_where']} ";
643		- }
644		- $where_clause = WPDA::substitute_environment_vars( $where_clause );
	563	+ $where_clause = WPDA::substitute_environment_vars( $where_clause );
	564	+ } else {
	565	+ $where_clause = '';
	566	+ }
	567	+ if ( '' === $default_where ) {
	568	+ $default_where = $where_clause;
	569	+ } else {
	570	+ if ( '' === $where_clause ) {
	571	+ $default_where = " where {$default_where} ";
645	572	} else {
646		- $where_clause = '';
	573	+ $default_where = " {$where_clause} and {$default_where} ";
647	574	}
648		- if ( '' === $default_where ) {
649		- $default_where = $where_clause;
650		- } else {
651		- if ( '' === $where_clause ) {
652		- $default_where = " where {$default_where} ";
653		- } else {
654		- $default_where = " {$where_clause} and {$default_where} ";
655		- }
656		- }
657		- $default_orderby = $project_page[0]['page_orderby'];
658		- // Prepare arguments.
659		- $args = array(
660		- 'page_hook_suffix' => 'WPDA_WPDP',
661		- 'wpdaschema_name' => $project_page[0]['page_schema_name'],
662		- 'table_name' => $project_page[0]['page_table_name'],
663		- 'list_table_class' => $list_table_class,
664		- 'edit_form_class' => $edit_form_class,
665		- 'project_id' => $wp_atts['project_id'],
666		- 'page_id' => $wp_atts['page_id'],
667		- 'default_where' => $default_where,
668		- 'where_clause' => $default_where,
669		- 'orderby_clause' => $default_orderby,
670		- );
671		- if ( 'view' === $project_page[0]['page_mode'] ) {
672		- $args['allow_update'] = 'off';
673		- $args['allow_import'] = 'off';
674		- }
675		- if ( 'no' === $project_page[0]['page_allow_insert'] ) {
676		- $args['allow_insert'] = 'off';
677		- $args['allow_import'] = 'off';
678		- }
679		- if ( 'no' === $project_page[0]['page_allow_delete'] ) {
680		- $args['allow_delete'] = 'off';
681		- }
682		- if ( 'only' === $project_page[0]['page_allow_insert'] ) {
683		- $args['action'] = 'new';
684		- $args['allow_insert'] = 'only';
685		- $args['allow_update'] = 'off';
686		- $args['allow_import'] = 'off';
687		- $args['allow_delete'] = 'off';
688		- }
689		- if ( 'no' === $project_page[0]['page_allow_import'] ) {
690		- $args['allow_import'] = 'off';
691		- }
692		- if ( 'no' === $project_page[0]['page_allow_bulk'] ) {
693		- $args['bulk_actions_enabled'] = false;
694		- }
695		- // Show page.
696		- $project_page_view = new $list_view_class($args);
697		- $project_page_view->show();
698		- } else {
699		- // Show table administration page.
700		- $media_manager = new WPDA_List_View(array(
701		- 'wpdaschema_name' => $wp_atts['schema_name'],
702		- 'table_name' => $wp_atts['table_name'],
703		- 'title' => $wp_atts['title'],
704		- 'subtitle' => $wp_atts['subtitle'],
705		- 'bulk_actions_enabled' => $bulk_actions_enabled,
706		- 'search_box_enabled' => $search_box_enabled,
707		- 'bulk_export_enabled' => $bulk_export_enabled,
708		- 'show_view_link' => $show_view_link,
709		- 'allow_insert' => $allow_insert,
710		- 'allow_update' => $allow_update,
711		- 'allow_delete' => $allow_delete,
712		- 'allow_import' => $allow_import,
713		- 'default_where' => $default_where,
714		- ));
715		- $media_manager->show();
716	575	}
	576	+ $default_orderby = $project_page[0]['page_orderby'];
	577	+ // Prepare arguments.
	578	+ $args = array(
	579	+ 'page_hook_suffix' => 'WPDA_WPDP',
	580	+ 'wpdaschema_name' => $project_page[0]['page_schema_name'],
	581	+ 'table_name' => $project_page[0]['page_table_name'],
	582	+ 'list_table_class' => $list_table_class,
	583	+ 'edit_form_class' => $edit_form_class,
	584	+ 'project_id' => $wp_atts['project_id'],
	585	+ 'page_id' => $wp_atts['page_id'],
	586	+ 'default_where' => $default_where,
	587	+ 'where_clause' => $default_where,
	588	+ 'orderby_clause' => $default_orderby,
	589	+ );
	590	+ if ( 'view' === $project_page[0]['page_mode'] ) {
	591	+ $args['allow_update'] = 'off';
	592	+ $args['allow_import'] = 'off';
	593	+ }
	594	+ if ( 'no' === $project_page[0]['page_allow_insert'] ) {
	595	+ $args['allow_insert'] = 'off';
	596	+ $args['allow_import'] = 'off';
	597	+ }
	598	+ if ( 'no' === $project_page[0]['page_allow_delete'] ) {
	599	+ $args['allow_delete'] = 'off';
	600	+ }
	601	+ if ( 'only' === $project_page[0]['page_allow_insert'] ) {
	602	+ $args['action'] = 'new';
	603	+ $args['allow_insert'] = 'only';
	604	+ $args['allow_update'] = 'off';
	605	+ $args['allow_import'] = 'off';
	606	+ $args['allow_delete'] = 'off';
	607	+ }
	608	+ if ( 'no' === $project_page[0]['page_allow_import'] ) {
	609	+ $args['allow_import'] = 'off';
	610	+ }
	611	+ if ( 'no' === $project_page[0]['page_allow_bulk'] ) {
	612	+ $args['bulk_actions_enabled'] = false;
	613	+ }
	614	+ // Show page.
	615	+ $project_page_view = new $list_view_class($args);
	616	+ $project_page_view->show();
717	617	?>
718	618	<script type='text/javascript'>
719	619	// JS variable commonL10n is used in loaded scripts, copied from wp_default_scripts for responsive support
720	620	/* <![CDATA[ */