| @@ -27,8 +27,9 @@ | ||
| 27 | 27 | $value->{$property_name} = $this->sanitize_settings( $property_value ); |
| 28 | 28 | } |
| 29 | 29 | } else { |
| 30 | 30 | // Allow HTML and onclick for computed fields |
| 31 | + // phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | |
| 31 | 32 | $value = apply_filters( |
| 32 | 33 | 'wp_kses_post', |
| 33 | 34 | $value, |
| 34 | 35 | "", |
| @@ -33,8 +34,9 @@ | ||
| 33 | 34 | $value, |
| 34 | 35 | "", |
| 35 | 36 | ["onclick"] |
| 36 | 37 | ); |
| 38 | + // phpcs:enable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound | |
| 37 | 39 | } |
| 38 | 40 | return $value; |
| 39 | 41 | } |
| 40 | 42 | |
| @@ -278,9 +280,13 @@ | ||
| 278 | 280 | 'map' => array( |
| 279 | 281 | 'required' => false, |
| 280 | 282 | 'type' => 'string', |
| 281 | 283 | 'description' => __( 'Map settings - JSON string', 'wp-data-access' ), |
| 282 | - 'sanitize_callback' => 'wp_kses_post', | |
| 284 | + 'sanitize_callback' => function ( $param ) { | |
| 285 | + $sanitized_settings = $this->sanitize_settings( json_decode( (string) $param, true ) ); | |
| 286 | + // Save sanitized JSON as string | |
| 287 | + return json_encode( $sanitized_settings ); | |
| 288 | + }, | |
| 283 | 289 | 'validate_callback' => 'rest_validate_request_arg', |
| 284 | 290 | ), |
| 285 | 291 | 'chart' => array( |
| 286 | 292 | 'required' => false, |
| @@ -512,8 +518,15 @@ | ||
| 512 | 518 | 'permission_callback' => '__return_true', |
| 513 | 519 | 'args' => array( |
| 514 | 520 | 'dbs_source' => $this->get_param( 'dbs' ), |
| 515 | 521 | 'dbs_destination' => $this->get_param( 'dbs' ), |
| 522 | + 'appDbId' => array( | |
| 523 | + 'required' => false, | |
| 524 | + 'type' => 'integer', | |
| 525 | + 'description' => __( 'App Id', 'wp-data-access' ), | |
| 526 | + 'sanitize_callback' => 'absint', | |
| 527 | + 'validate_callback' => 'rest_validate_request_arg', | |
| 528 | + ), | |
| 516 | 529 | ), |
| 517 | 530 | ) ); |
| 518 | 531 | register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/lang/get', array( |
| 519 | 532 | 'methods' => array('POST'), |
| @@ -562,11 +575,144 @@ | ||
| 562 | 575 | 'validate_callback' => 'rest_validate_request_arg', |
| 563 | 576 | ), |
| 564 | 577 | ), |
| 565 | 578 | ) ); |
| 579 | + register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/proxy', array( | |
| 580 | + 'methods' => array('GET'), | |
| 581 | + 'callback' => array($this, 'app_proxy'), | |
| 582 | + 'permission_callback' => '__return_true', | |
| 583 | + 'args' => array( | |
| 584 | + 'app_id' => $this->get_param( 'app_id' ), | |
| 585 | + 'cnt_id' => $this->get_param( 'cnt_id' ), | |
| 586 | + 'url' => array( | |
| 587 | + 'required' => true, | |
| 588 | + 'type' => 'string', | |
| 589 | + 'description' => __( 'URL', 'wp-data-access' ), | |
| 590 | + 'sanitize_callback' => 'sanitize_text_field', | |
| 591 | + 'validate_callback' => 'rest_validate_request_arg', | |
| 592 | + ), | |
| 593 | + ), | |
| 594 | + ) ); | |
| 595 | + // PWA | |
| 596 | + register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/pwa/get', array( | |
| 597 | + 'methods' => array('POST'), | |
| 598 | + 'callback' => array($this, 'app_wpa_get'), | |
| 599 | + 'permission_callback' => '__return_true', | |
| 600 | + 'args' => array( | |
| 601 | + 'app_id' => $this->get_param( 'app_id' ), | |
| 602 | + ), | |
| 603 | + ) ); | |
| 604 | + register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/pwa/activate', array( | |
| 605 | + 'methods' => array('POST'), | |
| 606 | + 'callback' => array($this, 'app_wpa_activate'), | |
| 607 | + 'permission_callback' => '__return_true', | |
| 608 | + 'args' => array( | |
| 609 | + 'app_id' => $this->get_param( 'app_id' ), | |
| 610 | + ), | |
| 611 | + ) ); | |
| 612 | + register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/pwa/deactivate', array( | |
| 613 | + 'methods' => array('POST'), | |
| 614 | + 'callback' => array($this, 'app_wpa_deactivate'), | |
| 615 | + 'permission_callback' => '__return_true', | |
| 616 | + 'args' => array( | |
| 617 | + 'app_id' => $this->get_param( 'app_id' ), | |
| 618 | + ), | |
| 619 | + ) ); | |
| 620 | + register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/upload', array( | |
| 621 | + 'methods' => array('POST'), | |
| 622 | + 'callback' => array($this, 'app_upload'), | |
| 623 | + 'permission_callback' => '__return_true', | |
| 624 | + 'args' => array( | |
| 625 | + 'app_id' => $this->get_param( 'app_id' ), | |
| 626 | + 'cnt_id' => $this->get_param( 'cnt_id' ), | |
| 627 | + 'pk' => array( | |
| 628 | + 'required' => true, | |
| 629 | + 'type' => 'string', | |
| 630 | + 'description' => __( 'Primary key in JSON format', 'wp-data-access' ), | |
| 631 | + 'sanitize_callback' => 'sanitize_text_field', | |
| 632 | + 'validate_callback' => 'rest_validate_request_arg', | |
| 633 | + ), | |
| 634 | + 'col' => $this->get_param( 'col' ), | |
| 635 | + ), | |
| 636 | + ) ); | |
| 637 | + register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/download', array( | |
| 638 | + 'methods' => array('POST'), | |
| 639 | + 'callback' => array($this, 'app_download'), | |
| 640 | + 'permission_callback' => '__return_true', | |
| 641 | + 'args' => array( | |
| 642 | + 'app_id' => $this->get_param( 'app_id' ), | |
| 643 | + 'cnt_id' => $this->get_param( 'cnt_id' ), | |
| 644 | + 'pk' => array( | |
| 645 | + 'required' => true, | |
| 646 | + 'type' => 'string', | |
| 647 | + 'description' => __( 'Primary key in JSON format', 'wp-data-access' ), | |
| 648 | + 'sanitize_callback' => 'sanitize_text_field', | |
| 649 | + 'validate_callback' => 'rest_validate_request_arg', | |
| 650 | + ), | |
| 651 | + 'col' => $this->get_param( 'col' ), | |
| 652 | + ), | |
| 653 | + ) ); | |
| 566 | 654 | } |
| 567 | 655 | |
| 656 | + public function app_proxy( $request ) { | |
| 657 | + wp_die(); | |
| 658 | + } | |
| 659 | + | |
| 660 | + private function detect_image_mime( $body ) { | |
| 661 | + return null; | |
| 662 | + } | |
| 663 | + | |
| 664 | + private function is_safe_remote_url( $url, $allowed_hosts ) { | |
| 665 | + return false; | |
| 666 | + } | |
| 667 | + | |
| 668 | + private function is_public_ip( $ip ) { | |
| 669 | + return false; | |
| 670 | + } | |
| 671 | + | |
| 672 | + public function app_download( $request ) { | |
| 673 | + return $this->WPDA_Rest_Response( 'OK' ); | |
| 674 | + } | |
| 675 | + | |
| 676 | + public function app_upload( $request ) { | |
| 677 | + return $this->WPDA_Rest_Response( 'OK' ); | |
| 678 | + } | |
| 679 | + | |
| 680 | + public function app_wpa_deactivate( $request ) { | |
| 681 | + if ( !$this->current_user_can_access() ) { | |
| 682 | + // Only admins | |
| 683 | + return $this->unauthorized(); | |
| 684 | + } | |
| 685 | + if ( !$this->current_user_token_valid( $request ) ) { | |
| 686 | + return $this->invalid_nonce(); | |
| 687 | + } | |
| 688 | + return $this->WPDA_Rest_Response( 'OK' ); | |
| 689 | + } | |
| 690 | + | |
| 691 | + public function app_wpa_activate( $request ) { | |
| 692 | + if ( !$this->current_user_can_access() ) { | |
| 693 | + // Only admins | |
| 694 | + return $this->unauthorized(); | |
| 695 | + } | |
| 696 | + if ( !$this->current_user_token_valid( $request ) ) { | |
| 697 | + return $this->invalid_nonce(); | |
| 698 | + } | |
| 699 | + return $this->WPDA_Rest_Response( 'OK' ); | |
| 700 | + } | |
| 701 | + | |
| 702 | + public function app_wpa_get( $request ) { | |
| 703 | + if ( !$this->current_user_can_access() ) { | |
| 704 | + // Only admins | |
| 705 | + return $this->unauthorized(); | |
| 706 | + } | |
| 707 | + if ( !$this->current_user_token_valid( $request ) ) { | |
| 708 | + return $this->invalid_nonce(); | |
| 709 | + } | |
| 710 | + return $this->WPDA_Rest_Response( 'NOT FOUND' ); | |
| 711 | + } | |
| 712 | + | |
| 568 | 713 | public function app_call( $request ) { |
| 714 | + return $this->bad_request(); | |
| 569 | 715 | } |
| 570 | 716 | |
| 571 | 717 | public function app_lang_get( $request ) { |
| 572 | 718 | if ( !$this->current_user_can_access() ) { |
| @@ -826,8 +972,9 @@ | ||
| 826 | 972 | $search_column_fns, |
| 827 | 973 | &$default_where, |
| 828 | 974 | &$lookups |
| 829 | 975 | ) { |
| 976 | + return $this->bad_request(); | |
| 830 | 977 | } |
| 831 | 978 | |
| 832 | 979 | private function build_relationships( |
| 833 | 980 | $container, |
| @@ -834,8 +981,9 @@ | ||
| 834 | 981 | &$m2m_relationship, |
| 835 | 982 | $tbl, |
| 836 | 983 | &$default_where |
| 837 | 984 | ) { |
| 985 | + return $this->bad_request(); | |
| 838 | 986 | } |
| 839 | 987 | |
| 840 | 988 | public function app_select( $request ) { |
| 841 | 989 | $app_id = $request->get_param( 'app_id' ); |
| @@ -858,8 +1006,9 @@ | ||
| 858 | 1006 | $media = $request->get_param( 'media' ); |
| 859 | 1007 | $rel_tab = $request->get_param( 'rel_tab' ); |
| 860 | 1008 | $client_side = '1' === $request->get_param( 'client_side' ); |
| 861 | 1009 | $geo_radius = $request->get_param( 'geo_radius' ); |
| 1010 | + $docs = array(); | |
| 862 | 1011 | $default_where = ''; |
| 863 | 1012 | $default_orderby = ''; |
| 864 | 1013 | $lookups = array(); |
| 865 | 1014 | $m2m_relationship = array(); |
| @@ -907,8 +1056,27 @@ | ||
| 907 | 1056 | } |
| 908 | 1057 | } |
| 909 | 1058 | } |
| 910 | 1059 | } |
| 1060 | + if ( isset( $settings['columns'] ) && is_array( $settings['columns'] ) && '1' !== $rel_tab ) { | |
| 1061 | + $queryable_columns = array(); | |
| 1062 | + if ( isset( $settings['table']['columns'] ) && is_array( $settings['table']['columns'] ) ) { | |
| 1063 | + foreach ( $settings['table']['columns'] as $column ) { | |
| 1064 | + if ( isset( $column['queryable'] ) && $column['queryable'] ) { | |
| 1065 | + $queryable_columns[] = $column['columnName']; | |
| 1066 | + } | |
| 1067 | + } | |
| 1068 | + } | |
| 1069 | + $app_columns = array(); | |
| 1070 | + foreach ( $settings['columns'] as $column ) { | |
| 1071 | + if ( isset( $column['columnName'], $column['isSelected'] ) && $column['isSelected'] ) { | |
| 1072 | + $app_columns[$column['columnName']] = in_array( $column['columnName'], $queryable_columns ); | |
| 1073 | + } | |
| 1074 | + } | |
| 1075 | + if ( 0 < count( $app_columns ) ) { | |
| 1076 | + $col = $app_columns; | |
| 1077 | + } | |
| 1078 | + } | |
| 911 | 1079 | $table_api = new WPDA_Table(); |
| 912 | 1080 | return $table_api->select( |
| 913 | 1081 | $dbs, |
| 914 | 1082 | $tbl, |
| @@ -933,9 +1101,10 @@ | ||
| 933 | 1101 | $md, |
| 934 | 1102 | $m2m_relationship, |
| 935 | 1103 | $search_data_types, |
| 936 | 1104 | $client_side, |
| 937 | - $geo_radius | |
| 1105 | + $geo_radius, | |
| 1106 | + $docs | |
| 938 | 1107 | ); |
| 939 | 1108 | } else { |
| 940 | 1109 | if ( 'rest_cookie_invalid_nonce' === $msg ) { |
| 941 | 1110 | return $this->invalid_nonce(); |
| @@ -959,8 +1128,9 @@ | ||
| 959 | 1128 | return array_map( function ( $value ) { |
| 960 | 1129 | if ( true === $value['isSelected'] ) { |
| 961 | 1130 | return $value['columnName']; |
| 962 | 1131 | } |
| 1132 | + return null; | |
| 963 | 1133 | }, $columns ); |
| 964 | 1134 | } |
| 965 | 1135 | |
| 966 | 1136 | public function app_get( $request ) { |
| @@ -968,8 +1138,9 @@ | ||
| 968 | 1138 | $cnt_id = $request->get_param( 'cnt_id' ); |
| 969 | 1139 | $key = $request->get_param( 'key' ); |
| 970 | 1140 | $media = $request->get_param( 'media' ); |
| 971 | 1141 | $rel_tab = $request->get_param( 'rel_tab' ); |
| 1142 | + $docs = array(); | |
| 972 | 1143 | if ( $this->check_app_access( |
| 973 | 1144 | $app_id, |
| 974 | 1145 | $cnt_id, |
| 975 | 1146 | 'select', |
| @@ -989,9 +1160,10 @@ | ||
| 989 | 1160 | $tbl, |
| 990 | 1161 | $key, |
| 991 | 1162 | $media, |
| 992 | 1163 | $column_names, |
| 993 | - $default_where | |
| 1164 | + $default_where, | |
| 1165 | + $docs | |
| 994 | 1166 | ); |
| 995 | 1167 | } else { |
| 996 | 1168 | if ( 'rest_cookie_invalid_nonce' === $msg ) { |
| 997 | 1169 | return $this->invalid_nonce(); |
| @@ -1080,53 +1252,9 @@ | ||
| 1080 | 1252 | } |
| 1081 | 1253 | } |
| 1082 | 1254 | |
| 1083 | 1255 | public function app_update_inline( $request ) { |
| 1084 | - $app_id = $request->get_param( 'app_id' ); | |
| 1085 | - $cnt_id = $request->get_param( 'cnt_id' ); | |
| 1086 | - $key = $request->get_param( 'key' ); | |
| 1087 | - $val = $request->get_param( 'val' ); | |
| 1088 | - if ( $this->check_app_access( | |
| 1089 | - $app_id, | |
| 1090 | - $cnt_id, | |
| 1091 | - 'select', | |
| 1092 | - $dbs, | |
| 1093 | - $tbl, | |
| 1094 | - $msg, | |
| 1095 | - $settings | |
| 1096 | - ) ) { | |
| 1097 | - foreach ( $val as $column_name => $column ) { | |
| 1098 | - $found = false; | |
| 1099 | - if ( isset( $settings['table']['columns'] ) ) { | |
| 1100 | - foreach ( $settings['table']['columns'] as $settings_column ) { | |
| 1101 | - if ( isset( $settings_column['columnName'] ) && $column_name === $settings_column['columnName'] ) { | |
| 1102 | - $found = true; | |
| 1103 | - } | |
| 1104 | - } | |
| 1105 | - if ( !$found ) { | |
| 1106 | - return $this->unauthorized(); | |
| 1107 | - } | |
| 1108 | - } | |
| 1109 | - } | |
| 1110 | - $column_names = $this->get_app_form_columns( $settings ); | |
| 1111 | - if ( false === $column_names ) { | |
| 1112 | - $column_names = array(); | |
| 1113 | - } | |
| 1114 | - $table_api = new WPDA_Table(); | |
| 1115 | - return $table_api->update( | |
| 1116 | - $dbs, | |
| 1117 | - $tbl, | |
| 1118 | - $key, | |
| 1119 | - $val, | |
| 1120 | - $column_names | |
| 1121 | - ); | |
| 1122 | - } else { | |
| 1123 | - if ( 'rest_cookie_invalid_nonce' === $msg ) { | |
| 1124 | - return $this->invalid_nonce(); | |
| 1125 | - } else { | |
| 1126 | - return $this->unauthorized(); | |
| 1127 | - } | |
| 1128 | - } | |
| 1256 | + return $this->bad_request(); | |
| 1129 | 1257 | } |
| 1130 | 1258 | |
| 1131 | 1259 | public function app_delete( $request ) { |
| 1132 | 1260 | $app_id = $request->get_param( 'app_id' ); |
| @@ -1276,8 +1404,12 @@ | ||
| 1276 | 1404 | } |
| 1277 | 1405 | } |
| 1278 | 1406 | |
| 1279 | 1407 | public function app_lookup_dbs( $request ) { |
| 1408 | + // Only admins are allowed to configre lookups | |
| 1409 | + if ( !$this->current_user_can_access() ) { | |
| 1410 | + return $this->unauthorized(); | |
| 1411 | + } | |
| 1280 | 1412 | $app_id = $request->get_param( 'app_id' ); |
| 1281 | 1413 | $cnt_id = $request->get_param( 'cnt_id' ); |
| 1282 | 1414 | if ( $this->check_app_access( |
| 1283 | 1415 | $app_id, |
| @@ -1300,8 +1432,12 @@ | ||
| 1300 | 1432 | } |
| 1301 | 1433 | } |
| 1302 | 1434 | |
| 1303 | 1435 | public function app_lookup_tbl( $request ) { |
| 1436 | + // Only admins are allowed to configre lookups | |
| 1437 | + if ( !$this->current_user_can_access() ) { | |
| 1438 | + return $this->unauthorized(); | |
| 1439 | + } | |
| 1304 | 1440 | $app_id = $request->get_param( 'app_id' ); |
| 1305 | 1441 | $cnt_id = $request->get_param( 'cnt_id' ); |
| 1306 | 1442 | $dbs = $request->get_param( 'dbs' ); |
| 1307 | 1443 | if ( $this->check_app_access( |
| @@ -1325,8 +1461,12 @@ | ||
| 1325 | 1461 | } |
| 1326 | 1462 | } |
| 1327 | 1463 | |
| 1328 | 1464 | public function app_lookup_cls( $request ) { |
| 1465 | + // Only admins are allowed to configre lookups | |
| 1466 | + if ( !$this->current_user_can_access() ) { | |
| 1467 | + return $this->unauthorized(); | |
| 1468 | + } | |
| 1329 | 1469 | $app_id = $request->get_param( 'app_id' ); |
| 1330 | 1470 | $cnt_id = $request->get_param( 'cnt_id' ); |
| 1331 | 1471 | $dbs = $request->get_param( 'dbs' ); |
| 1332 | 1472 | $tbl = $request->get_param( 'tbl' ); |
| @@ -1375,8 +1515,68 @@ | ||
| 1375 | 1515 | $renamed = 0; |
| 1376 | 1516 | $debug_mode = 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG ); |
| 1377 | 1517 | $debug = array(); |
| 1378 | 1518 | $errors = array(); |
| 1519 | + if ( $request->get_param( 'appDbId' ) ) { | |
| 1520 | + // Update app only | |
| 1521 | + $appDbId = $request->get_param( 'appDbId' ); | |
| 1522 | + // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table | |
| 1523 | + $sql = $wpdb->prepare( "update `{$wpdb->prefix}wpda_app_container` set `cnt_dbs` = %s where `cnt_dbs` = %s and app_id = %d", array($dbs_destination, $dbs_source, $appDbId) ); | |
| 1524 | + $result = $wpdb->query( $sql ); | |
| 1525 | + // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared | |
| 1526 | + $renamed += $result; | |
| 1527 | + if ( $debug_mode ) { | |
| 1528 | + $debug[] = array( | |
| 1529 | + 'sql' => $sql, | |
| 1530 | + 'result' => $result, | |
| 1531 | + ); | |
| 1532 | + } | |
| 1533 | + if ( '' !== $wpdb->last_error ) { | |
| 1534 | + $errors[] = array( | |
| 1535 | + 'sql' => $sql, | |
| 1536 | + 'error' => $wpdb->last_error, | |
| 1537 | + ); | |
| 1538 | + } | |
| 1539 | + $sql_content = array("update `{$wpdb->prefix}wpda_app_container` set `cnt_table` = replace(`cnt_table`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_table` like '%\"dbs\":\"%1s\"%' and app_id = %d", "update `{$wpdb->prefix}wpda_app_container` set `cnt_form` = replace(`cnt_form`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_form` like '%\"dbs\":\"%1s\"%' and app_id = %d"); | |
| 1540 | + foreach ( $sql_content as $sql ) { | |
| 1541 | + // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table | |
| 1542 | + $result = $wpdb->query( $wpdb->prepare( $sql, array( | |
| 1543 | + $dbs_source, | |
| 1544 | + $dbs_destination, | |
| 1545 | + $dbs_source, | |
| 1546 | + $appDbId | |
| 1547 | + ) ) ); | |
| 1548 | + $renamed += $result; | |
| 1549 | + if ( $debug_mode ) { | |
| 1550 | + $debug[] = array( | |
| 1551 | + 'sql' => $sql, | |
| 1552 | + 'result' => $result, | |
| 1553 | + ); | |
| 1554 | + } | |
| 1555 | + if ( '' !== $wpdb->last_error ) { | |
| 1556 | + $errors[] = array( | |
| 1557 | + 'sql' => $sql, | |
| 1558 | + 'error' => $wpdb->last_error, | |
| 1559 | + ); | |
| 1560 | + } | |
| 1561 | + } | |
| 1562 | + $context = array(); | |
| 1563 | + if ( $debug_mode ) { | |
| 1564 | + $context['debug'] = $debug; | |
| 1565 | + } | |
| 1566 | + if ( 0 < count( $errors ) ) { | |
| 1567 | + $context['errors'] = $errors; | |
| 1568 | + return new \WP_Error('error', 'Failed renaming database', array( | |
| 1569 | + 'status' => 401, | |
| 1570 | + 'context' => $context, | |
| 1571 | + )); | |
| 1572 | + } | |
| 1573 | + return $this->WPDA_Rest_Response( sprintf( | |
| 1574 | + /* translators: %s = number of database substitutions */ | |
| 1575 | + __( 'Successfully renamed %s database occurrences', 'wp-data-access' ), | |
| 1576 | + $renamed | |
| 1577 | + ), null, $context ); | |
| 1578 | + } | |
| 1379 | 1579 | // Rename all occurrences in repository tables and apps |
| 1380 | 1580 | $sqls = array( |
| 1381 | 1581 | "update `{$wpdb->prefix}wpda_publisher` set `pub_schema_name` = %s where `pub_schema_name` = %s", |
| 1382 | 1582 | "update `{$wpdb->prefix}wpda_project_page` set `page_schema_name` = %s where `page_schema_name` = %s", |
| @@ -1387,9 +1587,11 @@ | ||
| 1387 | 1587 | "update `{$wpdb->prefix}wpda_table_settings` set `wpda_schema_name` = %s where `wpda_schema_name` = %s", |
| 1388 | 1588 | "update `{$wpdb->prefix}wpda_app_container` set `cnt_dbs` = %s where `cnt_dbs` = %s" |
| 1389 | 1589 | ); |
| 1390 | 1590 | foreach ( $sqls as $sql ) { |
| 1591 | + // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table | |
| 1391 | 1592 | $result = $wpdb->query( $wpdb->prepare( $sql, array($dbs_destination, $dbs_source) ) ); |
| 1593 | + // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared | |
| 1392 | 1594 | $renamed += $result; |
| 1393 | 1595 | if ( $debug_mode ) { |
| 1394 | 1596 | $debug[] = array( |
| 1395 | 1597 | 'sql' => $sql, |
| @@ -1404,8 +1606,9 @@ | ||
| 1404 | 1606 | } |
| 1405 | 1607 | } |
| 1406 | 1608 | $sql_content = array("update `{$wpdb->prefix}wpda_app_container` set `cnt_table` = replace(`cnt_table`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_table` like '%\"dbs\":\"%1s\"%'", "update `{$wpdb->prefix}wpda_app_container` set `cnt_form` = replace(`cnt_form`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_form` like '%\"dbs\":\"%1s\"%'"); |
| 1407 | 1609 | foreach ( $sql_content as $sql ) { |
| 1610 | + // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table | |
| 1408 | 1611 | $result = $wpdb->query( $wpdb->prepare( $sql, array($dbs_source, $dbs_destination, $dbs_source) ) ); |
| 1409 | 1612 | $renamed += $result; |
| 1410 | 1613 | if ( $debug_mode ) { |
| 1411 | 1614 | $debug[] = array( |
| @@ -1430,9 +1633,13 @@ | ||
| 1430 | 1633 | 'status' => 401, |
| 1431 | 1634 | 'context' => $context, |
| 1432 | 1635 | )); |
| 1433 | 1636 | } |
| 1434 | - return $this->WPDA_Rest_Response( sprintf( __( 'Successfully renamed %s database occurrences', 'wp-data-access' ), $renamed ), null, $context ); | |
| 1637 | + return $this->WPDA_Rest_Response( sprintf( | |
| 1638 | + /* translators: %s = number of database substitutions */ | |
| 1639 | + __( 'Successfully renamed %s database occurrences', 'wp-data-access' ), | |
| 1640 | + $renamed | |
| 1641 | + ), null, $context ); | |
| 1435 | 1642 | } |
| 1436 | 1643 | |
| 1437 | 1644 | public function app_chart_data( $request ) { |
| 1438 | 1645 | $app_id = $request->get_param( 'app_id' ); |
| @@ -1466,14 +1673,23 @@ | ||
| 1466 | 1673 | )); |
| 1467 | 1674 | } |
| 1468 | 1675 | $suppress = $wpdadb->suppress_errors( true ); |
| 1469 | 1676 | $chart_data = $wpdadb->get_results( $query, 'ARRAY_A' ); |
| 1677 | + // Add an * before each label to support numeric labels | |
| 1678 | + $chart_data_converted = array(); | |
| 1679 | + foreach ( $chart_data as $data ) { | |
| 1680 | + $row = array(); | |
| 1681 | + foreach ( $data as $key => $value ) { | |
| 1682 | + $row['*' . $key] = $value; | |
| 1683 | + } | |
| 1684 | + $chart_data_converted[] = $row; | |
| 1685 | + } | |
| 1470 | 1686 | $wpdadb->get_results( "create temporary table `wpda_chart_data_types` as {$query}", 'ARRAY_A' ); |
| 1471 | 1687 | $explain = $wpdadb->get_results( "desc `wpda_chart_data_types`", 'ARRAY_A' ); |
| 1472 | 1688 | $wpdadb->get_results( "drop temporary table `wpda_chart_data_types`", 'ARRAY_A' ); |
| 1473 | 1689 | $wpdadb->suppress_errors( $suppress ); |
| 1474 | 1690 | return array( |
| 1475 | - 'data' => $chart_data, | |
| 1691 | + 'data' => $chart_data_converted, | |
| 1476 | 1692 | 'explain' => $explain, |
| 1477 | 1693 | ); |
| 1478 | 1694 | } else { |
| 1479 | 1695 | return new \WP_Error('error', $msg, array( |
| @@ -1954,8 +2170,9 @@ | ||
| 1954 | 2170 | $app_id_details = array_map( function ( $e ) { |
| 1955 | 2171 | if ( isset( $e['app_id_detail'] ) ) { |
| 1956 | 2172 | return $e['app_id_detail']; |
| 1957 | 2173 | } |
| 2174 | + return null; | |
| 1958 | 2175 | }, $apps ); |
| 1959 | 2176 | $app_titles = array(); |
| 1960 | 2177 | foreach ( $app_id_details as $app_id_detail ) { |
| 1961 | 2178 | $app_detail = WPDA_App_Model::get_by_id( $app_id_detail ); |
| @@ -1993,16 +2210,43 @@ | ||
| 1993 | 2210 | $settings->wp = [ |
| 1994 | 2211 | 'roles' => $this->get_wp_roles(), |
| 1995 | 2212 | 'users' => $this->get_wp_users(), |
| 1996 | 2213 | 'home' => admin_url( 'admin.php' ), |
| 2214 | + 'siteurl' => site_url(), | |
| 1997 | 2215 | 'tables' => array_values( $wpdb->tables() ), |
| 1998 | 2216 | 'date_format' => get_option( 'date_format' ), |
| 1999 | 2217 | 'time_format' => get_option( 'time_format' ), |
| 2000 | 2218 | 'scroll_offset' => WPDA::get_option( WPDA::OPTION_APPS_SCROLL_OFFSET ), |
| 2219 | + 'upload' => @ini_get( 'upload_max_filesize' ), | |
| 2220 | + 'uploadBytes' => $this->uploadToBytes( @ini_get( 'upload_max_filesize' ) ), | |
| 2221 | + 'locale' => get_locale(), | |
| 2001 | 2222 | ]; |
| 2002 | 2223 | return $settings; |
| 2003 | 2224 | } |
| 2004 | 2225 | |
| 2226 | + /** | |
| 2227 | + * Convert a PHP shorthand notation (e.g., "2M", "512K", "1G") to bytes. | |
| 2228 | + * | |
| 2229 | + * @param string $val The shorthand size string. | |
| 2230 | + * | |
| 2231 | + * @return int The size in bytes. | |
| 2232 | + */ | |
| 2233 | + private function uploadToBytes( $val ) : int { | |
| 2234 | + $val = trim( $val ); | |
| 2235 | + $lastChar = strtolower( $val[strlen( $val ) - 1] ); | |
| 2236 | + $num = (float) $val; | |
| 2237 | + switch ( $lastChar ) { | |
| 2238 | + case 'g': | |
| 2239 | + $num *= 1024; | |
| 2240 | + case 'm': | |
| 2241 | + $num *= 1024; | |
| 2242 | + case 'k': | |
| 2243 | + $num *= 1024; | |
| 2244 | + break; | |
| 2245 | + } | |
| 2246 | + return (int) round( $num ); | |
| 2247 | + } | |
| 2248 | + | |
| 2005 | 2249 | private function get_app_container_meta( $app_id, $container, $rel_tab = false ) { |
| 2006 | 2250 | $app = WPDA_App_Model::get_by_id( $app_id ); |
| 2007 | 2251 | if ( false === $app ) { |
| 2008 | 2252 | return $this->bad_request(); |
| @@ -2079,8 +2323,17 @@ | ||
| 2079 | 2323 | return $this->get_app_container_meta( $app_id, $container ); |
| 2080 | 2324 | } |
| 2081 | 2325 | } |
| 2082 | 2326 | |
| 2327 | + private function escapeUnicodeForExport( $str ) { | |
| 2328 | + if ( empty( $str ) ) { | |
| 2329 | + return $str; | |
| 2330 | + } | |
| 2331 | + return preg_replace_callback( '/\\\\(u[0-9a-fA-F]{4})/', function ( $matches ) { | |
| 2332 | + return '\\\\' . $matches[1]; | |
| 2333 | + }, $str ); | |
| 2334 | + } | |
| 2335 | + | |
| 2083 | 2336 | private function do_app_export_app( $app_id, $main_app_id ) { |
| 2084 | 2337 | global $wpdb; |
| 2085 | 2338 | $quotes = function ( $value ) { |
| 2086 | 2339 | return str_replace( array( |
| @@ -2090,9 +2343,10 @@ | ||
| 2090 | 2343 | "\\t", |
| 2091 | 2344 | "\\\\n", |
| 2092 | 2345 | "\\n", |
| 2093 | 2346 | "\\r\\n", |
| 2094 | - "\\r" | |
| 2347 | + "\\r", | |
| 2348 | + "\\d" | |
| 2095 | 2349 | ), array( |
| 2096 | 2350 | "''", |
| 2097 | 2351 | '\\\\"', |
| 2098 | 2352 | "\\\\\\t", |
| @@ -2099,14 +2353,16 @@ | ||
| 2099 | 2353 | "\\\\t", |
| 2100 | 2354 | "\\\\\\n", |
| 2101 | 2355 | "\\\\n", |
| 2102 | 2356 | "\\\\r\\\\n", |
| 2103 | - "\\\\r" | |
| 2357 | + "\\\\r", | |
| 2358 | + "\\\\\\\\\\d" | |
| 2104 | 2359 | ), $value ); |
| 2105 | 2360 | }; |
| 2106 | 2361 | $app = WPDA_App_Model::get_by_id( $app_id ); |
| 2107 | 2362 | $app_settings = ( null === $app[0]['app_settings'] ? 'null' : "{$quotes( $app[0]['app_settings'] )}" ); |
| 2108 | 2363 | $app_theme = ( null === $app[0]['app_theme'] ? 'null' : "{$quotes( $app[0]['app_theme'] )}" ); |
| 2364 | + // phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed | |
| 2109 | 2365 | $app_sql = <<<SQL |
| 2110 | 2366 | # Import app |
| 2111 | 2367 | insert into `{wp_prefix}wpda_app` |
| 2112 | 2368 | \t(`app_name` |
| @@ -2147,8 +2403,12 @@ | ||
| 2147 | 2403 | // Replace default WordPress database with conversion string |
| 2148 | 2404 | $cnt_dbs = ( $wpdb->dbname === $container['cnt_dbs'] ? '{wp_schema}' : "{$quotes( $container['cnt_dbs'] )}" ); |
| 2149 | 2405 | $cnt_table = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_table ); |
| 2150 | 2406 | $cnt_form = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_form ); |
| 2407 | + // Replace Unicode characters | |
| 2408 | + $cnt_table = $this->escapeUnicodeForExport( $cnt_table ); | |
| 2409 | + $cnt_form = $this->escapeUnicodeForExport( $cnt_form ); | |
| 2410 | + // phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed | |
| 2151 | 2411 | $containers_sql .= <<<SQL |
| 2152 | 2412 | # Import app container |
| 2153 | 2413 | insert into `{wp_prefix}wpda_app_container` |
| 2154 | 2414 | \t(`cnt_dbs` |
| @@ -2190,8 +2450,9 @@ | ||
| 2190 | 2450 | |
| 2191 | 2451 | SQL; |
| 2192 | 2452 | } |
| 2193 | 2453 | // Post update: update master container ids |
| 2454 | + // phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed | |
| 2194 | 2455 | $containers_sql .= <<<SQL |
| 2195 | 2456 | # Update app master container IDs |
| 2196 | 2457 | update `{wp_prefix}wpda_app_container` as a |
| 2197 | 2458 | set a.`cnt_relation` = |
| @@ -2214,8 +2475,9 @@ | ||
| 2214 | 2475 | foreach ( $apps as $app ) { |
| 2215 | 2476 | $apps_sql .= $this->do_app_export_app( $app['app_id_detail'], $main_app_id ); |
| 2216 | 2477 | } |
| 2217 | 2478 | foreach ( $apps as $app ) { |
| 2479 | + // phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed | |
| 2218 | 2480 | $apps_sql .= <<<SQL |
| 2219 | 2481 | # Import app relationships |
| 2220 | 2482 | insert into `{wp_prefix}wpda_app_apps` |
| 2221 | 2483 | \t(`app_id` |
| @@ -2236,8 +2498,9 @@ | ||
| 2236 | 2498 | |
| 2237 | 2499 | private function do_app_export( $app_id ) { |
| 2238 | 2500 | global $wpdb; |
| 2239 | 2501 | $sql = ''; |
| 2502 | + // phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed | |
| 2240 | 2503 | $begin_sql = <<<SQL |
| 2241 | 2504 | /*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */; |
| 2242 | 2505 | /*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */; |
| 2243 | 2506 | /*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */; |
| @@ -2258,8 +2521,9 @@ | ||
| 2258 | 2521 | |
| 2259 | 2522 | |
| 2260 | 2523 | SQL; |
| 2261 | 2524 | $sql .= $this->do_app_export_app( $app_id, $app_id ); |
| 2525 | + // phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed | |
| 2262 | 2526 | $end_sql = <<<SQL |
| 2263 | 2527 | # Drop temporary table |
| 2264 | 2528 | DROP TABLE `wpda_transfer_containers_{$app_id}`; |
| 2265 | 2529 | DROP TABLE `wpda_transfer_apps_{$app_id}`; |
| @@ -2451,14 +2715,16 @@ | ||
| 2451 | 2715 | $dynamic_params = array() |
| 2452 | 2716 | ) { |
| 2453 | 2717 | // Process $search_custom > URL parameters |
| 2454 | 2718 | global $wpdb; |
| 2719 | + $replacements = array(); | |
| 2720 | + $nonce = bin2hex( random_bytes( 8 ) ); | |
| 2455 | 2721 | foreach ( self::METHODS as $method ) { |
| 2456 | 2722 | $offset = 0; |
| 2457 | 2723 | $search = $method . '['; |
| 2724 | + // Get filter | |
| 2458 | 2725 | while ( ($pos_start = stripos( $where, $search, $offset )) !== false ) { |
| 2459 | 2726 | if ( ($pos_end = stripos( $where, ']', $pos_start )) !== false ) { |
| 2460 | - // Get filter | |
| 2461 | 2727 | $filter = substr( $where, $pos_start, $pos_end - $pos_start + 1 ); |
| 2462 | 2728 | // Get name |
| 2463 | 2729 | $arg_name = substr( $where, $pos_start + strlen( $search ), $pos_end - $pos_start - strlen( $search ) ); |
| 2464 | 2730 | // Remove quotes from name |
| @@ -2464,61 +2730,33 @@ | ||
| 2464 | 2730 | // Remove quotes from name |
| 2465 | 2731 | if ( substr( $arg_name, 0, 1 ) === "'" && substr( $arg_name, -1 ) === "'" ) { |
| 2466 | 2732 | $arg_name = substr( $arg_name, 1, -1 ); |
| 2467 | 2733 | } |
| 2468 | - // Remove double quotes from name | |
| 2734 | + // Remove quotes from name | |
| 2469 | 2735 | if ( substr( $arg_name, 0, 1 ) === '"' && substr( $arg_name, -1 ) === '"' ) { |
| 2470 | 2736 | $arg_name = substr( $arg_name, 1, -1 ); |
| 2471 | 2737 | } |
| 2738 | + $arg_value = null; | |
| 2472 | 2739 | // Handle GET args |
| 2473 | - if ( $method === self::METHODS[0] ) { | |
| 2740 | + if ( $method === self::METHODS[0] && isset( $search_custom['get'][$arg_name] ) ) { | |
| 2741 | + $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) ); | |
| 2742 | + } elseif ( $method === self::METHODS[1] && isset( $search_custom['post'][$arg_name] ) ) { | |
| 2743 | + $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) ); | |
| 2744 | + } elseif ( $method === self::METHODS[2] ) { | |
| 2474 | 2745 | if ( isset( $search_custom['get'][$arg_name] ) ) { |
| 2475 | 2746 | $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) ); |
| 2476 | - $where = $wpdb->prepare( substr_replace( | |
| 2477 | - $where, | |
| 2478 | - '%s', | |
| 2479 | - $pos_start, | |
| 2480 | - $pos_end - $pos_start + 1 | |
| 2481 | - ), $arg_value ); | |
| 2482 | - } else { | |
| 2483 | - $where = str_replace( $filter, 'null', $where ); | |
| 2747 | + } elseif ( isset( $search_custom['post'][$arg_name] ) ) { | |
| 2748 | + $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) ); | |
| 2484 | 2749 | } |
| 2485 | 2750 | } |
| 2486 | 2751 | // Handle POST args |
| 2487 | - if ( $method === self::METHODS[1] ) { | |
| 2488 | - if ( isset( $search_custom['post'][$arg_name] ) ) { | |
| 2489 | - $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) ); | |
| 2490 | - $where = $wpdb->prepare( substr_replace( | |
| 2491 | - $where, | |
| 2492 | - '%s', | |
| 2493 | - $pos_start, | |
| 2494 | - $pos_end - $pos_start + 1 | |
| 2495 | - ), $arg_value ); | |
| 2496 | - } else { | |
| 2497 | - $where = str_replace( $filter, 'null', $where ); | |
| 2498 | - } | |
| 2499 | - } | |
| 2752 | + $placeholder = '###URL_PLACEHOLDER_' . $nonce . '_' . md5( $filter ) . '###'; | |
| 2753 | + $where = str_replace( $filter, $placeholder, $where ); | |
| 2500 | 2754 | // Handle REQUEST args |
| 2501 | - if ( $method === self::METHODS[2] ) { | |
| 2502 | - if ( isset( $search_custom['get'][$arg_name] ) ) { | |
| 2503 | - $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) ); | |
| 2504 | - $where = $wpdb->prepare( substr_replace( | |
| 2505 | - $where, | |
| 2506 | - '%s', | |
| 2507 | - $pos_start, | |
| 2508 | - $pos_end - $pos_start + 1 | |
| 2509 | - ), $arg_value ); | |
| 2510 | - } elseif ( isset( $search_custom['post'][$arg_name] ) ) { | |
| 2511 | - $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) ); | |
| 2512 | - $where = $wpdb->prepare( substr_replace( | |
| 2513 | - $where, | |
| 2514 | - '%s', | |
| 2515 | - $pos_start, | |
| 2516 | - $pos_end - $pos_start + 1 | |
| 2517 | - ), $arg_value ); | |
| 2518 | - } else { | |
| 2519 | - $where = str_replace( $filter, 'null', $where ); | |
| 2520 | - } | |
| 2755 | + if ( $arg_value !== null ) { | |
| 2756 | + $replacements[$placeholder] = $wpdb->prepare( '%s', $arg_value ); | |
| 2757 | + } else { | |
| 2758 | + $replacements[$placeholder] = 'null'; | |
| 2521 | 2759 | } |
| 2522 | 2760 | } |
| 2523 | 2761 | $offset = $pos_start + 1; |
| 2524 | 2762 | if ( $offset > strlen( $where ) ) { |
| @@ -2530,21 +2768,16 @@ | ||
| 2530 | 2768 | if ( is_array( $search_params ) && 1 === count( $search_params ) ) { |
| 2531 | 2769 | $filter_field_name = $this->sanitize_db_identifier( array_keys( $search_params )[0] ); |
| 2532 | 2770 | $filter_field_value = sanitize_text_field( $search_params[$filter_field_name] ); |
| 2533 | 2771 | $filter_field_name_array = array_map( 'trim', explode( ',', $filter_field_name ) ); |
| 2534 | - //phpcs:ignore - 8.1 proof | |
| 2535 | 2772 | $filter_field_value_array = array_map( 'trim', explode( ',', $filter_field_value ) ); |
| 2536 | - //phpcs:ignore - 8.1 proof | |
| 2537 | 2773 | if ( count( $filter_field_name_array ) === count( $filter_field_value_array ) ) { |
| 2538 | - //phpcs:ignore - 8.1 proof | |
| 2539 | 2774 | // Add filter to where clause. |
| 2540 | 2775 | for ($i = 0; $i < count( $filter_field_name_array ); $i++) { |
| 2541 | - // phpcs:ignore Generic.CodeAnalysis.ForLoopWithTestFunctionCall, Squiz.PHP.DisallowSizeFunctionsInLoops | |
| 2542 | - $where .= (( '' === $where ? '' : ' and ' )) . $wpdb->prepare( | |
| 2543 | - ' `%1s` like %s ', | |
| 2544 | - // phpcs:ignore WordPress.DB.PreparedSQLPlaceholders | |
| 2545 | - array($filter_field_name_array[$i], $filter_field_value_array[$i]) | |
| 2546 | - ); | |
| 2776 | + $where .= ( '' === $where ? '' : ' and ' ); | |
| 2777 | + $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $filter_field_name_array[$i] ) . '###'; | |
| 2778 | + $where .= ' `' . $filter_field_name_array[$i] . '` like ' . $placeholder; | |
| 2779 | + $replacements[$placeholder] = $wpdb->prepare( '%s', $filter_field_value_array[$i] ); | |
| 2547 | 2780 | } |
| 2548 | 2781 | } |
| 2549 | 2782 | } |
| 2550 | 2783 | // Substitute all shortcode parameters |
| @@ -2551,13 +2784,11 @@ | ||
| 2551 | 2784 | if ( is_array( $shortcode_params ) ) { |
| 2552 | 2785 | foreach ( $shortcode_params as $column_name => $column_value ) { |
| 2553 | 2786 | $occurences = substr_count( strtolower( $where ), strtolower( "shortcodeParam['{$column_name}']" ) ); |
| 2554 | 2787 | if ( 0 < $occurences ) { |
| 2555 | - $column_values = array(); | |
| 2556 | - for ($i = 0; $i < $occurences; $i++) { | |
| 2557 | - $column_values[] = sanitize_text_field( $column_value ); | |
| 2558 | - } | |
| 2559 | - $where = $wpdb->prepare( str_ireplace( "shortcodeParam['{$column_name}']", '%s', $where ), $column_values ); | |
| 2788 | + $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $column_name ) . '###'; | |
| 2789 | + $where = str_ireplace( "shortcodeParam['{$column_name}']", $placeholder, $where ); | |
| 2790 | + $replacements[$placeholder] = $wpdb->prepare( '%s', sanitize_text_field( $column_value ) ); | |
| 2560 | 2791 | } |
| 2561 | 2792 | } |
| 2562 | 2793 | } |
| 2563 | 2794 | // Substitute all unused shortcode parameter calls with null |
| @@ -2575,11 +2806,15 @@ | ||
| 2575 | 2806 | } |
| 2576 | 2807 | // Substitute all dynamic parameters |
| 2577 | 2808 | if ( is_array( $dynamic_params ) && 0 < count( $dynamic_params ) ) { |
| 2578 | 2809 | foreach ( $dynamic_params as $column_name => $column_value ) { |
| 2579 | - $where = $wpdb->prepare( str_ireplace( "{:{$column_name}}", '%s', $where ), $column_value ); | |
| 2810 | + if ( stripos( $where, "{:{$column_name}}" ) !== false ) { | |
| 2811 | + $placeholder = '###DYNAMIC_PARAM_' . $nonce . '_' . md5( $column_name ) . '###'; | |
| 2812 | + $where = str_ireplace( "{:{$column_name}}", $placeholder, $where ); | |
| 2813 | + $replacements[$placeholder] = $wpdb->prepare( '%s', $column_value ); | |
| 2814 | + } | |
| 2580 | 2815 | } |
| 2581 | 2816 | } |
| 2582 | - return $where; | |
| 2817 | + return strtr( $where, $replacements ); | |
| 2583 | 2818 | } |
| 2584 | 2819 | |
| 2585 | 2820 | } |
