Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix critical PHPCS issues #197

Open
wants to merge 10 commits into
base: develop
Choose a base branch
from
Open

Fix critical PHPCS issues #197

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
234dbd3
Add PHPCS configuration file
philcable Nov 21, 2019
1c1eb73
Update SQL queries to avoid false positives for unprepared statments
philcable Nov 21, 2019
c270d9f
Fix unprepared SQL statements
philcable Nov 21, 2019
3df05f3
Update changelog
philcable Nov 27, 2019
d1f7e65
Improve SQL statement preparation
philcable Dec 3, 2019
86d2ebe
Adjust page template query with proper preparation
jeremyfelt Jan 15, 2020
06d0969
Add comments to explain query placeholders
jeremyfelt Jan 15, 2020
95ddd4a
Use double quotes around queries with interpolated variables
jeremyfelt Jan 16, 2020
8ddb4e5
Remove phpunit checks for expected incorrect usage of `$wpdb->prepare`
jeremyfelt Jan 16, 2020
175a16e
Merge branch 'develop' into fix/critical-phpcs-issues
ashleykolodziej Sep 25, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,8 @@
## Unreleased

- Removes duplicate call to burf-base, which is a dependency of burf-theme.
- Adds PHPCS configuration file.
- Updates and prepares SQL queries per PHPCS.

## 2.3.61

Expand Down
3 changes: 1 addition & 2 deletions inc/migration-helpers.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -249,8 +249,7 @@ function responsive_migrate_contact_form() {

if ( class_exists( 'GFForms' ) && class_exists( 'GFAPI' ) ) {

$contact_query = sprintf( 'SELECT post_id FROM %s WHERE meta_key = "_wp_page_template" AND meta_value = "contact-us.php"', $wpdb->postmeta );
$results = $wpdb->get_col( $contact_query );
$results = $wpdb->get_col( 'SELECT post_id FROM $wpdb->postmeta WHERE meta_key = "_wp_page_template" AND meta_value = "contact-us.php"' );

if ( empty( $results ) ) {
return;
Expand Down
43 changes: 20 additions & 23 deletions inc/upgrade.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,13 +115,16 @@ function responsive_upgrade_091( $verbose = true ) {
)
);

$template_query = sprintf(
'SELECT post_id, meta_value FROM %s WHERE meta_key = "_wp_page_template" AND meta_value IN ("%s")',
$wpdb->postmeta,
implode( '","', array_keys( $template_map ) )
);
// Extract array keys for reuse when generating the query.
$template_map_keys = array_keys( $template_map );

$results = $wpdb->get_results( $template_query );
// Prepare the query by adding a %s placeholder for each key of the passed array.
$results = $wpdb->get_results(
$wpdb->prepare(
"SELECT post_id, meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_wp_page_template' AND meta_value IN (" . substr( str_repeat( ',%s', count( $template_map_keys ) ), 1 ) . ")", // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
esc_sql( $template_map_keys )
)
);

if ( $verbose ) {
error_log( __FUNCTION__ . ' - Posts to migrate: ' . count( $results ) );
Expand All @@ -145,12 +148,7 @@ function responsive_upgrade_091( $verbose = true ) {
)
);

$banner_query = sprintf(
'SELECT post_id, meta_value FROM %s WHERE meta_key = "_bu_banner"',
$wpdb->postmeta
);

$results = $wpdb->get_results( $banner_query );
$results = $wpdb->get_results( 'SELECT post_id, meta_value FROM $wpdb->postmeta WHERE meta_key = "_bu_banner"' );
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@philcable The Unit tests are failing. It appears to be around this line and because the unit tests.

739FWordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '->postmeta WHERE meta_key = "_bu_banner"' at line 1 for query SELECT post_id, meta_value FROM $wpdb->postmeta WHERE meta_key = "_bu_banner" made by PHPUnit_TextUI_Command::main, PHPUnit_TextUI_Command->run, PHPUnit_TextUI_TestRunner->doRun, PHPUnit_Framework_TestSuite->run, PHPUnit_Framework_TestSuite->run, PHPUnit_Framework_TestCase->run, PHPUnit_Framework_TestResult->run, PHPUnit_Framework_TestCase->runBare, PHPUnit_Framework_TestCase->runTest, ReflectionMethod->invokeArgs, Tests_Responsive_Framework_Upgrades->test_responsive_upgrade_091, responsive_upgrade_091
740FFFFFF...         118 / 118 (100%)```

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stonybrookweb @philcable Oops, thanks for catching that!

I just addressed this in 95ddd4a by using " around the queries with interpolated $wpdb data. I'll do a quick check across the other projects to make sure that didn't pop up elsewhere.

8ddb4e5 then removes a piece from the unit tests that was ignoring incorrect use of $wpdb->prepare() and the tests are passing.

I left the conflict with the changelog as is for now.


foreach ( $results as $result ) {
$banner = maybe_unserialize( $result->meta_value );
Expand Down Expand Up @@ -216,12 +214,16 @@ function responsive_upgrade_2_0( $verbose = true ) {
)
);

$template_query = sprintf(
'SELECT post_id, meta_value FROM %s WHERE meta_key = "_wp_page_template" AND meta_value IN ("%s")',
$wpdb->postmeta,
implode( '","', array_keys( $template_map ) )
// Extract array keys for reuse when generating the query.
$template_map_keys = array_keys( $template_map );

// Prepare the query by adding a %s placeholder for each key of the passed array.
$results = $wpdb->get_results(
$wpdb->prepare(
"SELECT post_id, meta_value FROM $wpdb->postmeta WHERE meta_key = '_wp_page_template' AND meta_value IN (" . substr( str_repeat( ',%s', count( $template_map_keys ) ), 1 ) . ")", // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
$template_map_keys
)
);
$results = $wpdb->get_results( $template_query );

if ( $verbose ) {
error_log( __FUNCTION__ . ' - Posts to migrate: ' . count( $results ) );
Expand Down Expand Up @@ -271,12 +273,7 @@ function responsive_upgrade_banner( $verbose ) {
)
);

$results = $wpdb->get_results(
$wpdb->prepare(
"SELECT post_id, meta_value FROM $wpdb->postmeta WHERE meta_key = '_bu_banner'",
$wpdb->postmeta
)
);
$results = $wpdb->get_results( "SELECT post_id, meta_value FROM $wpdb->postmeta WHERE meta_key = '_bu_banner'" );

foreach ( $results as $result ) {
$banner = maybe_unserialize( $result->meta_value );
Expand Down
Loading