R3ap3r/aurora-wordpress-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Snapshot synced v3.6.1 working state as baseline

Browse Source 
Machine-sync snapshot: the working tree carried the full 3.0.0-3.6.1 arc
(licensing/FileManager/DatabaseExplorer removal, all new replacement screens
and REST controllers) that had not been committed on this machine. Captured
here as a safety baseline before starting the Adminify-parity revamp.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
NixReaper
2026-07-12 08:41:18 -05:00
co-authored by Claude Opus 4.8
parent 07d77bda57
commit e2db2ad4b5
88 changed files with 8944 additions and 2730 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/src/MenuCreator/MenuCreatorData.php
+11 -9
View File
@@ -104,11 +104,10 @@ class MenuCreatorData
$status = $request->get_param("status");
if ($status) {
$rows = $wpdb->get_results($wpdb->prepare(
"SELECT * FROM {$table} WHERE status = %s ORDER BY updated_at DESC",
$status
));
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- {$table} is an internal, hardcoded {$wpdb->prefix}-based table name, not user input; $status is bound via the $wpdb->prepare() %s placeholder.
$rows = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$table} WHERE status = %s ORDER BY updated_at DESC", $status));
} else {
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- {$table} is an internal, hardcoded {$wpdb->prefix}-based table name, not user input; no user-supplied values in this query.
$rows = $wpdb->get_results("SELECT * FROM {$table} ORDER BY updated_at DESC");
}
@@ -118,10 +117,8 @@ class MenuCreatorData
public static function get_one($request)
{
global $wpdb;
$row = $wpdb->get_row($wpdb->prepare(
"SELECT * FROM " . MenuCreator::table_name() . " WHERE id = %d",
(int) $request->get_param("id")
));
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- table name from an internal, hardcoded {$wpdb->prefix}-based constant, not user input; the %d value is passed through $wpdb->prepare() below.
$row = $wpdb->get_row($wpdb->prepare("SELECT * FROM " . MenuCreator::table_name() . " WHERE id = %d", (int) $request->get_param("id")));
if (!$row) {
return new \WP_Error("not_found", "Menu not found", ["status" => 404]);
}
@@ -133,6 +130,7 @@ class MenuCreatorData
global $wpdb;
$now = current_time("mysql");
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- $wpdb->insert() is WordPress's own escaping-safe API for writing to Aurora's custom menu-configs table.
$wpdb->insert(MenuCreator::table_name(), [
"name" => sanitize_text_field($request->get_param("name")),
"status" => self::sanitize_status($request->get_param("status")),
@@ -142,7 +140,9 @@ class MenuCreatorData
"updated_at" => $now,
]);
return self::get_one(new \WP_REST_Request("GET", "", ["id" => $wpdb->insert_id]));
$get_request = new \WP_REST_Request("GET");
$get_request->set_url_params(["id" => $wpdb->insert_id]);
return self::get_one($get_request);
}
public static function update($request)
@@ -164,6 +164,7 @@ class MenuCreatorData
$fields["items"] = wp_json_encode(self::sanitize_items($request->get_param("items")));
}
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- $wpdb->update() is WordPress's own escaping-safe API for writing to Aurora's custom menu-configs table.
$wpdb->update(MenuCreator::table_name(), $fields, ["id" => $id]);
return self::get_one($request);
@@ -172,6 +173,7 @@ class MenuCreatorData
public static function delete($request)
{
global $wpdb;
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- $wpdb->delete() is WordPress's own escaping-safe API for writing to Aurora's custom menu-configs table.
$wpdb->delete(MenuCreator::table_name(), ["id" => (int) $request->get_param("id")]);
return new \WP_REST_Response(["deleted" => true], 200);
}