← All changes | modules/revisions/Revisions.php +49 -19 3.0.7 → 3.1.6 View file →

		@@ -131,13 +131,42 @@
131	131
132	132	return $args;
133	133	}
134	134
	135	+ /**
	136	+ * Build prepared IN() clause for string values using $wpdb->prepare()
	137	+ *
	138	+ * @param string $column Column name (already escaped with backticks)
	139	+ * @param array $values Array of string values
	140	+ * @param bool $not Whether to use NOT IN instead of IN
	141	+ *
	142	+ * @return string|null Prepared SQL fragment or null if no valid values
	143	+ */
	144	+ private function build_string_in_clause( $column, $values, $not = false ) {
	145	+ if( ! is_array( $values ) || empty( $values ) ) {
	146	+ return null;
	147	+ }
	148	+ // Filter out empty strings and reindex
	149	+ $values = array_values( array_filter( $values, function( $v ) {
	150	+ return is_string( $v ) && strlen( $v ) > 0;
	151	+ } ) );
	152	+ if( empty( $values ) ) {
	153	+ return null;
	154	+ }
	155	+ $count = count( $values );
	156	+ $placeholders = implode( ', ', array_fill( 0, $count, '%s' ) );
	157	+ $operator = $not ? 'NOT IN' : 'IN';
	158	+
	159	+ return WPF()->db->prepare( "{$column} {$operator}({$placeholders})", ...$values );
	160	+ }
	161	+
135	162	public function build_sql_where( $args ) {
136	163	$where = '';
137	164	$args = $this->parse_args( $args );
138		-
	165	+
139	166	$wheres = [];
	167	+
	168	+ // Integer fields - safe with wpforo_bigintval (casts to int)
140	169	if( ! empty( $args['include'] ) ) {
141	170	$wheres[] = "`revisionid` IN(" . implode( ',', array_map( 'wpforo_bigintval', $args['include'] ) ) . ")";
142	171	}
143	172	if( ! empty( $args['exclude'] ) ) {
		@@ -142,9 +171,9 @@
142	171	}
143	172	if( ! empty( $args['exclude'] ) ) {
144	173	$wheres[] = "`revisionid` NOT IN(" . implode( ',', array_map( 'wpforo_bigintval', $args['exclude'] ) ) . ")";
145	174	}
146		-
	175	+
147	176	if( ! empty( $args['userids_include'] ) ) {
148	177	$wheres[] = "`userid` IN(" . implode( ',', array_map( 'wpforo_bigintval', $args['userids_include'] ) ) . ")";
149	178	}
150	179	if( ! empty( $args['userids_exclude'] ) ) {
		@@ -149,15 +178,8 @@
149	178	}
150	179	if( ! empty( $args['userids_exclude'] ) ) {
151	180	$wheres[] = "`userid` NOT IN(" . implode( ',', array_map( 'wpforo_bigintval', $args['userids_exclude'] ) ) . ")";
152	181	}
153		-
154		- if( ! empty( $args['textareaids_include'] ) ) {
155		- $wheres[] = "`textareaid` IN('" . implode( "','", array_map( 'esc_sql', $args['textareaids_include'] ) ) . "')";
156		- }
157		- if( ! empty( $args['textareaids_exclude'] ) ) {
158		- $wheres[] = "`textareaid` IN('" . implode( "','", array_map( 'esc_sql', $args['textareaids_exclude'] ) ) . "')";
159		- }
160	182
161	183	if( ! empty( $args['postids_include'] ) ) {
162	184	$wheres[] = "`postid` IN(" . implode( ',', array_map( 'wpforo_bigintval', $args['postids_include'] ) ) . ")";
163	185	}
		@@ -164,26 +186,34 @@
164	186	if( ! empty( $args['postids_exclude'] ) ) {
165	187	$wheres[] = "`postid` NOT IN(" . implode( ',', array_map( 'wpforo_bigintval', $args['postids_exclude'] ) ) . ")";
166	188	}
167	189
168		- if( ! empty( $args['urls_include'] ) ) {
169		- $wheres[] = "`url` IN('" . implode( "','", array_map( 'esc_sql', $args['urls_include'] ) ) . "')";
	190	+ // String fields - use $wpdb->prepare() with placeholders for SQL injection protection
	191	+ if( $clause = $this->build_string_in_clause( '`textareaid`', $args['textareaids_include'], false ) ) {
	192	+ $wheres[] = $clause;
170	193	}
171		- if( ! empty( $args['urls_exclude'] ) ) {
172		- $wheres[] = "`url` IN('" . implode( "','", array_map( 'esc_sql', $args['urls_exclude'] ) ) . "')";
	194	+ if( $clause = $this->build_string_in_clause( '`textareaid`', $args['textareaids_exclude'], true ) ) {
	195	+ $wheres[] = $clause;
173	196	}
174	197
175		- if( ! empty( $args['emails_include'] ) ) {
176		- $wheres[] = "`email` IN('" . implode( "','", array_map( 'esc_sql', $args['emails_include'] ) ) . "')";
	198	+ if( $clause = $this->build_string_in_clause( '`url`', $args['urls_include'], false ) ) {
	199	+ $wheres[] = $clause;
177	200	}
178		- if( ! empty( $args['emails_exclude'] ) ) {
179		- $wheres[] = "`email` IN('" . implode( "','", array_map( 'esc_sql', $args['emails_exclude'] ) ) . "')";
	201	+ if( $clause = $this->build_string_in_clause( '`url`', $args['urls_exclude'], true ) ) {
	202	+ $wheres[] = $clause;
180	203	}
181		-
	204	+
	205	+ if( $clause = $this->build_string_in_clause( '`email`', $args['emails_include'], false ) ) {
	206	+ $wheres[] = $clause;
	207	+ }
	208	+ if( $clause = $this->build_string_in_clause( '`email`', $args['emails_exclude'], true ) ) {
	209	+ $wheres[] = $clause;
	210	+ }
	211	+
182	212	if( $wheres ) {
183	213	$where = " WHERE " . implode( " AND ", $wheres );
184	214	}
185		-
	215	+
186	216	return $where;
187	217	}
188	218
189	219	private function build_sql_select( $args ) {