From bacf66c2b4fa7d3ea4ac70e45746e48f03e937c0 Mon Sep 17 00:00:00 2001 From: Mykyta Synelnikov Date: Wed, 20 Sep 2023 21:31:50 +0300 Subject: [PATCH] - probably fix with another way for this PR #1304; --- includes/core/class-member-directory-meta.php | 33 +++---- includes/core/class-member-directory.php | 89 ++++++++++++------- 2 files changed, 75 insertions(+), 47 deletions(-) diff --git a/includes/core/class-member-directory-meta.php b/includes/core/class-member-directory-meta.php index 75378531..7de32645 100644 --- a/includes/core/class-member-directory-meta.php +++ b/includes/core/class-member-directory-meta.php @@ -587,24 +587,25 @@ if ( ! class_exists( 'um\core\Member_Directory_Meta' ) ) { } if ( ! empty( $_POST['search'] ) ) { - $search_line = trim( stripslashes( sanitize_text_field( $_POST['search'] ) ) ); + $search_line = $this->prepare_search( $_POST['search'] ); + if ( ! empty( $search_line ) ) { + $searches = array(); + foreach ( $this->core_search_fields as $field ) { + $searches[] = $wpdb->prepare( "u.{$field} LIKE %s", '%' . $search_line . '%' ); + } - $searches = array(); - foreach ( $this->core_search_fields as $field ) { - $searches[] = $wpdb->prepare( "u.{$field} LIKE %s", '%' . $search_line . '%' ); + $core_search = implode( ' OR ', $searches ); + + $this->joins[] = "LEFT JOIN {$wpdb->prefix}um_metadata umm_search ON umm_search.user_id = u.ID"; + + $additional_search = apply_filters( 'um_member_directory_meta_general_search_meta_query', '',$search_line ); + + $search_like_string = apply_filters( 'um_member_directory_meta_search_like_type', '%' . $search_line . '%', $search_line ); + + $this->where_clauses[] = $wpdb->prepare( "( umm_search.um_value = %s OR umm_search.um_value LIKE %s OR umm_search.um_value LIKE %s OR {$core_search}{$additional_search})", $search_line, $search_like_string, '%' . serialize( (string) $search_line ) . '%' ); + + $this->is_search = true; } - - $core_search = implode( ' OR ', $searches ); - - $this->joins[] = "LEFT JOIN {$wpdb->prefix}um_metadata umm_search ON umm_search.user_id = u.ID"; - - $additional_search = apply_filters( 'um_member_directory_meta_general_search_meta_query', '', stripslashes( sanitize_text_field( $_POST['search'] ) ) ); - - $search_like_string = apply_filters( 'um_member_directory_meta_search_like_type', '%' . $search_line . '%', $search_line ); - - $this->where_clauses[] = $wpdb->prepare( "( umm_search.um_value = %s OR umm_search.um_value LIKE %s OR umm_search.um_value LIKE %s OR {$core_search}{$additional_search})", $search_line, $search_like_string, '%' . serialize( (string) $search_line ) . '%' ); - - $this->is_search = true; } //filters diff --git a/includes/core/class-member-directory.php b/includes/core/class-member-directory.php index dc37cee8..3ceeb1e3 100644 --- a/includes/core/class-member-directory.php +++ b/includes/core/class-member-directory.php @@ -1614,43 +1614,72 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) { return $query; } + /** + * Prepare the search line. Avoid the using mySQL statement. + * + * @param string $search + * + * @return string + */ + protected function prepare_search( $search ) { + // unslash, sanitize, trim - necessary prepare. + $search = trim( sanitize_text_field( wp_unslash( $search ) ) ); + if ( empty( $search ) ) { + return ''; + } + // Make the search line empty if it contains the mySQL query statements. + $regexp_map = array( + '/select(.*?)from/im', + '/update(.*?)set/im', + '/delete(.*?)from/im', + ); + + foreach ( $regexp_map as $regexp ) { + preg_match( $regexp, $search, $matches ); + if ( ! empty( $matches ) ) { + $search = ''; + break; + } + } + + return $search; + } /** * Handle general search line request */ - function general_search() { + public function general_search() { //general search if ( ! empty( $_POST['search'] ) ) { // complex using with change_meta_sql function + $search = $this->prepare_search( $_POST['search'] ); + if ( ! empty( $search ) ) { + $meta_query = array( + 'relation' => 'OR', + array( + 'value' => $search, + 'compare' => '=', + ), + array( + 'value' => $search, + 'compare' => 'LIKE', + ), + array( + 'value' => serialize( (string) $search ), + 'compare' => 'LIKE', + ), + ); - $search = trim( sanitize_text_field( wp_unslash( $_POST['search'] ) ) ); + $meta_query = apply_filters( 'um_member_directory_general_search_meta_query', $meta_query, $search ); - $meta_query = array( - 'relation' => 'OR', - array( - 'value' => $search, - 'compare' => '=', - ), - array( - 'value' => $search, - 'compare' => 'LIKE', - ), - array( - 'value' => serialize( (string) $search ), - 'compare' => 'LIKE', - ), - ); + $this->query_args['meta_query'][] = $meta_query; - $meta_query = apply_filters( 'um_member_directory_general_search_meta_query', $meta_query, $search ); - - $this->query_args['meta_query'][] = $meta_query; - - $this->is_search = true; + $this->is_search = true; + } } } - /** * Change mySQL meta query join attribute * for search only by UM user meta fields and WP core fields in WP Users table @@ -1662,17 +1691,16 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) { * @param $primary_id_column * @param \WP_User_Query $context * - * @return mixed + * @return array */ - function change_meta_sql( $sql, $queries, $type, $primary_table, $primary_id_column, $context ) { + public function change_meta_sql( $sql, $queries, $type, $primary_table, $primary_id_column, $context ) { if ( ! empty( $_POST['search'] ) ) { - global $wpdb; - - $search = trim( sanitize_text_field( wp_unslash( $_POST['search'] ) ) ); + $search = $this->prepare_search( $_POST['search'] ); if ( ! empty( $search ) ) { + global $wpdb; - $meta_value = '%' . $wpdb->esc_like( $search ) . '%'; - $search_meta = $wpdb->prepare( '%s', $meta_value ); + $meta_value = '%' . $wpdb->esc_like( $search ) . '%'; + $search_meta = $wpdb->prepare( '%s', $meta_value ); preg_match( '~(?<=\{)(.*?)(?=\})~', $search_meta, $matches, PREG_OFFSET_CAPTURE, 0 ); @@ -1740,7 +1768,6 @@ if ( ! class_exists( 'um\core\Member_Directory' ) ) { return $sql; } - /** * Handle filters request */