| @@ -280,9 +280,13 @@ | ||
| 280 | 280 | 'map' => array( |
| 281 | 281 | 'required' => false, |
| 282 | 282 | 'type' => 'string', |
| 283 | 283 | 'description' => __( 'Map settings - JSON string', 'wp-data-access' ), |
| 284 | - 'sanitize_callback' => 'wp_kses_post', | |
| 284 | + 'sanitize_callback' => function ( $param ) { | |
| 285 | + $sanitized_settings = $this->sanitize_settings( json_decode( (string) $param, true ) ); | |
| 286 | + // Save sanitized JSON as string | |
| 287 | + return json_encode( $sanitized_settings ); | |
| 288 | + }, | |
| 285 | 289 | 'validate_callback' => 'rest_validate_request_arg', |
| 286 | 290 | ), |
| 287 | 291 | 'chart' => array( |
| 288 | 292 | 'required' => false, |
| @@ -514,8 +518,15 @@ | ||
| 514 | 518 | 'permission_callback' => '__return_true', |
| 515 | 519 | 'args' => array( |
| 516 | 520 | 'dbs_source' => $this->get_param( 'dbs' ), |
| 517 | 521 | 'dbs_destination' => $this->get_param( 'dbs' ), |
| 522 | + 'appDbId' => array( | |
| 523 | + 'required' => false, | |
| 524 | + 'type' => 'integer', | |
| 525 | + 'description' => __( 'App Id', 'wp-data-access' ), | |
| 526 | + 'sanitize_callback' => 'absint', | |
| 527 | + 'validate_callback' => 'rest_validate_request_arg', | |
| 528 | + ), | |
| 518 | 529 | ), |
| 519 | 530 | ) ); |
| 520 | 531 | register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/lang/get', array( |
| 521 | 532 | 'methods' => array('POST'), |
| @@ -564,8 +575,24 @@ | ||
| 564 | 575 | 'validate_callback' => 'rest_validate_request_arg', |
| 565 | 576 | ), |
| 566 | 577 | ), |
| 567 | 578 | ) ); |
| 579 | + register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/proxy', array( | |
| 580 | + 'methods' => array('GET'), | |
| 581 | + 'callback' => array($this, 'app_proxy'), | |
| 582 | + 'permission_callback' => '__return_true', | |
| 583 | + 'args' => array( | |
| 584 | + 'app_id' => $this->get_param( 'app_id' ), | |
| 585 | + 'cnt_id' => $this->get_param( 'cnt_id' ), | |
| 586 | + 'url' => array( | |
| 587 | + 'required' => true, | |
| 588 | + 'type' => 'string', | |
| 589 | + 'description' => __( 'URL', 'wp-data-access' ), | |
| 590 | + 'sanitize_callback' => 'sanitize_text_field', | |
| 591 | + 'validate_callback' => 'rest_validate_request_arg', | |
| 592 | + ), | |
| 593 | + ), | |
| 594 | + ) ); | |
| 568 | 595 | // PWA |
| 569 | 596 | register_rest_route( WPDA_API::WPDA_NAMESPACE, 'app/pwa/get', array( |
| 570 | 597 | 'methods' => array('POST'), |
| 571 | 598 | 'callback' => array($this, 'app_wpa_get'), |
| @@ -625,8 +652,24 @@ | ||
| 625 | 652 | ), |
| 626 | 653 | ) ); |
| 627 | 654 | } |
| 628 | 655 | |
| 656 | + public function app_proxy( $request ) { | |
| 657 | + wp_die(); | |
| 658 | + } | |
| 659 | + | |
| 660 | + private function detect_image_mime( $body ) { | |
| 661 | + return null; | |
| 662 | + } | |
| 663 | + | |
| 664 | + private function is_safe_remote_url( $url, $allowed_hosts ) { | |
| 665 | + return false; | |
| 666 | + } | |
| 667 | + | |
| 668 | + private function is_public_ip( $ip ) { | |
| 669 | + return false; | |
| 670 | + } | |
| 671 | + | |
| 629 | 672 | public function app_download( $request ) { |
| 630 | 673 | return $this->WPDA_Rest_Response( 'OK' ); |
| 631 | 674 | } |
| 632 | 675 | |
| @@ -1013,8 +1056,27 @@ | ||
| 1013 | 1056 | } |
| 1014 | 1057 | } |
| 1015 | 1058 | } |
| 1016 | 1059 | } |
| 1060 | + if ( isset( $settings['columns'] ) && is_array( $settings['columns'] ) && '1' !== $rel_tab ) { | |
| 1061 | + $queryable_columns = array(); | |
| 1062 | + if ( isset( $settings['table']['columns'] ) && is_array( $settings['table']['columns'] ) ) { | |
| 1063 | + foreach ( $settings['table']['columns'] as $column ) { | |
| 1064 | + if ( isset( $column['queryable'] ) && $column['queryable'] ) { | |
| 1065 | + $queryable_columns[] = $column['columnName']; | |
| 1066 | + } | |
| 1067 | + } | |
| 1068 | + } | |
| 1069 | + $app_columns = array(); | |
| 1070 | + foreach ( $settings['columns'] as $column ) { | |
| 1071 | + if ( isset( $column['columnName'], $column['isSelected'] ) && $column['isSelected'] ) { | |
| 1072 | + $app_columns[$column['columnName']] = in_array( $column['columnName'], $queryable_columns ); | |
| 1073 | + } | |
| 1074 | + } | |
| 1075 | + if ( 0 < count( $app_columns ) ) { | |
| 1076 | + $col = $app_columns; | |
| 1077 | + } | |
| 1078 | + } | |
| 1017 | 1079 | $table_api = new WPDA_Table(); |
| 1018 | 1080 | return $table_api->select( |
| 1019 | 1081 | $dbs, |
| 1020 | 1082 | $tbl, |
| @@ -1066,8 +1128,9 @@ | ||
| 1066 | 1128 | return array_map( function ( $value ) { |
| 1067 | 1129 | if ( true === $value['isSelected'] ) { |
| 1068 | 1130 | return $value['columnName']; |
| 1069 | 1131 | } |
| 1132 | + return null; | |
| 1070 | 1133 | }, $columns ); |
| 1071 | 1134 | } |
| 1072 | 1135 | |
| 1073 | 1136 | public function app_get( $request ) { |
| @@ -1452,8 +1515,68 @@ | ||
| 1452 | 1515 | $renamed = 0; |
| 1453 | 1516 | $debug_mode = 'on' === WPDA::get_option( WPDA::OPTION_PLUGIN_DEBUG ); |
| 1454 | 1517 | $debug = array(); |
| 1455 | 1518 | $errors = array(); |
| 1519 | + if ( $request->get_param( 'appDbId' ) ) { | |
| 1520 | + // Update app only | |
| 1521 | + $appDbId = $request->get_param( 'appDbId' ); | |
| 1522 | + // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table | |
| 1523 | + $sql = $wpdb->prepare( "update `{$wpdb->prefix}wpda_app_container` set `cnt_dbs` = %s where `cnt_dbs` = %s and app_id = %d", array($dbs_destination, $dbs_source, $appDbId) ); | |
| 1524 | + $result = $wpdb->query( $sql ); | |
| 1525 | + // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared | |
| 1526 | + $renamed += $result; | |
| 1527 | + if ( $debug_mode ) { | |
| 1528 | + $debug[] = array( | |
| 1529 | + 'sql' => $sql, | |
| 1530 | + 'result' => $result, | |
| 1531 | + ); | |
| 1532 | + } | |
| 1533 | + if ( '' !== $wpdb->last_error ) { | |
| 1534 | + $errors[] = array( | |
| 1535 | + 'sql' => $sql, | |
| 1536 | + 'error' => $wpdb->last_error, | |
| 1537 | + ); | |
| 1538 | + } | |
| 1539 | + $sql_content = array("update `{$wpdb->prefix}wpda_app_container` set `cnt_table` = replace(`cnt_table`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_table` like '%\"dbs\":\"%1s\"%' and app_id = %d", "update `{$wpdb->prefix}wpda_app_container` set `cnt_form` = replace(`cnt_form`, '\"dbs\":\"%1s\"', '\"dbs\":\"%1s\"') where `cnt_form` like '%\"dbs\":\"%1s\"%' and app_id = %d"); | |
| 1540 | + foreach ( $sql_content as $sql ) { | |
| 1541 | + // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- plugin table | |
| 1542 | + $result = $wpdb->query( $wpdb->prepare( $sql, array( | |
| 1543 | + $dbs_source, | |
| 1544 | + $dbs_destination, | |
| 1545 | + $dbs_source, | |
| 1546 | + $appDbId | |
| 1547 | + ) ) ); | |
| 1548 | + $renamed += $result; | |
| 1549 | + if ( $debug_mode ) { | |
| 1550 | + $debug[] = array( | |
| 1551 | + 'sql' => $sql, | |
| 1552 | + 'result' => $result, | |
| 1553 | + ); | |
| 1554 | + } | |
| 1555 | + if ( '' !== $wpdb->last_error ) { | |
| 1556 | + $errors[] = array( | |
| 1557 | + 'sql' => $sql, | |
| 1558 | + 'error' => $wpdb->last_error, | |
| 1559 | + ); | |
| 1560 | + } | |
| 1561 | + } | |
| 1562 | + $context = array(); | |
| 1563 | + if ( $debug_mode ) { | |
| 1564 | + $context['debug'] = $debug; | |
| 1565 | + } | |
| 1566 | + if ( 0 < count( $errors ) ) { | |
| 1567 | + $context['errors'] = $errors; | |
| 1568 | + return new \WP_Error('error', 'Failed renaming database', array( | |
| 1569 | + 'status' => 401, | |
| 1570 | + 'context' => $context, | |
| 1571 | + )); | |
| 1572 | + } | |
| 1573 | + return $this->WPDA_Rest_Response( sprintf( | |
| 1574 | + /* translators: %s = number of database substitutions */ | |
| 1575 | + __( 'Successfully renamed %s database occurrences', 'wp-data-access' ), | |
| 1576 | + $renamed | |
| 1577 | + ), null, $context ); | |
| 1578 | + } | |
| 1456 | 1579 | // Rename all occurrences in repository tables and apps |
| 1457 | 1580 | $sqls = array( |
| 1458 | 1581 | "update `{$wpdb->prefix}wpda_publisher` set `pub_schema_name` = %s where `pub_schema_name` = %s", |
| 1459 | 1582 | "update `{$wpdb->prefix}wpda_project_page` set `page_schema_name` = %s where `page_schema_name` = %s", |
| @@ -1550,14 +1673,23 @@ | ||
| 1550 | 1673 | )); |
| 1551 | 1674 | } |
| 1552 | 1675 | $suppress = $wpdadb->suppress_errors( true ); |
| 1553 | 1676 | $chart_data = $wpdadb->get_results( $query, 'ARRAY_A' ); |
| 1677 | + // Add an * before each label to support numeric labels | |
| 1678 | + $chart_data_converted = array(); | |
| 1679 | + foreach ( $chart_data as $data ) { | |
| 1680 | + $row = array(); | |
| 1681 | + foreach ( $data as $key => $value ) { | |
| 1682 | + $row['*' . $key] = $value; | |
| 1683 | + } | |
| 1684 | + $chart_data_converted[] = $row; | |
| 1685 | + } | |
| 1554 | 1686 | $wpdadb->get_results( "create temporary table `wpda_chart_data_types` as {$query}", 'ARRAY_A' ); |
| 1555 | 1687 | $explain = $wpdadb->get_results( "desc `wpda_chart_data_types`", 'ARRAY_A' ); |
| 1556 | 1688 | $wpdadb->get_results( "drop temporary table `wpda_chart_data_types`", 'ARRAY_A' ); |
| 1557 | 1689 | $wpdadb->suppress_errors( $suppress ); |
| 1558 | 1690 | return array( |
| 1559 | - 'data' => $chart_data, | |
| 1691 | + 'data' => $chart_data_converted, | |
| 1560 | 1692 | 'explain' => $explain, |
| 1561 | 1693 | ); |
| 1562 | 1694 | } else { |
| 1563 | 1695 | return new \WP_Error('error', $msg, array( |
| @@ -2038,8 +2170,9 @@ | ||
| 2038 | 2170 | $app_id_details = array_map( function ( $e ) { |
| 2039 | 2171 | if ( isset( $e['app_id_detail'] ) ) { |
| 2040 | 2172 | return $e['app_id_detail']; |
| 2041 | 2173 | } |
| 2174 | + return null; | |
| 2042 | 2175 | }, $apps ); |
| 2043 | 2176 | $app_titles = array(); |
| 2044 | 2177 | foreach ( $app_id_details as $app_id_detail ) { |
| 2045 | 2178 | $app_detail = WPDA_App_Model::get_by_id( $app_id_detail ); |
| @@ -2084,8 +2217,9 @@ | ||
| 2084 | 2217 | 'time_format' => get_option( 'time_format' ), |
| 2085 | 2218 | 'scroll_offset' => WPDA::get_option( WPDA::OPTION_APPS_SCROLL_OFFSET ), |
| 2086 | 2219 | 'upload' => @ini_get( 'upload_max_filesize' ), |
| 2087 | 2220 | 'uploadBytes' => $this->uploadToBytes( @ini_get( 'upload_max_filesize' ) ), |
| 2221 | + 'locale' => get_locale(), | |
| 2088 | 2222 | ]; |
| 2089 | 2223 | return $settings; |
| 2090 | 2224 | } |
| 2091 | 2225 | |
| @@ -2189,8 +2323,17 @@ | ||
| 2189 | 2323 | return $this->get_app_container_meta( $app_id, $container ); |
| 2190 | 2324 | } |
| 2191 | 2325 | } |
| 2192 | 2326 | |
| 2327 | + private function escapeUnicodeForExport( $str ) { | |
| 2328 | + if ( empty( $str ) ) { | |
| 2329 | + return $str; | |
| 2330 | + } | |
| 2331 | + return preg_replace_callback( '/\\\\(u[0-9a-fA-F]{4})/', function ( $matches ) { | |
| 2332 | + return '\\\\' . $matches[1]; | |
| 2333 | + }, $str ); | |
| 2334 | + } | |
| 2335 | + | |
| 2193 | 2336 | private function do_app_export_app( $app_id, $main_app_id ) { |
| 2194 | 2337 | global $wpdb; |
| 2195 | 2338 | $quotes = function ( $value ) { |
| 2196 | 2339 | return str_replace( array( |
| @@ -2200,9 +2343,10 @@ | ||
| 2200 | 2343 | "\\t", |
| 2201 | 2344 | "\\\\n", |
| 2202 | 2345 | "\\n", |
| 2203 | 2346 | "\\r\\n", |
| 2204 | - "\\r" | |
| 2347 | + "\\r", | |
| 2348 | + "\\d" | |
| 2205 | 2349 | ), array( |
| 2206 | 2350 | "''", |
| 2207 | 2351 | '\\\\"', |
| 2208 | 2352 | "\\\\\\t", |
| @@ -2209,9 +2353,10 @@ | ||
| 2209 | 2353 | "\\\\t", |
| 2210 | 2354 | "\\\\\\n", |
| 2211 | 2355 | "\\\\n", |
| 2212 | 2356 | "\\\\r\\\\n", |
| 2213 | - "\\\\r" | |
| 2357 | + "\\\\r", | |
| 2358 | + "\\\\\\\\\\d" | |
| 2214 | 2359 | ), $value ); |
| 2215 | 2360 | }; |
| 2216 | 2361 | $app = WPDA_App_Model::get_by_id( $app_id ); |
| 2217 | 2362 | $app_settings = ( null === $app[0]['app_settings'] ? 'null' : "{$quotes( $app[0]['app_settings'] )}" ); |
| @@ -2258,8 +2403,11 @@ | ||
| 2258 | 2403 | // Replace default WordPress database with conversion string |
| 2259 | 2404 | $cnt_dbs = ( $wpdb->dbname === $container['cnt_dbs'] ? '{wp_schema}' : "{$quotes( $container['cnt_dbs'] )}" ); |
| 2260 | 2405 | $cnt_table = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_table ); |
| 2261 | 2406 | $cnt_form = str_replace( "\"dbs\":\"{$wpdb->dbname}\"", "\"dbs\":\"{wp_schema}\"", $cnt_form ); |
| 2407 | + // Replace Unicode characters | |
| 2408 | + $cnt_table = $this->escapeUnicodeForExport( $cnt_table ); | |
| 2409 | + $cnt_form = $this->escapeUnicodeForExport( $cnt_form ); | |
| 2262 | 2410 | // phpcs:ignore PluginCheck.CodeAnalysis.Heredoc.NotAllowed |
| 2263 | 2411 | $containers_sql .= <<<SQL |
| 2264 | 2412 | # Import app container |
| 2265 | 2413 | insert into `{wp_prefix}wpda_app_container` |
| @@ -2568,8 +2716,9 @@ | ||
| 2568 | 2716 | ) { |
| 2569 | 2717 | // Process $search_custom > URL parameters |
| 2570 | 2718 | global $wpdb; |
| 2571 | 2719 | $replacements = array(); |
| 2720 | + $nonce = bin2hex( random_bytes( 8 ) ); | |
| 2572 | 2721 | foreach ( self::METHODS as $method ) { |
| 2573 | 2722 | $offset = 0; |
| 2574 | 2723 | $search = $method . '['; |
| 2575 | 2724 | // Get filter |
| @@ -2599,9 +2748,9 @@ | ||
| 2599 | 2748 | $arg_value = sanitize_text_field( wp_unslash( $search_custom['post'][$arg_name] ) ); |
| 2600 | 2749 | } |
| 2601 | 2750 | } |
| 2602 | 2751 | // Handle POST args |
| 2603 | - $placeholder = '###URL_PLACEHOLDER_' . md5( $filter ) . '###'; | |
| 2752 | + $placeholder = '###URL_PLACEHOLDER_' . $nonce . '_' . md5( $filter ) . '###'; | |
| 2604 | 2753 | $where = str_replace( $filter, $placeholder, $where ); |
| 2605 | 2754 | // Handle REQUEST args |
| 2606 | 2755 | if ( $arg_value !== null ) { |
| 2607 | 2756 | $replacements[$placeholder] = $wpdb->prepare( '%s', $arg_value ); |
| @@ -2624,9 +2773,9 @@ | ||
| 2624 | 2773 | if ( count( $filter_field_name_array ) === count( $filter_field_value_array ) ) { |
| 2625 | 2774 | // Add filter to where clause. |
| 2626 | 2775 | for ($i = 0; $i < count( $filter_field_name_array ); $i++) { |
| 2627 | 2776 | $where .= ( '' === $where ? '' : ' and ' ); |
| 2628 | - $placeholder = '###SHORTCODE_PARAM_' . md5( $filter_field_name_array[$i] ) . '###'; | |
| 2777 | + $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $filter_field_name_array[$i] ) . '###'; | |
| 2629 | 2778 | $where .= ' `' . $filter_field_name_array[$i] . '` like ' . $placeholder; |
| 2630 | 2779 | $replacements[$placeholder] = $wpdb->prepare( '%s', $filter_field_value_array[$i] ); |
| 2631 | 2780 | } |
| 2632 | 2781 | } |
| @@ -2635,9 +2784,9 @@ | ||
| 2635 | 2784 | if ( is_array( $shortcode_params ) ) { |
| 2636 | 2785 | foreach ( $shortcode_params as $column_name => $column_value ) { |
| 2637 | 2786 | $occurences = substr_count( strtolower( $where ), strtolower( "shortcodeParam['{$column_name}']" ) ); |
| 2638 | 2787 | if ( 0 < $occurences ) { |
| 2639 | - $placeholder = '###SHORTCODE_PARAM_' . md5( $column_name ) . '###'; | |
| 2788 | + $placeholder = '###SHORTCODE_PARAM_' . $nonce . '_' . md5( $column_name ) . '###'; | |
| 2640 | 2789 | $where = str_ireplace( "shortcodeParam['{$column_name}']", $placeholder, $where ); |
| 2641 | 2790 | $replacements[$placeholder] = $wpdb->prepare( '%s', sanitize_text_field( $column_value ) ); |
| 2642 | 2791 | } |
| 2643 | 2792 | } |
| @@ -2657,16 +2806,15 @@ | ||
| 2657 | 2806 | } |
| 2658 | 2807 | // Substitute all dynamic parameters |
| 2659 | 2808 | if ( is_array( $dynamic_params ) && 0 < count( $dynamic_params ) ) { |
| 2660 | 2809 | foreach ( $dynamic_params as $column_name => $column_value ) { |
| 2661 | - $placeholder = '###DYNAMIC_PARAM_' . md5( $column_name ) . '###'; | |
| 2662 | - $where = str_ireplace( "{:{$column_name}}", $placeholder, $where ); | |
| 2663 | - $replacements[$placeholder] = $wpdb->prepare( '%s', $column_value ); | |
| 2810 | + if ( stripos( $where, "{:{$column_name}}" ) !== false ) { | |
| 2811 | + $placeholder = '###DYNAMIC_PARAM_' . $nonce . '_' . md5( $column_name ) . '###'; | |
| 2812 | + $where = str_ireplace( "{:{$column_name}}", $placeholder, $where ); | |
| 2813 | + $replacements[$placeholder] = $wpdb->prepare( '%s', $column_value ); | |
| 2814 | + } | |
| 2664 | 2815 | } |
| 2665 | 2816 | } |
| 2666 | - foreach ( $replacements as $placeholder => $value ) { | |
| 2667 | - $where = str_replace( $placeholder, $value, $where ); | |
| 2668 | - } | |
| 2669 | - return $where; | |
| 2817 | + return strtr( $where, $replacements ); | |
| 2670 | 2818 | } |
| 2671 | 2819 | |
| 2672 | 2820 | } |
