WordPress.org
Get WordPress

Plugin Directory

Changeset 3051393


Ignore:
Timestamp:
03/15/2024 01:08:14 AM (2 years ago)
Author:
kevon.adonis
Message:

Pushing v2.6.5 - see changelog

Location:
wp-abstracts-manuscripts-manager
Files:
760 added
10 edited

Legend:

Unmodified
Added
Removed

  • wp-abstracts-manuscripts-manager/trunk/abstracts/abstracts.classes.php

    r2844958 r3051393  
    187187        global $wpdb, $_wp_column_headers;
    188188        $screen = get_current_screen();
    189         $abs_tbl = $wpdb->prefix."wpabstracts_abstracts";
    190         $events_tbl = $wpdb->prefix."wpabstracts_events";
    191         $users_tbl = $wpdb->base_prefix."users";
    192         $query = "SELECT abs.abstract_id, abs.title, abs.event, abs.topic, abs.author, abs.presenter_preference, abs.status as abs_status, abs.submit_date, abs.modified_date, abs.submit_by, abs.keywords, event.event_id, event.name, users.display_name, users.user_login, users.user_email ";
    193         $query .= "FROM " . $abs_tbl . " as abs ";
    194         $query .= "LEFT JOIN " . $users_tbl . " as users ";
    195         $query .= "ON abs.submit_by = users.ID ";
    196         $query .= "LEFT JOIN " . $events_tbl . " as event ";
    197         $query .= "ON abs.event = event.event_id WHERE event.status = 1";
     189        $abs_tbl = $wpdb->prefix . "wpabstracts_abstracts";
     190        $events_tbl = $wpdb->prefix . "wpabstracts_events";
     191        $users_tbl = $wpdb->base_prefix . "users";
     192        $query = $wpdb->prepare(
     193            "SELECT abs.abstract_id, abs.title, abs.event, abs.topic, abs.author, abs.presenter_preference, abs.status AS abs_status, abs.submit_date, abs.modified_date, abs.submit_by, abs.keywords, event.event_id, event.name, users.display_name, users.user_login, users.user_email
     194            FROM {$abs_tbl} AS abs
     195            LEFT JOIN {$users_tbl} AS users ON abs.submit_by = users.ID
     196            LEFT JOIN {$events_tbl} AS event ON abs.event = event.event_id
     197            WHERE event.status = %d",
     198            1
     199        );
     200
    198201        $searched = false;
    199202        $statusFiltered = false;
    200         $preferenceFiltered = false;
    201         if(isset($_GET['s']) && $_GET['s']){
     203        $preferenceFiltered = false;
     204
     205        if (isset($_GET['s']) && $_GET['s']) {
    202206            $term = trim(sanitize_text_field($_GET['s']));
    203             $query .= " WHERE (abs.abstract_id LIKE '%$term%' OR abs.title LIKE '%$term%' OR abs.topic LIKE '%$term%' OR abs.author LIKE '%$term%' OR users.user_login LIKE '%$term%' OR users.display_name LIKE '%$term%')";
     207            $query .= $wpdb->prepare(
     208                " AND (abs.abstract_id LIKE %s OR abs.title LIKE %s OR abs.topic LIKE %s OR abs.author LIKE %s OR users.user_login LIKE %s OR users.display_name LIKE %s)",
     209                '%' . $wpdb->esc_like($term) . '%',
     210                '%' . $wpdb->esc_like($term) . '%',
     211                '%' . $wpdb->esc_like($term) . '%',
     212                '%' . $wpdb->esc_like($term) . '%',
     213                '%' . $wpdb->esc_like($term) . '%',
     214                '%' . $wpdb->esc_like($term) . '%'
     215            );
    204216            $searched = true;
    205217        }
    206         if(isset($_GET['status_filter']) && $_GET['status_filter']){
     218
     219        if (isset($_GET['status_filter']) && $_GET['status_filter']) {
    207220            $status_filter = trim(sanitize_text_field($_GET['status_filter']));
    208221            $statusFiltered = true;
    209             if($searched || $preferenceFiltered){
    210                 $query .= " AND status = " . $status_filter;
    211             }else{
    212                 $query .= " WHERE abs.status = " . $status_filter;
    213             }
    214         }
    215         if(isset($_GET['preference_filter']) && $_GET['preference_filter']){
     222            if ($searched || $preferenceFiltered) {
     223                $query .= $wpdb->prepare(" AND abs.status = %d", $status_filter);
     224            } else {
     225                $query .= $wpdb->prepare(" AND abs.status = %d", $status_filter);
     226            }
     227        }
     228
     229        if (isset($_GET['preference_filter']) && $_GET['preference_filter']) {
    216230            $preference_filter = trim(sanitize_text_field($_GET['preference_filter']));
    217             if($searched || $statusFiltered){
    218                 $query .= " AND abs.presenter_preference = '$preference_filter'";
    219             }else{
    220                 $query .= " WHERE abs.presenter_preference = '$preference_filter'";
    221             }
    222         }
     231            if ($searched || $statusFiltered) {
     232                $query .= $wpdb->prepare(" AND abs.presenter_preference = %s", $preference_filter);
     233            } else {
     234                $query .= $wpdb->prepare(" AND abs.presenter_preference = %s", $preference_filter);
     235            }
     236        }
     237
    223238        $orderby = !empty($_GET["orderby"]) ? sanitize_text_field($_GET["orderby"]) : 'abs.abstract_id';
    224239        $order = !empty($_GET["order"]) ? sanitize_text_field($_GET["order"]) : 'desc';
    225         if(!empty($orderby) & !empty($order)){ $query.=' ORDER BY '.$orderby.' '.$order; }
     240
     241        if (!empty($orderby) && !empty($order)) {
     242            $query .= " ORDER BY {$orderby} {$order}";
     243        }
     244
    226245        $this->process_bulk_action();
    227246        $this->items = $wpdb->get_results($query);
     247
    228248        $columns = $this->get_columns();
    229249        $_wp_column_headers[$screen->id]=$columns;

  • wp-abstracts-manuscripts-manager/trunk/emails/emails.classes.php

    r2844959 r3051393  
    9797        global $wpdb, $_wp_column_headers;
    9898        $screen = get_current_screen();
    99         $templates_tbl = $wpdb->prefix."wpabstracts_emailtemplates";
    100         $query = "SELECT * FROM {$templates_tbl} WHERE `type` = 'abstract'";
     99        $templates_tbl = $wpdb->prefix . "wpabstracts_emailtemplates";
     100        $query = $wpdb->prepare(
     101            "SELECT * FROM {$templates_tbl} WHERE `type` = %s",
     102            'abstract'
     103        );
    101104        $orderby = !empty($_GET["orderby"]) ? sanitize_text_field($_GET["orderby"]) : 'ID';
    102105        $order = !empty($_GET["order"]) ? sanitize_text_field($_GET["order"]) : 'desc';
    103         if(!empty($orderby) & !empty($order)){ $query.=' ORDER BY '.$orderby.' '.$order; }
     106        if (!empty($orderby) && !empty($order)) {
     107            $query .= $wpdb->prepare(
     108                " ORDER BY %s %s",
     109                $orderby,
     110                $order
     111            );
     112        }
    104113        $this->process_bulk_action();
    105114        $this->items = $wpdb->get_results($query);
    106         /* -- Register the Columns -- */
    107115        $columns = $this->get_columns();
    108116        $_wp_column_headers[$screen->id]=$columns;

  • wp-abstracts-manuscripts-manager/trunk/events/events.manage.php

    r2355706 r3051393  
    168168            $abs_ids = wpabstracts_get_abstracts('event_id', $id);
    169169            if($abs_ids) {
    170                 $wpdb->query("DELETE FROM {$wpdb->prefix}wpabstracts_abstracts WHERE `abstract_id` IN($abs_ids)");
    171                 $wpdb->query("DELETE FROM {$wpdb->prefix}wpabstracts_attachments WHERE `abstracts_id` IN($abs_ids)");
    172             }
    173             $wpdb->query("DELETE FROM {$wpdb->prefix}wpabstracts_events WHERE `event_id` = " . intval($id));
     170                $wpdb->query(
     171                    $wpdb->prepare(
     172                        "DELETE FROM {$wpdb->prefix}wpabstracts_abstracts WHERE `abstract_id` IN (%s)",
     173                        $abs_ids
     174                    )
     175                );
     176                $wpdb->query(
     177                    $wpdb->prepare(
     178                        "DELETE FROM {$wpdb->prefix}wpabstracts_attachments WHERE `abstracts_id` IN (%s)",
     179                        $abs_ids
     180                    )
     181                );
     182            }
     183            $wpdb->query(
     184                $wpdb->prepare(
     185                    "DELETE FROM {$wpdb->prefix}wpabstracts_events WHERE `event_id` = %d",
     186                    $id
     187                )
     188            );
    174189            wpabstracts_show_message("Event ID ". intval($id) . " was successfully deleted", 'alert-success');
    175190        }else {
    … …  
    185200    if($_POST['event_id']){
    186201        $event_id = intval($_POST['event_id']);
    187         $event = $wpdb->get_row("SELECT topics FROM {$wpdb->prefix}wpabstracts_events Where event_id =" . $event_id);
     202        $event = $wpdb->get_row(
     203            $wpdb->prepare(
     204                "SELECT topics FROM {$wpdb->prefix}wpabstracts_events WHERE event_id = %d",
     205                $event_id
     206            )
     207        );
    188208        $topics = explode('|',$event->topics);
    189209        foreach($topics as $topic){ ?>

  • wp-abstracts-manuscripts-manager/trunk/inc/wpabstracts_classes.php

    r2844958 r3051393  
    127127        global $wpdb, $_wp_column_headers;
    128128        $screen = get_current_screen();
    129         $attachments_tbl = $wpdb->prefix."wpabstracts_attachments";
    130         $abstracts_tbl = $wpdb->prefix."wpabstracts_abstracts";
    131         $events_tbl = $wpdb->prefix."wpabstracts_events";
    132         $query = "SELECT atts.attachment_id, atts.abstracts_id, atts.filename, atts.filesize, abs.abstract_id, abs.title, abs.event, abs.topic, abs.submit_by, event.name as event_name FROM " . $attachments_tbl . " AS atts ";
    133         $query .="LEFT JOIN " . $abstracts_tbl . " AS abs ";
    134         $query .="ON atts.abstracts_id = abs.abstract_id ";
    135         $query .="LEFT JOIN " . $events_tbl . " AS event ";
    136         $query .="ON event.event_id = abs.event WHERE event.status = 1";
    137         $orderby = !empty($_GET["orderby"]) ? sanitize_text_field($_GET["orderby"]) : 'attachment_id';
    138         $order = !empty($_GET["order"]) ? sanitize_text_field($_GET["order"]) : 'desc';
    139         if(!empty($orderby) & !empty($order)){ $query.=' ORDER BY '.$orderby.' '.$order; }
     129        $attachments_tbl = $wpdb->prefix . "wpabstracts_attachments";
     130        $abstracts_tbl = $wpdb->prefix . "wpabstracts_abstracts";
     131        $events_tbl = $wpdb->prefix . "wpabstracts_events";
     132       
     133        $query = "SELECT atts.attachment_id, atts.abstracts_id, atts.filename, atts.filesize, abs.abstract_id, abs.title, abs.event, abs.topic, abs.submit_by, event.name AS event_name
     134        FROM {$attachments_tbl} AS atts
     135        LEFT JOIN {$abstracts_tbl} AS abs ON atts.abstracts_id = abs.abstract_id
     136        LEFT JOIN {$events_tbl} AS event ON event.event_id = abs.event
     137        WHERE event.status = %d";
     138       
     139        $query .= $wpdb->prepare(
     140            " ORDER BY %s %s",
     141            !empty($_GET["orderby"]) ? sanitize_text_field($_GET["orderby"]) : 'attachment_id',
     142            !empty($_GET["order"]) ? sanitize_text_field($_GET["order"]) : 'desc'
     143        );
     144       
    140145        $this->process_bulk_action();
    141         $this->items = $wpdb->get_results($query);
     146        $this->items = $wpdb->get_results($wpdb->prepare($query, 1));
    142147        $columns = $this->get_columns();
    143148        $_wp_column_headers[$screen->id]=$columns;
    … …  
    192197    function column_count($item){
    193198        global $wpdb;
    194         $count = $wpdb->get_var("SELECT COUNT(*) FROM {$wpdb->prefix}wpabstracts_abstracts WHERE `event` = " . $item->event_id);
     199        $count = $wpdb->get_var(
     200            $wpdb->prepare(
     201                "SELECT COUNT(*) FROM {$wpdb->prefix}wpabstracts_abstracts WHERE `event` = %d",
     202                $item->event_id
     203            )
     204        );
    195205        echo apply_filters('wpabstracts_event_submissions', $count, $item);
    196206    }
    … …  
    269279    function prepare_items() {
    270280        global $wpdb, $_wp_column_headers;
    271         $screen = get_current_screen();
    272         $events_tbl = $wpdb->prefix."wpabstracts_events";
    273         $query = "SELECT * FROM " . $events_tbl;
     281        $screen = get_current_screen();
     282        $events_tbl = $wpdb->prefix . "wpabstracts_events";
     283        $query = "SELECT * FROM {$events_tbl}";
    274284        $orderby = !empty($_GET["orderby"]) ? sanitize_text_field($_GET["orderby"]) : 'event_id';
    275285        $order = !empty($_GET["order"]) ? sanitize_text_field($_GET["order"]) : 'desc';
    276         if(!empty($orderby) & !empty($order)){ $query.=' ORDER BY '.$orderby.' '.$order; }
     286        if (!empty($orderby) && !empty($order)) {
     287            $query .= " ORDER BY {$orderby} {$order}";
     288        }
    277289        $this->process_bulk_action();
    278290        $this->items = $wpdb->get_results($query);

  • wp-abstracts-manuscripts-manager/trunk/inc/wpabstracts_downloads.php

    r2844958 r3051393  
    113113        abs.author_affiliation, abs.presenter, abs.presenter_email, abs.presenter_preference, user.ID, user.display_name,
    114114        user.user_email, GROUP_CONCAT(reviewers.user_id), GROUP_CONCAT(reviewer.display_name), abs.submit_date
    115         FROM " . $wpdb->prefix . "wpabstracts_abstracts as abs
    116         LEFT JOIN ". $wpdb->prefix . "wpabstracts_events as event ON abs.event = event.event_id
    117         LEFT JOIN ". $wpdb->base_prefix . "users as user ON user.ID = abs.submit_by
    118         LEFT JOIN ". $wpdb->prefix . "wpabstracts_reviewers as reviewers ON reviewers.abs_id = abs.abstract_id
    119         LEFT JOIN ". $wpdb->base_prefix . "users as reviewer ON reviewer.ID = reviewers.user_id";
    120 
    121         if($reportID > 0){
     115        FROM {$wpdb->prefix}wpabstracts_abstracts AS abs
     116        LEFT JOIN {$wpdb->prefix}wpabstracts_events AS event ON abs.event = event.event_id
     117        LEFT JOIN {$wpdb->base_prefix}users AS user ON user.ID = abs.submit_by
     118        LEFT JOIN {$wpdb->prefix}wpabstracts_reviewers AS reviewers ON reviewers.abs_id = abs.abstract_id
     119        LEFT JOIN {$wpdb->base_prefix}users AS reviewer ON reviewer.ID = reviewers.user_id";
     120
     121        if ($reportID > 0) {
    122122            $reportName = __("Abstracts", 'wpabstracts') . "-" . wpabstracts_map_status_name($statuses, $reportID);
    123             $reportData = $wpdb->get_results($selectSQL . " WHERE abs.status = " . intval($reportID) . " group by abs.abstract_id", ARRAY_N);
    124         } else{
     123            $reportData = $wpdb->get_results(
     124                $wpdb->prepare(
     125                    $selectSQL . " WHERE abs.status = %d GROUP BY abs.abstract_id",
     126                    $reportID
     127                ),
     128                ARRAY_N
     129            );
     130        } else {
    125131            $reportName = __("Abstracts-All", 'wpabstracts');
    126             $reportData = $wpdb->get_results($selectSQL . " group by abs.abstract_id", ARRAY_N);
     132            $reportData = $wpdb->get_results(
     133                $selectSQL . " GROUP BY abs.abstract_id",
     134                ARRAY_N
     135            );
    127136        }
    128137
    … …  
    276285
    277286    foreach($attachments as $attachments_id){
    278         $sql = $wpdb->prepare("SELECT * FROM {$wpdb->prefix}wpabstracts_attachments WHERE `attachment_id`=%d", $attachments_id);
    279         $attachment = $wpdb->get_row($sql);
     287        $sql = $wpdb->prepare(
     288            "SELECT * FROM {$wpdb->prefix}wpabstracts_attachments WHERE `attachment_id` = %d",
     289            $attachments_id
     290        );
     291        $attachment = $wpdb->get_row($sql);
    280292        $content = $attachment->format ? $attachment->filecontent : rawurldecode($attachment->filecontent);
    281293        $filename = "ID_". $attachment->abstracts_id . "_" . $attachment->attachment_id . "_" . $attachment->filename;
    … …  
    303315function wpabstracts_download_attachment($id) {
    304316    global $wpdb;
    305     $file = $wpdb->get_row("SELECT * FROM " . $wpdb->prefix . "wpabstracts_attachments WHERE attachment_id=" . $id);
     317    $file = $wpdb->get_row(
     318        $wpdb->prepare(
     319            "SELECT * FROM {$wpdb->prefix}wpabstracts_attachments WHERE attachment_id = %d",
     320            $id
     321        )
     322    );
    306323    $content = $file->format ? $file->filecontent : rawurldecode($file->filecontent);
    307324    header("Cache-Control: no-cache, must-revalidate");
    … …  
    315332function wpabstracts_download_attachments($atts){
    316333    global $wpdb;
    317     if(is_array($atts)){
    318         $sql = esc_sql("SELECT * FROM {$wpdb->prefix}wpabstracts_attachments WHERE attachment_id IN (" . implode(',', $atts) . ")");
     334    if (is_array($atts)) {
     335        $placeholders = array_fill(0, count($atts), '%d');
     336        $sql = $wpdb->prepare(
     337            "SELECT * FROM {$wpdb->prefix}wpabstracts_attachments WHERE attachment_id IN (" . implode(',', $placeholders) . ")",
     338            $atts
     339        );
    319340        $attachments = $wpdb->get_results($sql);
    320341    }

  • wp-abstracts-manuscripts-manager/trunk/inc/wpabstracts_functions.php

    r2844958 r3051393  
    1717    global $wpdb;
    1818    $wpdb->show_errors();
    19     $abs_tbl = $wpdb->prefix."wpabstracts_abstracts";
    20     $evt_tbl = $wpdb->prefix."wpabstracts_events";
    21     $query = "SELECT abs.*, evt.status as evt_status FROM {$abs_tbl} as abs";
    22     $query .=" LEFT JOIN {$evt_tbl} AS evt";
    23     $query .=" ON evt.event_id = abs.event WHERE evt.status = 1";
    24     if(is_array($key_value)) {
     19    $abs_tbl = $wpdb->prefix . "wpabstracts_abstracts";
     20    $evt_tbl = $wpdb->prefix . "wpabstracts_events";
     21    $query = "SELECT abs.*, evt.status AS evt_status FROM {$abs_tbl} AS abs";
     22    $query .= " LEFT JOIN {$evt_tbl} AS evt";
     23    $query .= " ON evt.event_id = abs.event WHERE evt.status = 1";
     24    if (is_array($key_value)) {
    2525        foreach ($key_value as $key => $value) {
    26             $query .=" AND abs.{$key} = $value";
     26            // Use prepare for each key-value pair
     27            $query .= $wpdb->prepare(" AND abs.{$key} = %s", $value);
    2728        }
    2829    }
    … …  
    3233function wpabstracts_get_abstract($absId){
    3334    global $wpdb;
    34     return $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wpabstracts_abstracts WHERE `abstract_id`=" . $absId);
     35    return $wpdb->get_row(
     36        $wpdb->prepare(
     37            "SELECT * FROM {$wpdb->prefix}wpabstracts_abstracts WHERE `abstract_id` = %d",
     38            $absId
     39        )
     40    );
    3541}
    3642
    3743function wpabstracts_get_review($id) {
    3844    global $wpdb;
    39     $sql = $wpdb->prepare("SELECT * FROM {$wpdb->prefix}wpabstracts_reviews WHERE `review_id` = %d", $id);
    40     return $wpdb->get_row($sql);
     45    return $wpdb->get_row(
     46        $wpdb->prepare(
     47            "SELECT * FROM {$wpdb->prefix}wpabstracts_reviews WHERE `review_id` = %d",
     48            $id
     49        )
     50    );
    4151}
    4252
    … …  
    5565}
    5666
    57 function wpabstracts_get_attachments($field, $value){
    58     global $wpdb;
    59     $ret_val = null;
    60     switch ($field){
    61         case 'abstracts_id':
    62         $attachments = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wpabstracts_attachments WHERE `abstracts_id`=".$value);
    63         $ret_val = $attachments;
    64         break;
    65     }
    66     return $ret_val;
    67 }
    68 
    69 function wpabstracts_delete_attachment($id, $message){
    70     global $wpdb;
    71     $wpdb->query("DELETE FROM {$wpdb->prefix}wpabstracts_attachments WHERE `attachment_id` = " . $id);
    72     if($message){
    73         wpabstracts_show_message("Attachment ID ". $id . " was successfully deleted", 'alert-success');
    74     }
     67function wpabstracts_get_attachments($field, $value) {
     68    global $wpdb;
     69    $ret_val = null;
     70    switch ($field) {
     71        case 'abstracts_id':
     72            $attachments = $wpdb->get_results(
     73                $wpdb->prepare(
     74                    "SELECT * FROM {$wpdb->prefix}wpabstracts_attachments WHERE `abstracts_id` = %d",
     75                    $value
     76                )
     77            );
     78            $ret_val = $attachments;
     79            break;
     80    }
     81    return $ret_val;
     82}
     83
     84function wpabstracts_delete_attachment($id, $message) {
     85    global $wpdb;
     86    $wpdb->query(
     87        $wpdb->prepare(
     88            "DELETE FROM {$wpdb->prefix}wpabstracts_attachments WHERE `attachment_id` = %d",
     89            $id
     90        )
     91    );
     92    if ($message) {
     93        wpabstracts_show_message("Attachment ID " . $id . " was successfully deleted", 'alert-success');
     94    }
    7595}
    7696
    … …  
    352372            $attachmentsIDs = (array) $_POST["abs_remove_attachments"];
    353373            foreach($attachmentsIDs AS $attachID){
    354                 $wpdb->query("DELETE FROM {$wpdb->prefix}wpabstracts_attachments WHERE attachment_id=".intval($attachID));
     374                $wpdb->query(
     375                    $wpdb->prepare(
     376                        "DELETE FROM {$wpdb->prefix}wpabstracts_attachments WHERE attachment_id = %d",
     377                        intval($attachID)
     378                    )
     379                );
    355380            }
    356381        }
    … …  
    571596
    572597function wpabstracts_user_submission_count() {
    573     global $wpdb;
    574     return $wpdb->get_var("SELECT COUNT(*) FROM {$wpdb->prefix}wpabstracts_abstracts WHERE `submit_by` = " . get_current_user_id());
     598    global $wpdb;
     599    return $wpdb->get_var(
     600        $wpdb->prepare(
     601            "SELECT COUNT(*) FROM {$wpdb->prefix}wpabstracts_abstracts WHERE `submit_by` = %d",
     602            get_current_user_id()
     603        )
     604    );
    575605}
    576606
    … …  
    946976}
    947977
    948 function wpabstracts_get_user($user_id){
    949     global $wpdb;
    950     $user = $wpdb->get_row("SELECT * FROM " . $wpdb->prefix."wpabstracts_users WHERE user_id = " . $user_id);
    951     return $user;
    952 }
    953 
    954 function wpabstracts_user_sync(){
    955     global $wpdb;
    956     $users = get_users();
    957     foreach($users as $user){
    958         $userExist = $wpdb->get_var('SELECT COUNT(*) FROM ' . $wpdb->prefix.'wpabstracts_users WHERE user_id = ' . $user->ID);
    959         if(!$userExist){
    960             $data = array('user_id' => $user->ID, 'status' => 1);
    961             $wpdb->insert($wpdb->prefix.'wpabstracts_users', $data);
    962         }
    963     }
     978function wpabstracts_get_user($user_id) {
     979    global $wpdb;
     980    $user = $wpdb->get_row(
     981        $wpdb->prepare(
     982            "SELECT * FROM {$wpdb->prefix}wpabstracts_users WHERE user_id = %d",
     983            $user_id
     984        )
     985    );
     986    return $user;
     987}
     988
     989function wpabstracts_user_sync() {
     990    global $wpdb;
     991    $users = get_users();
     992    foreach ($users as $user) {
     993        $userExist = $wpdb->get_var(
     994            $wpdb->prepare(
     995                'SELECT COUNT(*) FROM ' . $wpdb->prefix . 'wpabstracts_users WHERE user_id = %d',
     996                $user->ID
     997            )
     998        );
     999        if (!$userExist) {
     1000            $data = array('user_id' => $user->ID, 'status' => 1);
     1001            $wpdb->insert($wpdb->prefix . 'wpabstracts_users', $data);
     1002        }
     1003    }
    9641004}
    9651005

  • wp-abstracts-manuscripts-manager/trunk/readme.txt

    r3048640 r3051393  
    11=== WP Abstracts  ===
    22Contributors: kevon.adonis
    3 Tags: abstracts, conference plugin, peer reviews, abstract review, submission, reviewers, abstracts submission, manuscripts, abstracts manager, wordpress abstracts submission, abstracts management, conference plugin
     3Tags: abstracts manager, conference plugin, peer reviews, submission review, manuscript manager
    44Requires at least: 5.0
    55Requires PHP: >=5.6
    66Tested up to: 6.4.3
    7 Stable tag: 2.6.4
     7Stable tag: 2.6.5
    88License: GPLv2 or later
    99License URI: http://www.gnu.org/licenses/gpl-2.0.html
    … …  
    7171
    7272== Changelog ==
     73= 2.6.5 - 03/14/2024 =
     74* Security - Implement Wordpress best practices for unsafe SQL calls using wpdb->prepare()
     75* Compatibility testing up to WP 6.4.3
     76
    7377= 2.6.4 - 03/10/2024 =
    7478* Security - Resolved insufficient input sanitization on events settings and reset password page.

  • wp-abstracts-manuscripts-manager/trunk/users/users.classes.php

    r2355706 r3051393  
    184184        global $wpdb, $_wp_column_headers;
    185185        $screen = get_current_screen();
    186         $wpausers = $wpdb->prefix."wpabstracts_users";
    187         $wpusers = $wpdb->base_prefix."users";
    188         $wpusermeta = $wpdb->base_prefix."usermeta";
    189         $query = "SELECT wpausers.*, wpusers.ID as wpid, wpusers.user_email, wpusers.user_login, wpusermeta.meta_value as user_role FROM $wpausers AS wpausers " .
    190         "LEFT JOIN $wpusers AS wpusers ON wpausers.user_id = wpusers.ID " .
    191         "LEFT JOIN $wpusermeta AS wpusermeta ON wpusers.ID = wpusermeta.user_id WHERE wpusermeta.meta_key = '" . $wpdb->base_prefix . "capabilities'";
    192         if(isset($_GET['s']) && $_GET['s']){
     186
     187        $wpausers = $wpdb->prefix . "wpabstracts_users";
     188        $wpusers = $wpdb->base_prefix . "users";
     189        $wpusermeta = $wpdb->base_prefix . "usermeta";
     190       
     191        $query = $wpdb->prepare(
     192            "SELECT wpausers.*, wpusers.ID AS wpid, wpusers.user_email, wpusers.user_login, wpusermeta.meta_value AS user_role
     193            FROM {$wpausers} AS wpausers
     194            LEFT JOIN {$wpusers} AS wpusers ON wpausers.user_id = wpusers.ID
     195            LEFT JOIN {$wpusermeta} AS wpusermeta ON wpusers.ID = wpusermeta.user_id
     196            WHERE wpusermeta.meta_key = %s",
     197            $wpdb->base_prefix . "capabilities"
     198        );
     199       
     200        if (isset($_GET['s']) && $_GET['s']) {
    193201            $search = trim(sanitize_text_field($_GET['s']));
    194             $query .= " and ($wpusers.user_login LIKE '%" . $search . "%' OR $wpusers.user_email LIKE '%" . $search . "%')";
    195         }
    196         if(isset($_GET['status_filter']) && $_GET['status_filter']){
     202            $query .= $wpdb->prepare(
     203                " AND (wpusers.user_login LIKE %s OR wpusers.user_email LIKE %s)",
     204                '%' . $wpdb->esc_like($search) . '%',
     205                '%' . $wpdb->esc_like($search) . '%'
     206            );
     207        }
     208       
     209        if (isset($_GET['status_filter']) && $_GET['status_filter']) {
    197210            $status_filter = trim(sanitize_text_field($_GET['status_filter']));
    198             $query .= " and wpusermeta.meta_value LIKE '%" . $status_filter . "%'";
    199         }
     211            $query .= $wpdb->prepare(" AND wpusermeta.meta_value LIKE %s", '%' . $wpdb->esc_like($status_filter) . '%');
     212        }
     213       
    200214        $orderby = !empty($_GET["orderby"]) ? sanitize_text_field($_GET["orderby"]) : 'wpausers.user_id';
    201215        $order = !empty($_GET["order"]) ? sanitize_text_field($_GET["order"]) : 'desc';
    202         if(!empty($orderby) & !empty($order)){ $query.=' ORDER BY '.$orderby.' '.$order; }
     216        if (!empty($orderby) && !empty($order)) {
     217            $query .= " ORDER BY {$orderby} {$order}";
     218        }
     219       
    203220        $this->process_bulk_action();
    204221        $this->items = $wpdb->get_results($query);
     222       
     223       
    205224        $columns = $this->get_columns();
    206225        $_wp_column_headers[$screen->id]=$columns;

  • wp-abstracts-manuscripts-manager/trunk/users/users.downloads.php

    r2355706 r3051393  
    2020
    2121function wpabstracts_useraddon_export_users() {
     22    global $wpdb;
     23    $wpa_users = $wpdb->prefix . "wpabstracts_users";
     24    $wp_users = $wpdb->prefix . "users";
    2225
    23     global $wpdb;
    24     $wpa_users = $wpdb->prefix."wpabstracts_users";
    25     $wp_users = $wpdb->prefix."users";
    26     $query = "SELECT wpusers.ID, wpusers.user_email, wpausers.data, wpausers.status FROM $wpa_users AS wpausers LEFT JOIN $wp_users AS wpusers ON wpausers.user_id = wpusers.ID";
     26    $query = $wpdb->prepare(
     27        "SELECT wpusers.ID, wpusers.user_email, wpausers.data, wpausers.status
     28        FROM {$wpa_users} AS wpausers
     29        LEFT JOIN {$wp_users} AS wpusers ON wpausers.user_id = wpusers.ID"
     30    );
     31
    2732    $users = $wpdb->get_results($query);
    2833

  • wp-abstracts-manuscripts-manager/trunk/wpabstracts.php

    r3048640 r3051393  
    44Plugin URI: http://www.wpabstracts.com
    55Description: Allow abstracts submissions on your site. Manage everything from events, abstracts, authors, reviews, attachments, notifications and more.
    6 Version: 2.6.4
     6Version: 2.6.5
    77Author: Kevon Adonis
    88Author URI: http://www.kevonadonis.com
    … …  
    1414define('WPABSTRACTS_ACCESS_LEVEL', 'manage_options');
    1515define('WPABSTRACTS_PLUGIN_DIR', dirname(__FILE__) . '/');
    16 define('WPABSTRACTS_VERSION', '2.6.4');
     16define('WPABSTRACTS_VERSION', '2.6.5');
    1717define('WPABSTRACTS_SECRET_KEY', '5a22d6e80bf870.68089106');
    1818register_activation_hook(__FILE__,'wpabstracts_install');
    … …  
    441441    $users = get_users();
    442442    foreach($users as $user){
    443         $userExist = $wpdb->get_var("SELECT COUNT(*) FROM " . $user_tbl . " WHERE user_id = " . $user->ID);
     443        $userExist = $wpdb->get_var(
     444            $wpdb->prepare(
     445                "SELECT COUNT(*) FROM {$user_tbl} WHERE user_id = %d",
     446                $user->ID
     447            )
     448        );
    444449        if(!$userExist){
    445450            $data = array('user_id' => $user->ID, 'status' => 1);
    … …  
    759764    global $wpdb;
    760765    if($_POST['event_id']){
    761         $event_id = intval($_POST['event_id']);
    762         $event = $wpdb->get_row("SELECT topics FROM {$wpdb->prefix}wpabstracts_events Where event_id =" . $event_id);
     766        $event_id = intval($_POST['event_id']);
     767        $event = $wpdb->get_row(
     768            $wpdb->prepare(
     769                "SELECT topics FROM {$wpdb->prefix}wpabstracts_events WHERE event_id = %d",
     770                $event_id
     771            )
     772        );
    763773        $topics = explode('|', $event->topics);
    764774        foreach($topics as $topic){ ?>
Note: See TracChangeset for help on using the changeset viewer.