<?php

[0] Fix | Delete

[1] Fix | Delete

namespace StringLocator\Extension\SQL;

[2] Fix | Delete

[3] Fix | Delete

use StringLocator\Base\Search as SearchBase;

[4] Fix | Delete

use StringLocator\String_Locator;

[5] Fix | Delete

[6] Fix | Delete

/**

[7] Fix | Delete

* Search class.

[8] Fix | Delete

*/

[9] Fix | Delete

class Search extends SearchBase {

[10] Fix | Delete

[11] Fix | Delete

/**

[12] Fix | Delete

* Class constructor.

[13] Fix | Delete

*/

[14] Fix | Delete

public function __construct() {

[15] Fix | Delete

add_filter( 'string_locator_search_sources_markup', array( $this, 'add_search_options' ), 11, 2 );

[16] Fix | Delete

[17] Fix | Delete

add_filter( 'string_locator_search_handler', array( $this, 'maybe_perform_sql_search' ), 10, 2 );

[18] Fix | Delete

add_filter( 'string_locator_directory_iterator_short_circuit', array( $this, 'maybe_short_circuit_directory_iterator' ), 10, 2 );

[19] Fix | Delete

[20] Fix | Delete

add_filter( 'string_locator_restore_search_row', array( $this, 'restore_sql_search' ), 10, 2 );

[21] Fix | Delete

[22] Fix | Delete

parent::__construct();

[23] Fix | Delete

}

[24] Fix | Delete

[25] Fix | Delete

/**

[26] Fix | Delete

* Handle markup output when restoring a search result.

[27] Fix | Delete

*

[28] Fix | Delete

* @param string $row The result row.

[29] Fix | Delete

* @param object $item The search result item for this row.

[30] Fix | Delete

*

[31] Fix | Delete

* @return string

[32] Fix | Delete

*/

[33] Fix | Delete

public function restore_sql_search( $row, $item ) {

[34] Fix | Delete

if ( ! isset( $item->primary_key ) ) {

[35] Fix | Delete

return $row;

[36] Fix | Delete

}

[37] Fix | Delete

[38] Fix | Delete

$row = sprintf(

[39] Fix | Delete

'<tr data-type="sql" data-primary-key="%d" data-primary-column="%s" data-primary-type="%s" data-table-name="%s" data-column-name="%s">

[40] Fix | Delete

<th scope="row" class="check-column">

[41] Fix | Delete

<input type="checkbox" name="string-locator-replace-checked[]" class="check-column-box">

[42] Fix | Delete

</th>

[43] Fix | Delete

<td>

[44] Fix | Delete

%s

[45] Fix | Delete

<div class="row-actions">

[46] Fix | Delete

%s

[47] Fix | Delete

</div>

[48] Fix | Delete

</td>

[49] Fix | Delete

<td>

[50] Fix | Delete

%s

[51] Fix | Delete

</td>

[52] Fix | Delete

<td>

[53] Fix | Delete

%d

[54] Fix | Delete

</td>

[55] Fix | Delete

<td>

[56] Fix | Delete

%d

[57] Fix | Delete

</td>

[58] Fix | Delete

</tr>',

[59] Fix | Delete

esc_attr( $item->primary_key ),

[60] Fix | Delete

esc_attr( $item->primary_column ),

[61] Fix | Delete

esc_attr( $item->primary_type ),

[62] Fix | Delete

esc_attr( $item->table ),

[63] Fix | Delete

esc_attr( $item->column ),

[64] Fix | Delete

$item->stringresult,

[65] Fix | Delete

( ! current_user_can( String_Locator::$default_capability ) ? '' : sprintf(

[66] Fix | Delete

'<span class="edit"><a href="%1$s" aria-label="%2$s">%2$s</a></span>',

[67] Fix | Delete

esc_url( $item->editurl ),

[68] Fix | Delete

// translators: The row-action edit link label.

[69] Fix | Delete

esc_html__( 'Edit', 'string-locator' )

[70] Fix | Delete

) ),

[71] Fix | Delete

( ! current_user_can( String_Locator::$default_capability ) ? $item->filename : sprintf(

[72] Fix | Delete

'<a href="%s">%s</a>',

[73] Fix | Delete

esc_url( $item->editurl ),

[74] Fix | Delete

esc_html( $item->filename )

[75] Fix | Delete

) ),

[76] Fix | Delete

esc_html( $item->primary_key ),

[77] Fix | Delete

esc_html( $item->linepos )

[78] Fix | Delete

);

[79] Fix | Delete

[80] Fix | Delete

return $row;

[81] Fix | Delete

}

[82] Fix | Delete

[83] Fix | Delete

/**

[84] Fix | Delete

* Add SQL items as search options.

[85] Fix | Delete

*

[86] Fix | Delete

* @param string $searchers The markup for the existing search options.

[87] Fix | Delete

* @param string $search_location The currently selected search option, when restoring a search.

[88] Fix | Delete

*

[89] Fix | Delete

* @return string

[90] Fix | Delete

*/

[91] Fix | Delete

public function add_search_options( $searchers, $search_location ) {

[92] Fix | Delete

ob_start();

[93] Fix | Delete

?>

[94] Fix | Delete

[95] Fix | Delete

<optgroup label="<?php esc_attr_e( 'Database', 'string-locator' ); ?>">

[96] Fix | Delete

<option value="sql"<?php echo ( 'sql' === $search_location ? ' selected="selected"' : '' ); ?>><?php esc_html_e( 'All database tables', 'string-locator' ); ?></option>

[97] Fix | Delete

</optgroup>

[98] Fix | Delete

[99] Fix | Delete

<?php

[100] Fix | Delete

[101] Fix | Delete

$searchers .= ob_get_clean();

[102] Fix | Delete

[103] Fix | Delete

return $searchers;

[104] Fix | Delete

}

[105] Fix | Delete

[106] Fix | Delete

/**

[107] Fix | Delete

* Output the underscores template used for SQL search results.

[108] Fix | Delete

*

[109] Fix | Delete

* @return void

[110] Fix | Delete

*/

[111] Fix | Delete

public function add_search_response_template() {

[112] Fix | Delete

require_once STRING_LOCATOR_PLUGIN_DIR . '/includes/Extension/SQL/views/template/search.php';

[113] Fix | Delete

}

[114] Fix | Delete

[115] Fix | Delete

/**

[116] Fix | Delete

* Allow the SQL search to ignore the DirectoryIterator request used to build search bases for files.

[117] Fix | Delete

*

[118] Fix | Delete

* @param bool $short_circuit Whether to short-circuit the DirectoryIterator request.

[119] Fix | Delete

* @param \WP_REST_Response $request The WP_REST_Request for this API call.

[120] Fix | Delete

*

[121] Fix | Delete

* @return array

[122] Fix | Delete

*/

[123] Fix | Delete

public function maybe_short_circuit_directory_iterator( $short_circuit, $request ) {

[124] Fix | Delete

$data = json_decode( $request->get_param( 'data' ) );

[125] Fix | Delete

[126] Fix | Delete

if ( 'sql' === $data->directory ) {

[127] Fix | Delete

$store = (object) array(

[128] Fix | Delete

'type' => 'sql',

[129] Fix | Delete

'search' => $data->search,

[130] Fix | Delete

'directory' => 'sql',

[131] Fix | Delete

'chunks' => 1,

[132] Fix | Delete

'regex' => $data->regex,

[133] Fix | Delete

);

[134] Fix | Delete

[135] Fix | Delete

set_transient( 'string-locator-search-overview', $store );

[136] Fix | Delete

update_option( 'string-locator-search-history', array(), false );

[137] Fix | Delete

[138] Fix | Delete

return array(

[139] Fix | Delete

'success' => true,

[140] Fix | Delete

'data' => array(

[141] Fix | Delete

'chunks' => 1,

[142] Fix | Delete

'current' => 0,

[143] Fix | Delete

'regex' => $data->regex,

[144] Fix | Delete

'total' => 1,

[145] Fix | Delete

),

[146] Fix | Delete

);

[147] Fix | Delete

}

[148] Fix | Delete

[149] Fix | Delete

return $short_circuit;

[150] Fix | Delete

}

[151] Fix | Delete

[152] Fix | Delete

/**

[153] Fix | Delete

* Conditionally override the search handler.

[154] Fix | Delete

*

[155] Fix | Delete

* @param mixed $handler The currently active class for handling the search request.

[156] Fix | Delete

* @param \WP_REST_Request $request The request received by the REST API handler.

[157] Fix | Delete

*

[158] Fix | Delete

* @return $this

[159] Fix | Delete

*/

[160] Fix | Delete

public function maybe_perform_sql_search( $handler, $request ) {

[161] Fix | Delete

$search_data = get_transient( 'string-locator-search-overview' );

[162] Fix | Delete

[163] Fix | Delete

if ( empty( $search_data ) || ! isset( $search_data->type ) || 'sql' !== $search_data->type ) {

[164] Fix | Delete

return $handler;

[165] Fix | Delete

}

[166] Fix | Delete

[167] Fix | Delete

return $this;

[168] Fix | Delete

}

[169] Fix | Delete

[170] Fix | Delete

/**

[171] Fix | Delete

* Run the search.

[172] Fix | Delete

*

[173] Fix | Delete

* @param int $filenum An integer representing where in the line you are when doing batch searches.

[174] Fix | Delete

*

[175] Fix | Delete

* @return array

[176] Fix | Delete

*/

[177] Fix | Delete

public function run( $filenum ) {

[178] Fix | Delete

global $wpdb;

[179] Fix | Delete

[180] Fix | Delete

$response = array(

[181] Fix | Delete

'search' => array(),

[182] Fix | Delete

'filenum' => absint( $filenum ),

[183] Fix | Delete

'current' => 0,

[184] Fix | Delete

'total' => 0,

[185] Fix | Delete

'type' => 'sql',

[186] Fix | Delete

);

[187] Fix | Delete

[188] Fix | Delete

$scan_data = get_transient( 'string-locator-search-overview' );

[189] Fix | Delete

[190] Fix | Delete

$is_regex = false;

[191] Fix | Delete

if ( isset( $scan_data->regex ) ) {

[192] Fix | Delete

$is_regex = String_Locator::absbool( $scan_data->regex );

[193] Fix | Delete

}

[194] Fix | Delete

[195] Fix | Delete

if ( $is_regex ) {

[196] Fix | Delete

if ( false === @preg_match( $scan_data->search, '' ) ) { // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged

[197] Fix | Delete

wp_send_json_error(

[198] Fix | Delete

array(

[199] Fix | Delete

'continue' => false,

[200] Fix | Delete

'message' => sprintf(

[201] Fix | Delete

/* translators: %s: The search string used. */

[202] Fix | Delete

__( 'Your search string, <strong>%s</strong>, is not a valid pattern, and the search has been aborted.', 'string-locator' ),

[203] Fix | Delete

esc_html( $scan_data->search )

[204] Fix | Delete

),

[205] Fix | Delete

)

[206] Fix | Delete

);

[207] Fix | Delete

}

[208] Fix | Delete

}

[209] Fix | Delete

[210] Fix | Delete

// Get al ist of all available tables to search through.

[211] Fix | Delete

$tables = $wpdb->get_results( 'SHOW TABLES' );

[212] Fix | Delete

[213] Fix | Delete

$identifier_name = 'Tables_in_' . DB_NAME;

[214] Fix | Delete

[215] Fix | Delete

if ( ! validate_sql_fields( $identifier_name ) ) {

[216] Fix | Delete

wp_send_json_error(

[217] Fix | Delete

array(

[218] Fix | Delete

'continue' => false,

[219] Fix | Delete

'message' => sprintf(

[220] Fix | Delete

/* translators: %s: The search string used. */

[221] Fix | Delete

__( 'The table identifier, combined with your database name, <strong>%s</strong>, is not a valid SQL pattern, and the search has been aborted.', 'string-locator' ),

[222] Fix | Delete

esc_html( $identifier_name )

[223] Fix | Delete

),

[224] Fix | Delete

)

[225] Fix | Delete

);

[226] Fix | Delete

}

[227] Fix | Delete

[228] Fix | Delete

$match_count = 0;

[229] Fix | Delete

[230] Fix | Delete

$search_results = array();

[231] Fix | Delete

[232] Fix | Delete

foreach ( $tables as $table ) {

[233] Fix | Delete

$table_name = $table->{ $identifier_name };

[234] Fix | Delete

[235] Fix | Delete

$columns = $wpdb->get_results( 'DESCRIBE ' . $table_name ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- The table name is validated earlier for SQLi, and needs to be dynamic due to relying on `DB_NAME`.

[236] Fix | Delete

[237] Fix | Delete

$primary_column = null;

[238] Fix | Delete

$primary_type = null;

[239] Fix | Delete

[240] Fix | Delete

// Initial loop only gets primary data.

[241] Fix | Delete

foreach ( $columns as $column ) {

[242] Fix | Delete

if ( 'PRI' === $column->Key ) { // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase -- Object property name is returned by the MySQL database.

[243] Fix | Delete

$primary_column = $column->Field; // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase -- Object property name is returned by the MySQL database.

[244] Fix | Delete

$primary_type = ( stristr( $column->Type, 'int' ) ? 'int' : 'str' ); // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase -- Object property name is returned by the MySQL database.

[245] Fix | Delete

}

[246] Fix | Delete

}

[247] Fix | Delete

[248] Fix | Delete

foreach ( $columns as $column ) {

[249] Fix | Delete

$column_name = $column->Field; // phpcs:ignore WordPress.NamingConventions.ValidVariableName.UsedPropertyNotSnakeCase -- Object property name is returned by the MySQL database.

[250] Fix | Delete

[251] Fix | Delete

if ( $is_regex ) {

[252] Fix | Delete

$matches = $wpdb->get_results(

[253] Fix | Delete

$wpdb->prepare(

[254] Fix | Delete

'SELECT ' . $column_name . ' AS column_name, ' . $primary_column . ' as primary_column FROM ' . $table_name . ' WHERE ' . $column_name . ' REGEXP %s', // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- It is not possible to prepare a table or column name, but these are instead validated in `/includes/Search/class-sql.php` before reaching this point.

[255] Fix | Delete

$scan_data->search

[256] Fix | Delete

)

[257] Fix | Delete

);

[258] Fix | Delete

} else {

[259] Fix | Delete

$matches = $wpdb->get_results(

[260] Fix | Delete

$wpdb->prepare(

[261] Fix | Delete

'SELECT ' . $column_name . ' AS column_name, ' . $primary_column . ' as primary_column FROM ' . $table_name . ' WHERE ' . $column_name . ' LIKE %s', // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- It is not possible to prepare a table or column name, but these are instead validated in `/includes/Search/class-sql.php` before reaching this point.

[262] Fix | Delete

'%' . $wpdb->esc_like( $scan_data->search ) . '%'

[263] Fix | Delete

)

[264] Fix | Delete

);

[265] Fix | Delete

}

[266] Fix | Delete

[267] Fix | Delete

if ( is_wp_error( $matches ) ) {

[268] Fix | Delete

wp_send_json_error(

[269] Fix | Delete

array(

[270] Fix | Delete

'continue' => false,

[271] Fix | Delete

'message' => sprintf(

[272] Fix | Delete

/* translators: 1: The search string used. 2: The error received */

[273] Fix | Delete

__( 'Your search for <strong>%1$s</strong> led to an SQL error, and the search has been aborted. The error encountered was: %2$s', 'string-locator' ),

[274] Fix | Delete

esc_html( $scan_data->search ),

[275] Fix | Delete

esc_html( $matches->get_error_message() )

[276] Fix | Delete

),

[277] Fix | Delete

)

[278] Fix | Delete

);

[279] Fix | Delete

}

[280] Fix | Delete

[281] Fix | Delete

foreach ( $matches as $match ) {

[282] Fix | Delete

$match_count++;

[283] Fix | Delete

[284] Fix | Delete

$string = $scan_data->search;

[285] Fix | Delete

$string_preview = $match->column_name;

[286] Fix | Delete

[287] Fix | Delete

$string_location = 0;

[288] Fix | Delete

[289] Fix | Delete

$string_preview = String_Locator::create_preview( $string_preview, $string, $is_regex );

[290] Fix | Delete

[291] Fix | Delete

$editurl = $this->create_edit_link( $table_name, $column_name, $primary_column, $primary_type, $match );

[292] Fix | Delete

[293] Fix | Delete

$search_results[] = array(

[294] Fix | Delete

'ID' => $match_count,

[295] Fix | Delete

'table' => $table_name,

[296] Fix | Delete

'column' => $column_name,

[297] Fix | Delete

'primary_key' => $match->primary_column,

[298] Fix | Delete

'primary_type' => $primary_type,

[299] Fix | Delete

'primary_column' => $primary_column,

[300] Fix | Delete

'filename' => sprintf(

[301] Fix | Delete

'`%s`.`%s`',

[302] Fix | Delete

$table_name,

[303] Fix | Delete

$column_name

[304] Fix | Delete

),

[305] Fix | Delete

'filename_raw' => sprintf(

[306] Fix | Delete

'`%s`.`%s`',

[307] Fix | Delete

$table_name,

[308] Fix | Delete

$column_name

[309] Fix | Delete

),

[310] Fix | Delete

'editurl' => ( current_user_can( String_Locator::$default_capability ) ? $editurl : false ),

[311] Fix | Delete

'stringresult' => $string_preview,

[312] Fix | Delete

'linepos' => $string_location,

[313] Fix | Delete

'linenum' => 0,

[314] Fix | Delete

);

[315] Fix | Delete

}

[316] Fix | Delete

}

[317] Fix | Delete

}

[318] Fix | Delete

[319] Fix | Delete

if ( ! empty( $search_results ) ) {

[320] Fix | Delete

$history = get_option( 'string-locator-search-history', array() );

[321] Fix | Delete

$history = array_merge( $history, $search_results );

[322] Fix | Delete

update_option( 'string-locator-search-history', $history, false );

[323] Fix | Delete

}

[324] Fix | Delete

[325] Fix | Delete

$response['search'] = array(

[326] Fix | Delete

$search_results,

[327] Fix | Delete

);

[328] Fix | Delete

[329] Fix | Delete

return $response;

[330] Fix | Delete

}

[331] Fix | Delete

[332] Fix | Delete

/**

[333] Fix | Delete

* Generate a link to the editor interface for a search result.

[334] Fix | Delete

*

[335] Fix | Delete

* @param string $table_name The table name where a match was found.

[336] Fix | Delete

* @param string $column_name The column name where a match was found.

[337] Fix | Delete

* @param string $primary_column The primary column from the table having a match.

[338] Fix | Delete

* @param string $primary_type The type of the primary column.

[339] Fix | Delete

* @param object $match An object containing details of the match.

[340] Fix | Delete

*

[341] Fix | Delete

* @return string

[342] Fix | Delete

*/

[343] Fix | Delete

public function create_edit_link( $table_name, $column_name, $primary_column, $primary_type, $match ) {

[344] Fix | Delete

return add_query_arg(

[345] Fix | Delete

array(

[346] Fix | Delete

'page' => 'string-locator',

[347] Fix | Delete

'edit-file' => true,

[348] Fix | Delete

'file-type' => 'sql',

[349] Fix | Delete

'file-reference' => sprintf(

[350] Fix | Delete

'`%s`.`%s`',

[351] Fix | Delete

$table_name,

[352] Fix | Delete

$column_name

[353] Fix | Delete

),

[354] Fix | Delete

'sql-column' => $column_name,

[355] Fix | Delete

'sql-table' => $table_name,

[356] Fix | Delete

'sql-primary-column' => $primary_column,

[357] Fix | Delete

'sql-primary-type' => $primary_type,

[358] Fix | Delete

'sql-primary-key' => $match->primary_column,

[359] Fix | Delete

),

[360] Fix | Delete

admin_url( $this->path_to_use )

[361] Fix | Delete

);

[362] Fix | Delete

}

[363] Fix | Delete

}

[364] Fix | Delete

[365] Fix | Delete

new Search();

[366] Fix | Delete

[367] Fix | Delete