Changeset 2707223

Timestamp:

04/08/2022 10:17:35 PM (3 years ago)

Author:

pluginbazar

Message:

security fixed with $wpdb

Location:

woc-order-alert/trunk

Files:

• composer.lock (deleted)
• includes/class-hooks.php (modified) (2 diffs)
• readme.txt (modified) (1 diff)
• woc-order-alert.php (modified) (1 diff)

woc-order-alert/trunk/includes/class-hooks.php

@@ -107 +107 @@
             global $wpdb;
 
-            $all_orders           = $wpdb->get_results( "SELECT * FROM " . OLISTENER_DATA_TABLE . " WHERE read_status = 'unread'" );
+            $all_orders           = $wpdb->get_results(
+                $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}woocommerce_order_listener WHERE read_status = %s", 'unread' )
+            );
+            $all_orders           = ! is_array( $all_orders ) ? array() : $all_orders;
             $order_list_items_all = olistener()->get_order_list_items();
             $order_list_items     = olistener()->get_option( 'olistener_order_list_items', array_keys( $order_list_items_all ) );
@@ -192 +195 @@
 
                 $order_total  = sanitize_text_field( olistener()->get_args_option( 'total', '', $json_params ) );
-                $all_orders   = $wpdb->get_results( "SELECT * FROM " . OLISTENER_DATA_TABLE . " WHERE `order_id` = $order_id AND `order_total` = $order_total" );
+                $all_orders   = $wpdb->get_results(
+                    $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}woocommerce_order_listener WHERE order_id = %d", $order_id )
+                );
+                $all_orders   = ! is_array( $all_orders ) ? array() : $all_orders;
                 $latest_order = end( $all_orders );
                 $order_args   = array(

woc-order-alert/trunk/readme.txt

@@ -7 +7 @@
     Tested up to: 5.9.3
     Tested up to WooCommerce: 6.3.1
-    Stable tag: 3.2.0
+    Stable tag: 3.2.2
     License: GPLv2 or later
     License URI: http://www.gnu.org/licenses/gpl-2.0.html

woc-order-alert/trunk/woc-order-alert.php

@@ -4 +4 @@
     Plugin URI: https://pluginbazar.com/
     Description: Play sound as notification instantly on new order in your WooCommerce store
-    Version: 3.2.1
+    Version: 3.2.2
     Author: Pluginbazar
     Author URI: https://pluginbazar.com/