← All changes | WPDataAccess/API/WPDA_Apps.php +268 -70 5.5.79 → 5.5.87 View file →

		@@ -3,9 +3,8 @@
3	3	namespace WPDataAccess\API;
4	4
5	5	use stdClass;
6	6	use WPDataAccess\Connection\WPDADB;
7		-use WPDataAccess\Data_Apps\WPDA_PWA;
8	7	use WPDataAccess\Data_Dictionary\WPDA_List_Columns_Cache;
9	8	use WPDataAccess\Plugin_Table_Models\WPDA_App_Container_Model;
10	9	use WPDataAccess\Plugin_Table_Models\WPDA_App_Apps_Model;
11	10	use WPDataAccess\Plugin_Table_Models\WPDA_App_Model;
		@@ -281,9 +280,13 @@
281	280	'map' => array(
282	281	'required' => false,
283	282	'type' => 'string',
284	283	'description' => __( 'Map settings - JSON string', 'wp-data-access' ),
285		- 'sanitize_callback' => 'wp_kses_post',
	284	+ 'sanitize_callback' => function ( $param ) {
	285	+ $sanitized_settings = $this->sanitize_settings( json_decode( (string) $param, true ) );
	286	+ // Save sanitized JSON as string
	287	+ return json_encode( $sanitized_settings );
	288	+ },
286	289	'validate_callback' => 'rest_validate_request_arg',
287	290	),
288	291	'chart' => array(
289	292	'required' => false,
		@@ -515,8 +518,15 @@
515	518	'permission_callback' => '__return_true',
516	519	'args' => array(
517	520	'dbs_source' => $this->get_param( 'dbs' ),
518	521	'dbs_destination' => $this->get_param( 'dbs' ),
	522	+ 'appDbId' => array(
	523	+ 'required' => false,
	524	+ 'type' => 'integer',
	525	+ 'description' => __( 'App Id', 'wp-data-access' ),
	526	+ 'sanitize_callback' => 'absint',
	527	+ 'validate_callback' => 'rest_validate_request_arg',
	528	+ ),
519	529	),
520	530	) );
521	531	register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/lang/get', array(
522	532	'methods' => array('POST'),
		@@ -565,8 +575,24 @@
565	575	'validate_callback' => 'rest_validate_request_arg',
566	576	),
567	577	),
568	578	) );
	579	+ register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/proxy', array(
	580	+ 'methods' => array('GET'),
	581	+ 'callback' => array($this, 'app_proxy'),
	582	+ 'permission_callback' => '__return_true',
	583	+ 'args' => array(
	584	+ 'app_id' => $this->get_param( 'app_id' ),
	585	+ 'cnt_id' => $this->get_param( 'cnt_id' ),
	586	+ 'url' => array(
	587	+ 'required' => true,
	588	+ 'type' => 'string',
	589	+ 'description' => __( 'URL', 'wp-data-access' ),
	590	+ 'sanitize_callback' => 'sanitize_text_field',
	591	+ 'validate_callback' => 'rest_validate_request_arg',
	592	+ ),
	593	+ ),
	594	+ ) );
569	595	// PWA
570	596	register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/pwa/get', array(
571	597	'methods' => array('POST'),
572	598	'callback' => array($this, 'app_wpa_get'),
		@@ -590,10 +616,68 @@
590	616	'args' => array(
591	617	'app_id' => $this->get_param( 'app_id' ),
592	618	),
593	619	) );
	620	+ register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/upload', array(
	621	+ 'methods' => array('POST'),
	622	+ 'callback' => array($this, 'app_upload'),
	623	+ 'permission_callback' => '__return_true',
	624	+ 'args' => array(
	625	+ 'app_id' => $this->get_param( 'app_id' ),
	626	+ 'cnt_id' => $this->get_param( 'cnt_id' ),
	627	+ 'pk' => array(
	628	+ 'required' => true,
	629	+ 'type' => 'string',
	630	+ 'description' => __( 'Primary key in JSON format', 'wp-data-access' ),
	631	+ 'sanitize_callback' => 'sanitize_text_field',
	632	+ 'validate_callback' => 'rest_validate_request_arg',
	633	+ ),
	634	+ 'col' => $this->get_param( 'col' ),
	635	+ ),
	636	+ ) );
	637	+ register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/download', array(
	638	+ 'methods' => array('POST'),
	639	+ 'callback' => array($this, 'app_download'),
	640	+ 'permission_callback' => '__return_true',
	641	+ 'args' => array(
	642	+ 'app_id' => $this->get_param( 'app_id' ),
	643	+ 'cnt_id' => $this->get_param( 'cnt_id' ),
	644	+ 'pk' => array(
	645	+ 'required' => true,
	646	+ 'type' => 'string',
	647	+ 'description' => __( 'Primary key in JSON format', 'wp-data-access' ),
	648	+ 'sanitize_callback' => 'sanitize_text_field',
	649	+ 'validate_callback' => 'rest_validate_request_arg',
	650	+ ),
	651	+ 'col' => $this->get_param( 'col' ),
	652	+ ),
	653	+ ) );
594	654	}
595	655
	656	+ public function app_proxy( $request ) {
	657	+ wp_die();
	658	+ }
	659	+
	660	+ private function detect_image_mime( $body ) {
	661	+ return null;
	662	+ }
	663	+
	664	+ private function is_safe_remote_url( $url, $allowed_hosts ) {
	665	+ return false;
	666	+ }
	667	+
	668	+ private function is_public_ip( $ip ) {
	669	+ return false;
	670	+ }
	671	+
	672	+ public function app_download( $request ) {
	673	+ return $this->WPDA_Rest_Response( 'OK' );
	674	+ }
	675	+
	676	+ public function app_upload( $request ) {
	677	+ return $this->WPDA_Rest_Response( 'OK' );
	678	+ }
	679	+
596	680	public function app_wpa_deactivate( $request ) {
597	681	if ( !$this->current_user_can_access() ) {
598	682	// Only admins
599	683	return $this->unauthorized();
		@@ -922,8 +1006,9 @@
922	1006	$media = $request->get_param( 'media' );
923	1007	$rel_tab = $request->get_param( 'rel_tab' );
924	1008	$client_side = '1' === $request->get_param( 'client_side' );
925	1009	$geo_radius = $request->get_param( 'geo_radius' );
	1010	+ $docs = array();
926	1011	$default_where = '';
927	1012	$default_orderby = '';
928	1013	$lookups = array();
929	1014	$m2m_relationship = array();
		@@ -971,8 +1056,27 @@
971	1056	}
972	1057	}
973	1058	}
974	1059	}
	1060	+ if ( isset( $settings['columns'] ) && is_array( $settings['columns'] ) && '1' !== $rel_tab ) {
	1061	+ $queryable_columns = array();
	1062	+ if ( isset( $settings['table']['columns'] ) && is_array( $settings['table']['columns'] ) ) {
	1063	+ foreach ( $settings['table']['columns'] as $column ) {
	1064	+ if ( isset( $column['queryable'] ) && $column['queryable'] ) {
	1065	+ $queryable_columns[] = $column['columnName'];
	1066	+ }
	1067	+ }
	1068	+ }
	1069	+ $app_columns = array();
	1070	+ foreach ( $settings['columns'] as $column ) {
	1071	+ if ( isset( $column['columnName'], $column['isSelected'] ) && $column['isSelected'] ) {
	1072	+ $app_columns[$column['columnName']] = in_array( $column['columnName'], $queryable_columns );
	1073	+ }
	1074	+ }
	1075	+ if ( 0 < count( $app_columns ) ) {
	1076	+ $col = $app_columns;
	1077	+ }
	1078	+ }
975	1079	$table_api = new WPDA_Table();
976	1080	return $table_api->select(
977	1081	$dbs,
978	1082	$tbl,
		@@ -997,9 +1101,10 @@
997	1101	$md,
998	1102	$m2m_relationship,
999	1103	$search_data_types,
1000	1104	$client_side,
1001		- $geo_radius
	1105	+ $geo_radius,
	1106	+ $docs
1002	1107	);
1003	1108	} else {
1004	1109	if ( 'rest_cookie_invalid_nonce' === $msg ) {
1005	1110	return $this->invalid_nonce();
		@@ -1023,8 +1128,9 @@
1023	1128	return array_map( function ( $value ) {
1024	1129	if ( true === $value['isSelected'] ) {
1025	1130	return $value['columnName'];
1026	1131	}
	1132	+ return null;
1027	1133	}, $columns );
1028	1134	}
1029	1135
1030	1136	public function app_get( $request ) {
		@@ -1032,8 +1138,9 @@
1032	1138	$cnt_id = $request->get_param( 'cnt_id' );
1033	1139	$key = $request->get_param( 'key' );
1034	1140	$media = $request->get_param( 'media' );
1035	1141	$rel_tab = $request->get_param( 'rel_tab' );
	1142	+ $docs = array();
1036	1143	if ( $this->check_app_access(
1037	1144	$app_id,
1038	1145	$cnt_id,
1039	1146	'select',
		@@ -1053,9 +1160,10 @@
1053	1160	$tbl,
1054	1161	$key,
1055	1162	$media,
1056	1163	$column_names,
1057		- $default_where
	1164	+ $default_where,
	1165	+ $docs
1058	1166	);
1059	1167	} else {
1060	1168	if ( 'rest_cookie_invalid_nonce' === $msg ) {
1061	1169	return $this->invalid_nonce();
		@@ -1296,8 +1404,12 @@
1296	1404	}
1297	1405	}
1298	1406
1299	1407	public function app_lookup_dbs( $request ) {
	1408	+ // Only admins are allowed to configre lookups
	1409	+ if ( !$this->current_user_can_access() ) {
	1410	+ return $this->unauthorized();
	1411	+ }
1300	1412	$app_id = $request->get_param( 'app_id' );
1301	1413	$cnt_id = $request->get_param( 'cnt_id' );
1302	1414	if ( $this->check_app_access(
1303	1415	$app_id,
		@@ -1320,8 +1432,12 @@
1320	1432	}
1321	1433	}
1322	1434
1323	1435	public function app_lookup_tbl( $request ) {
	1436	+ // Only admins are allowed to configre lookups
	1437	+ if ( !$this->current_user_can_access() ) {
	1438	+ return $this->unauthorized();
	1439	+ }
1324	1440	$app_id = $request->get_param( 'app_id' );
1325	1441	$cnt_id = $request->get_param( 'cnt_id' );
1326	1442	$dbs = $request->get_param( 'dbs' );
1327	1443	if ( $this->check_app_access(
		@@ -1345,8 +1461,12 @@
1345	1461	}
1346	1462	}
1347	1463
1348	1464	public function app_lookup_cls( $request ) {
	1465	+ // Only admins are allowed to configre lookups
	1466	+ if ( !$this->current_user_can_access() ) {
	1467	+ return $this->unauthorized();
	1468	+ }
1349	1469	$app_id = $request->get_param( 'app_id' );
1350	1470	$cnt_id = $request->get_param( 'cnt_id' );
1351	1471	$dbs = $request->get_param( 'dbs' );
1352	1472	$tbl = $request->get_param( 'tbl' );
		@@ -1395,8 +1515,68 @@
1395	1515	$renamed = 0;
1396	1516	$debug_mode = 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG );
1397	1517	$debug = array();
1398	1518	$errors = array();
	1519	+ if ( $request->get_param( 'appDbId' ) ) {
	1520	+ // Update app only
	1521	+ $appDbId = $request->get_param( 'appDbId' );
	1522	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table
	1523	+ $sql = $wpdb->prepare( "update `{$wpdb->prefix}wpda_app_container` set `cnt_dbs` = %s where `cnt_dbs` = %s and app_id = %d", array($dbs_destination, $dbs_source, $appDbId) );
	1524	+ $result = $wpdb->query( $sql );
	1525	+ // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared
	1526	+ $renamed += $result;
	1527	+ if ( $debug_mode ) {
	1528	+ $debug[] = array(
	1529	+ 'sql' => $sql,
	1530	+ 'result' => $result,
	1531	+ );
	1532	+ }
	1533	+ if ( '' !== $wpdb->last_error ) {
	1534	+ $errors[] = array(
	1535	+ 'sql' => $sql,
	1536	+ 'error' => $wpdb->last_error,
	1537	+ );
	1538	+ }
	1539	+ $sql_content = array("update `{$wpdb->prefix}wpda_app_container` set `cnt_table` = replace(`cnt_table`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_table` like '%\"dbs\":\"%1s\"%' and app_id = %d", "update `{$wpdb->prefix}wpda_app_container` set `cnt_form` = replace(`cnt_form`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_form` like '%\"dbs\":\"%1s\"%' and app_id = %d");
	1540	+ foreach ( $sql_content as $sql ) {
	1541	+ // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table
	1542	+ $result = $wpdb->query( $wpdb->prepare( $sql, array(
	1543	+ $dbs_source,
	1544	+ $dbs_destination,
	1545	+ $dbs_source,
	1546	+ $appDbId
	1547	+ ) ) );
	1548	+ $renamed += $result;
	1549	+ if ( $debug_mode ) {
	1550	+ $debug[] = array(
	1551	+ 'sql' => $sql,
	1552	+ 'result' => $result,
	1553	+ );
	1554	+ }
	1555	+ if ( '' !== $wpdb->last_error ) {
	1556	+ $errors[] = array(
	1557	+ 'sql' => $sql,
	1558	+ 'error' => $wpdb->last_error,
	1559	+ );
	1560	+ }
	1561	+ }
	1562	+ $context = array();
	1563	+ if ( $debug_mode ) {
	1564	+ $context['debug'] = $debug;
	1565	+ }
	1566	+ if ( 0 < count( $errors ) ) {
	1567	+ $context['errors'] = $errors;
	1568	+ return new \WP_Error('error', 'Failed renaming database', array(
	1569	+ 'status' => 401,
	1570	+ 'context' => $context,
	1571	+ ));
	1572	+ }
	1573	+ return $this->WPDA_Rest_Response( sprintf(
	1574	+ /* translators: %s = number of database substitutions */
	1575	+ __( 'Successfully renamed %s database occurrences', 'wp-data-access' ),
	1576	+ $renamed
	1577	+ ), null, $context );
	1578	+ }
1399	1579	// Rename all occurrences in repository tables and apps
1400	1580	$sqls = array(
1401	1581	"update `{$wpdb->prefix}wpda_publisher` set `pub_schema_name` = %s where `pub_schema_name` = %s",
1402	1582	"update `{$wpdb->prefix}wpda_project_page` set `page_schema_name` = %s where `page_schema_name` = %s",
		@@ -1493,14 +1673,23 @@
1493	1673	));
1494	1674	}
1495	1675	$suppress = $wpdadb->suppress_errors( true );
1496	1676	$chart_data = $wpdadb->get_results( $query, 'ARRAY_A' );
	1677	+ // Add an * before each label to support numeric labels
	1678	+ $chart_data_converted = array();
	1679	+ foreach ( $chart_data as $data ) {
	1680	+ $row = array();
	1681	+ foreach ( $data as $key => $value ) {
	1682	+ $row['*' . $key] = $value;
	1683	+ }
	1684	+ $chart_data_converted[] = $row;
	1685	+ }
1497	1686	$wpdadb->get_results( "create temporary table `wpda_chart_data_types` as {$query}", 'ARRAY_A' );
1498	1687	$explain = $wpdadb->get_results( "desc `wpda_chart_data_types`", 'ARRAY_A' );
1499	1688	$wpdadb->get_results( "drop temporary table `wpda_chart_data_types`", 'ARRAY_A' );
1500	1689	$wpdadb->suppress_errors( $suppress );
1501	1690	return array(
1502		- 'data' => $chart_data,
	1691	+ 'data' => $chart_data_converted,
1503	1692	'explain' => $explain,
1504	1693	);
1505	1694	} else {
1506	1695	return new \WP_Error('error', $msg, array(
		@@ -1981,8 +2170,9 @@
1981	2170	$app_id_details = array_map( function ( $e ) {
1982	2171	if ( isset( $e['app_id_detail'] ) ) {
1983	2172	return $e['app_id_detail'];
1984	2173	}
	2174	+ return null;
1985	2175	}, $apps );
1986	2176	$app_titles = array();
1987	2177	foreach ( $app_id_details as $app_id_detail ) {
1988	2178	$app_detail = WPDA_App_Model::get_by_id( $app_id_detail );
		@@ -2025,12 +2215,38 @@
2025	2215	'tables' => array_values( $wpdb->tables() ),
2026	2216	'date_format' => get_option( 'date_format' ),
2027	2217	'time_format' => get_option( 'time_format' ),
2028	2218	'scroll_offset' => WPDA::get_option( WPDA::OPTION_APPS_SCROLL_OFFSET ),
	2219	+ 'upload' => @ini_get( 'upload_max_filesize' ),
	2220	+ 'uploadBytes' => $this->uploadToBytes( @ini_get( 'upload_max_filesize' ) ),
	2221	+ 'locale' => get_locale(),
2029	2222	];
2030	2223	return $settings;
2031	2224	}
2032	2225
	2226	+ /**
	2227	+ * Convert a PHP shorthand notation (e.g., "2M", "512K", "1G") to bytes.
	2228	+ *
	2229	+ * @param string $val The shorthand size string.
	2230	+ *
	2231	+ * @return int The size in bytes.
	2232	+ */
	2233	+ private function uploadToBytes( $val ) : int {
	2234	+ $val = trim( $val );
	2235	+ $lastChar = strtolower( $val[strlen( $val ) - 1] );
	2236	+ $num = (float) $val;
	2237	+ switch ( $lastChar ) {
	2238	+ case 'g':
	2239	+ $num *= 1024;
	2240	+ case 'm':
	2241	+ $num *= 1024;
	2242	+ case 'k':
	2243	+ $num *= 1024;
	2244	+ break;
	2245	+ }
	2246	+ return (int) round( $num );
	2247	+ }
	2248	+
2033	2249	private function get_app_container_meta( $app_id, $container, $rel_tab = false ) {
2034	2250	$app = WPDA_App_Model::get_by_id( $app_id );
2035	2251	if ( false === $app ) {
2036	2252	return $this->bad_request();
		@@ -2107,8 +2323,17 @@
2107	2323	return $this->get_app_container_meta( $app_id, $container );
2108	2324	}
2109	2325	}
2110	2326
	2327	+ private function escapeUnicodeForExport( $str ) {
	2328	+ if ( empty( $str ) ) {
	2329	+ return $str;
	2330	+ }
	2331	+ return preg_replace_callback( '/\\\\(u[0-9a-fA-F]{4})/', function ( $matches ) {
	2332	+ return '\\\\' . $matches[1];
	2333	+ }, $str );
	2334	+ }
	2335	+
2111	2336	private function do_app_export_app( $app_id, $main_app_id ) {
2112	2337	global $wpdb;
2113	2338	$quotes = function ( $value ) {
2114	2339	return str_replace( array(
		@@ -2118,9 +2343,10 @@
2118	2343	"\\t",
2119	2344	"\\\\n",
2120	2345	"\\n",
2121	2346	"\\r\\n",
2122		- "\\r"
	2347	+ "\\r",
	2348	+ "\\d"
2123	2349	), array(
2124	2350	"''",
2125	2351	'\\\\"',
2126	2352	"\\\\\\t",
		@@ -2127,9 +2353,10 @@
2127	2353	"\\\\t",
2128	2354	"\\\\\\n",
2129	2355	"\\\\n",
2130	2356	"\\\\r\\\\n",
2131		- "\\\\r"
	2357	+ "\\\\r",
	2358	+ "\\\\\\\\\\d"
2132	2359	), $value );
2133	2360	};
2134	2361	$app = WPDA_App_Model::get_by_id( $app_id );
2135	2362	$app_settings = ( null === $app[0]['app_settings'] ? 'null' : "{$quotes( $app[0]['app_settings'] )}" );
		@@ -2176,8 +2403,11 @@
2176	2403	// Replace default WordPress database with conversion string
2177	2404	$cnt_dbs = ( $wpdb->dbname === $container['cnt_dbs'] ? '{wp_schema}' : "{$quotes( $container['cnt_dbs'] )}" );
2178	2405	$cnt_table = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_table );
2179	2406	$cnt_form = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_form );
	2407	+ // Replace Unicode characters
	2408	+ $cnt_table = $this->escapeUnicodeForExport( $cnt_table );
	2409	+ $cnt_form = $this->escapeUnicodeForExport( $cnt_form );
2180	2410	// phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed
2181	2411	$containers_sql .= <<<SQL
2182	2412	# Import app container
2183	2413	insert into `{wp_prefix}wpda_app_container`
		@@ -2485,14 +2715,16 @@
2485	2715	$dynamic_params = array()
2486	2716	) {
2487	2717	// Process $search_custom > URL parameters
2488	2718	global $wpdb;
	2719	+ $replacements = array();
	2720	+ $nonce = bin2hex( random_bytes( 8 ) );
2489	2721	foreach ( self::METHODS as $method ) {
2490	2722	$offset = 0;
2491	2723	$search = $method . '[';
	2724	+ // Get filter
2492	2725	while ( ($pos_start = stripos( $where, $search, $offset )) !== false ) {
2493	2726	if ( ($pos_end = stripos( $where, ']', $pos_start )) !== false ) {
2494		- // Get filter
2495	2727	$filter = substr( $where, $pos_start, $pos_end - $pos_start + 1 );
2496	2728	// Get name
2497	2729	$arg_name = substr( $where, $pos_start + strlen( $search ), $pos_end - $pos_start - strlen( $search ) );
2498	2730	// Remove quotes from name
		@@ -2498,64 +2730,34 @@
2498	2730	// Remove quotes from name
2499	2731	if ( substr( $arg_name, 0, 1 ) === "'" && substr( $arg_name, -1 ) === "'" ) {
2500	2732	$arg_name = substr( $arg_name, 1, -1 );
2501	2733	}
2502		- // Remove double quotes from name
	2734	+ // Remove quotes from name
2503	2735	if ( substr( $arg_name, 0, 1 ) === '"' && substr( $arg_name, -1 ) === '"' ) {
2504	2736	$arg_name = substr( $arg_name, 1, -1 );
2505	2737	}
	2738	+ $arg_value = null;
2506	2739	// Handle GET args
2507		- // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared
2508		- if ( $method === self::METHODS[0] ) {
	2740	+ if ( $method === self::METHODS[0] && isset( $search_custom['get'][$arg_name] ) ) {
	2741	+ $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) );
	2742	+ } elseif ( $method === self::METHODS[1] && isset( $search_custom['post'][$arg_name] ) ) {
	2743	+ $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
	2744	+ } elseif ( $method === self::METHODS[2] ) {
2509	2745	if ( isset( $search_custom['get'][$arg_name] ) ) {
2510	2746	$arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) );
2511		- $where = $wpdb->prepare( substr_replace(
2512		- $where,
2513		- '%s',
2514		- $pos_start,
2515		- $pos_end - $pos_start + 1
2516		- ), $arg_value );
2517		- } else {
2518		- $where = str_replace( $filter, 'null', $where );
	2747	+ } elseif ( isset( $search_custom['post'][$arg_name] ) ) {
	2748	+ $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
2519	2749	}
2520	2750	}
2521	2751	// Handle POST args
2522		- if ( $method === self::METHODS[1] ) {
2523		- if ( isset( $search_custom['post'][$arg_name] ) ) {
2524		- $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
2525		- $where = $wpdb->prepare( substr_replace(
2526		- $where,
2527		- '%s',
2528		- $pos_start,
2529		- $pos_end - $pos_start + 1
2530		- ), $arg_value );
2531		- } else {
2532		- $where = str_replace( $filter, 'null', $where );
2533		- }
2534		- }
	2752	+ $placeholder = '###URL_PLACEHOLDER_' . $nonce . '_' . md5( $filter ) . '###';
	2753	+ $where = str_replace( $filter, $placeholder, $where );
2535	2754	// Handle REQUEST args
2536		- if ( $method === self::METHODS[2] ) {
2537		- if ( isset( $search_custom['get'][$arg_name] ) ) {
2538		- $arg_value = sanitize_text_field( wp_unslash( $search_custom['get'][$arg_name] ) );
2539		- $where = $wpdb->prepare( substr_replace(
2540		- $where,
2541		- '%s',
2542		- $pos_start,
2543		- $pos_end - $pos_start + 1
2544		- ), $arg_value );
2545		- } elseif ( isset( $search_custom['post'][$arg_name] ) ) {
2546		- $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) );
2547		- $where = $wpdb->prepare( substr_replace(
2548		- $where,
2549		- '%s',
2550		- $pos_start,
2551		- $pos_end - $pos_start + 1
2552		- ), $arg_value );
2553		- } else {
2554		- $where = str_replace( $filter, 'null', $where );
2555		- }
	2755	+ if ( $arg_value !== null ) {
	2756	+ $replacements[$placeholder] = $wpdb->prepare( '%s', $arg_value );
	2757	+ } else {
	2758	+ $replacements[$placeholder] = 'null';
2556	2759	}
2557		- // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared
2558	2760	}
2559	2761	$offset = $pos_start + 1;
2560	2762	if ( $offset > strlen( $where ) ) {
2561	2763	$offset = strlen( $where ) - 1;
		@@ -2566,19 +2768,17 @@
2566	2768	if ( is_array( $search_params ) && 1 === count( $search_params ) ) {
2567	2769	$filter_field_name = $this->sanitize_db_identifier( array_keys( $search_params )[0] );
2568	2770	$filter_field_value = sanitize_text_field( $search_params[$filter_field_name] );
2569	2771	$filter_field_name_array = array_map( 'trim', explode( ',', $filter_field_name ) );
2570		- // phpcs:ignore -- 8.1 proof
2571	2772	$filter_field_value_array = array_map( 'trim', explode( ',', $filter_field_value ) );
2572		- // phpcs:ignore -- 8.1 proof
2573	2773	if ( count( $filter_field_name_array ) === count( $filter_field_value_array ) ) {
2574		- // phpcs:ignore -- 8.1 proof
2575	2774	// Add filter to where clause.
2576		- // phpcs:disable Generic.CodeAnalysis.ForLoopWithTestFunctionCall, Squiz.PHP.DisallowSizeFunctionsInLoops, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder
2577	2775	for ($i = 0; $i < count( $filter_field_name_array ); $i++) {
2578		- $where .= (( '' === $where ? '' : ' and ' )) . $wpdb->prepare( ' `%1s` like %s ', array($filter_field_name_array[$i], $filter_field_value_array[$i]) );
	2776	+ $where .= ( '' === $where ? '' : ' and ' );
	2777	+ $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $filter_field_name_array[$i] ) . '###';
	2778	+ $where .= ' `' . $filter_field_name_array[$i] . '` like ' . $placeholder;
	2779	+ $replacements[$placeholder] = $wpdb->prepare( '%s', $filter_field_value_array[$i] );
2579	2780	}
2580		- // phpcs:enable Generic.CodeAnalysis.ForLoopWithTestFunctionCall, Squiz.PHP.DisallowSizeFunctionsInLoops, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnquotedComplexPlaceholder
2581	2781	}
2582	2782	}
2583	2783	// Substitute all shortcode parameters
2584	2784	if ( is_array( $shortcode_params ) ) {
		@@ -2584,15 +2784,11 @@
2584	2784	if ( is_array( $shortcode_params ) ) {
2585	2785	foreach ( $shortcode_params as $column_name => $column_value ) {
2586	2786	$occurences = substr_count( strtolower( $where ), strtolower( "shortcodeParam['{$column_name}']" ) );
2587	2787	if ( 0 < $occurences ) {
2588		- $column_values = array();
2589		- for ($i = 0; $i < $occurences; $i++) {
2590		- $column_values[] = sanitize_text_field( $column_value );
2591		- }
2592		- // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
2593		- $where = $wpdb->prepare( str_ireplace( "shortcodeParam['{$column_name}']", '%s', $where ), $column_values );
2594		- // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	2788	+ $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $column_name ) . '###';
	2789	+ $where = str_ireplace( "shortcodeParam['{$column_name}']", $placeholder, $where );
	2790	+ $replacements[$placeholder] = $wpdb->prepare( '%s', sanitize_text_field( $column_value ) );
2595	2791	}
2596	2792	}
2597	2793	}
2598	2794	// Substitute all unused shortcode parameter calls with null
		@@ -2610,13 +2806,15 @@
2610	2806	}
2611	2807	// Substitute all dynamic parameters
2612	2808	if ( is_array( $dynamic_params ) && 0 < count( $dynamic_params ) ) {
2613	2809	foreach ( $dynamic_params as $column_name => $column_value ) {
2614		- // phpcs:disable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
2615		- $where = $wpdb->prepare( str_ireplace( "{:{$column_name}}", '%s', $where ), $column_value );
2616		- // phpcs:enable WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.PreparedSQL.InterpolatedNotPrepared
	2810	+ if ( stripos( $where, "{:{$column_name}}" ) !== false ) {
	2811	+ $placeholder = '###DYNAMIC_PARAM_' . $nonce . '_' . md5( $column_name ) . '###';
	2812	+ $where = str_ireplace( "{:{$column_name}}", $placeholder, $where );
	2813	+ $replacements[$placeholder] = $wpdb->prepare( '%s', $column_value );
	2814	+ }
2617	2815	}
2618	2816	}
2619		- return $where;
	2817	+ return strtr( $where, $replacements );
2620	2818	}
2621	2819
2622	2820	}