Skip to content

Commit c9a608c

Browse files
donnapepdonnapep
authored
Merge pull request #7739 from Automattic/release/4.24.5
Release 4.24.5
2 parents cd43d10 + 6baabda commit c9a608c

30 files changed

+701
-471
lines changed

‎changelog.txt

+28
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,33 @@
11
*** Changelog ***
22

3+
## 4.24.5 - 2025-01-16
4+
### Security
5+
- Fix unprepared SQL
6+
- Remove feed content if the user doesn't have access to the lesson
7+
8+
### Added
9+
- Wrap question numbers in `<span>` tags [#7738](https://github.com/Automattic/sensei/pull/7738)
10+
11+
### Changed
12+
- Replace `date` with `gmdate` [#7735](https://github.com/Automattic/sensei/pull/7735)
13+
- Replace `unlink` with `wp_delete_file` [#7732](https://github.com/Automattic/sensei/pull/7732)
14+
- Replace `wp_json_encode` with `json_encode` [#7730](https://github.com/Automattic/sensei/pull/7730)
15+
- Update the placeholder to use an internal image [#7728](https://github.com/Automattic/sensei/pull/7728)
16+
- Replace `strip_tags` with `wp_strip_all_tags` [#7731](https://github.com/Automattic/sensei/pull/7731)
17+
18+
### Deprecated
19+
- Deprecate `load_localisation` and `load_plugin_textdomain` functions [#7713](https://github.com/Automattic/sensei/pull/7713)
20+
21+
### Removed
22+
- Remove manual loading of translations [#7713](https://github.com/Automattic/sensei/pull/7713)
23+
- Remove fallback code for Sensei Pro update reminder [#7729](https://github.com/Automattic/sensei/pull/7729)
24+
- Remove files that are already included in WordPress Core [#7727](https://github.com/Automattic/sensei/pull/7727)
25+
- Remove obsolete code from Students area [#7726](https://github.com/Automattic/sensei/pull/7726)
26+
27+
### Fixed
28+
- Initialize Sensei blocks for posts [#7736](https://github.com/Automattic/sensei/pull/7736)
29+
- Remove usage of deprecated parameters in WordPress Core functions [#7724](https://github.com/Automattic/sensei/pull/7724)
30+
331
## 4.24.4 - 2024-11-12
432
### Security
533
- Messages and emails accessible using the search REST API

‎changelog/deprecate-ptranslation-load-functions

-4
This file was deleted.

‎changelog/fix-no-sensei-blocks-for-posts

-4
This file was deleted.

‎changelog/fix-use-wp-strip-all-tags

-4
This file was deleted.

‎changelog/fix-wordpress-core-deprecations

-4
This file was deleted.

‎changelog/remove-loading-translations-code

-4
This file was deleted.

‎changelog/remove-obsolete-javascript

-4
This file was deleted.

‎changelog/remove-obsolete-learner-management-code

-4
This file was deleted.

‎changelog/remove-plugin-updater-code

-4
This file was deleted.

‎changelog/update-json_encode-to-wp_json_encode

-4
This file was deleted.

‎changelog/update-placeholder-image

-4
This file was deleted.

‎changelog/update-replace-date-with-gmdate

-4
This file was deleted.

‎changelog/update-replace-unlink-with-wp_delete_file

-4
This file was deleted.

‎changelog/update-wrap-question-title-in-span

-4
This file was deleted.

‎config/psalm/psalm-baseline.xml

+8-15
Original file line numberDiff line numberDiff line change
@@ -107,10 +107,9 @@
107107
<DocblockTypeContradiction occurrences="1">
108108
<code>false === $mysql_date</code>
109109
</DocblockTypeContradiction>
110-
<InvalidScalarArgument occurrences="5">
110+
<InvalidScalarArgument occurrences="4">
111111
<code>$_POST['data']['comment_id']</code>
112112
<code>$_POST['data']['post_id']</code>
113-
<code>$lesson_id</code>
114113
<code>wp_unslash( $_GET['course_id'] ?? 0 )</code>
115114
<code>wp_unslash( $_GET['lesson_id'] ?? 0 )</code>
116115
</InvalidScalarArgument>
@@ -530,12 +529,6 @@
530529
<code>! self::$instance</code>
531530
<code>self::$instance</code>
532531
</DocblockTypeContradiction>
533-
<InvalidArgument occurrences="1">
534-
<code>true</code>
535-
</InvalidArgument>
536-
<MissingClosureParamType occurrences="1">
537-
<code>$attributes</code>
538-
</MissingClosureParamType>
539532
<UnresolvableInclude occurrences="1">
540533
<code>require __DIR__ . "/{$post_type}/{$block_pattern}.php"</code>
541534
</UnresolvableInclude>
@@ -903,13 +896,12 @@
903896
<code>$course-&gt;ID</code>
904897
<code>$post-&gt;ID</code>
905898
</PossiblyInvalidPropertyFetch>
906-
<PossiblyNullArgument occurrences="6">
899+
<PossiblyNullArgument occurrences="5">
907900
<code>$course_structure</code>
908901
<code>$event_name</code>
909902
<code>$post_id</code>
910903
<code>$post_id</code>
911904
<code>$post_type-&gt;cap-&gt;edit_posts</code>
912-
<code>$screen</code>
913905
</PossiblyNullArgument>
914906
<PossiblyNullPropertyFetch occurrences="3">
915907
<code>$post_type-&gt;cap</code>
@@ -1736,10 +1728,6 @@
17361728
<PossiblyFalseArgument occurrences="1">
17371729
<code>wp_json_encode( $args )</code>
17381730
</PossiblyFalseArgument>
1739-
<PossiblyInvalidCast occurrences="2">
1740-
<code>$clean_lesson_id</code>
1741-
<code>$clean_user_id</code>
1742-
</PossiblyInvalidCast>
17431731
<PossiblyNullArgument occurrences="3">
17441732
<code>get_post_type_object( 'course' )-&gt;cap-&gt;edit_post</code>
17451733
<code>get_post_type_object( 'lesson' )-&gt;cap-&gt;edit_post</code>
@@ -2866,6 +2854,10 @@
28662854
<DocblockTypeContradiction occurrences="1">
28672855
<code>0</code>
28682856
</DocblockTypeContradiction>
2857+
<DuplicateArrayKey occurrences="2">
2858+
<code>$published_quiz_ids</code>
2859+
<code>$published_quiz_ids</code>
2860+
</DuplicateArrayKey>
28692861
<InvalidArgument occurrences="11">
28702862
<code>$key</code>
28712863
<code>$published_quiz_ids</code>
@@ -3126,7 +3118,8 @@
31263118
<MissingPropertyType occurrences="1">
31273119
<code>$this-&gt;post_types-&gt;role_caps</code>
31283120
</MissingPropertyType>
3129-
<PossiblyFalseArgument occurrences="2">
3121+
<PossiblyFalseArgument occurrences="3">
3122+
<code>get_the_ID()</code>
31303123
<code>get_the_ID()</code>
31313124
<code>get_the_ID()</code>
31323125
</PossiblyFalseArgument>

‎includes/admin/class-sensei-learner-management.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ public function __construct( $file ) {
106106
*/
107107
public function __get( $key ) {
108108
if ( 'name' === $key ) {
109-
_doing_it_wrong( __CLASS__ . '->name', 'The "name" property is deprecated. Use get_name() instead.', '$$next-version$$' );
109+
_doing_it_wrong( __CLASS__ . '->name', 'The "name" property is deprecated. Use get_name() instead.', '4.24.5' );
110110

111111
return $this->get_name();
112112
}

‎includes/class-sensei-analysis.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public function __get( $key ) {
6868
}
6969

7070
if ( 'name' === $key ) {
71-
_doing_it_wrong( __CLASS__ . '->name', 'The "name" property is deprecated. Use get_name() instead.', '$$next-version$$' );
71+
_doing_it_wrong( __CLASS__ . '->name', 'The "name" property is deprecated. Use get_name() instead.', '4.24.5' );
7272

7373
return $this->get_name();
7474
}

‎includes/class-sensei-grading.php

+52-55
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ public function __construct( $file ) {
6060
*/
6161
public function __get( $key ) {
6262
if ( 'name' === $key ) {
63-
_doing_it_wrong( __CLASS__ . '->name', 'The "name" property is deprecated. Use get_name() instead.', '$$next-version$$' );
63+
_doing_it_wrong( __CLASS__ . '->name', 'The "name" property is deprecated. Use get_name() instead.', '4.24.5' );
6464

6565
return $this->get_name();
6666
}
@@ -567,17 +567,21 @@ public function count_statuses( $args = array() ) {
567567

568568
$cache_key = 'sensei-statuses-' . md5( wp_json_encode( $args ) );
569569

570-
$query = "SELECT comment_approved, COUNT( * ) AS total FROM {$wpdb->comments} WHERE comment_type = %s ";
570+
$query = $wpdb->prepare( "SELECT comment_approved, COUNT( * ) AS total FROM {$wpdb->comments} WHERE comment_type = %s ", $type );
571571

572572
// Restrict to specific posts.
573573
if ( isset( $args['post__in'] ) && ! empty( $args['post__in'] ) && is_array( $args['post__in'] ) ) {
574-
$query .= ' AND comment_post_ID IN (' . implode( ',', array_map( 'absint', $args['post__in'] ) ) . ')';
574+
$post__in_placeholder = implode( ', ', array_fill( 0, count( $args['post__in'] ), '%d' ) );
575+
// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- Placeholders created dynamically.
576+
$query .= $wpdb->prepare( " AND comment_post_ID IN ( $post__in_placeholder )", $args['post__in'] );
575577
} elseif ( ! empty( $args['post_id'] ) ) {
576578
$query .= $wpdb->prepare( ' AND comment_post_ID = %d', $args['post_id'] );
577579
}
578580
// Restrict to specific users.
579581
if ( isset( $args['user_id'] ) && is_array( $args['user_id'] ) ) {
580-
$query .= ' AND user_id IN (' . implode( ',', array_map( 'absint', $args['user_id'] ) ) . ')';
582+
$user_id_placeholder = implode( ', ', array_fill( 0, count( $args['user_id'] ), '%d' ) );
583+
// phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- Placeholders created dynamically.
584+
$query .= $wpdb->prepare( " AND user_id IN ( $user_id_placeholder )", $args['user_id'] );
581585
} elseif ( ! empty( $args['user_id'] ) ) {
582586
$query .= $wpdb->prepare( ' AND user_id = %d', $args['user_id'] );
583587
}
@@ -589,8 +593,8 @@ public function count_statuses( $args = array() ) {
589593

590594
$counts = wp_cache_get( $cache_key, 'counts' );
591595
if ( false === $counts ) {
592-
$sql = $wpdb->prepare( $query, $type );
593-
$results = (array) $wpdb->get_results( $sql, ARRAY_A );
596+
// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- SQL prepared in advance.
597+
$results = (array) $wpdb->get_results( $query, ARRAY_A );
594598
$counts = array_fill_keys( $this->get_stati( $type ), 0 );
595599

596600
foreach ( $results as $row ) {
@@ -1273,16 +1277,13 @@ public static function grade_gap_fill_question( $question_id, $user_answer ) {
12731277
* @return int $number_of_graded_lessons
12741278
*/
12751279
public static function get_graded_lessons_count() {
1276-
12771280
global $wpdb;
12781281

1279-
$comment_query_piece = [];
1280-
$comment_query_piece['select'] = 'SELECT COUNT(*) AS total';
1281-
$comment_query_piece['from'] = " FROM {$wpdb->comments} INNER JOIN {$wpdb->commentmeta} ON ( {$wpdb->comments}.comment_ID = {$wpdb->commentmeta}.comment_id ) ";
1282-
$comment_query_piece['where'] = " WHERE {$wpdb->comments}.comment_type IN ('sensei_lesson_status') AND ( {$wpdb->commentmeta}.meta_key = 'grade')";
1283-
1284-
$comment_query = $comment_query_piece['select'] . $comment_query_piece['from'] . $comment_query_piece['where'];
1285-
$number_of_graded_lessons = intval( $wpdb->get_var( $comment_query, 0, 0 ) );
1282+
$number_of_graded_lessons = (int) $wpdb->get_var(
1283+
"SELECT COUNT(*) AS total
1284+
FROM {$wpdb->comments} INNER JOIN {$wpdb->commentmeta} ON ( {$wpdb->comments}.comment_ID = {$wpdb->commentmeta}.comment_id )
1285+
WHERE {$wpdb->comments}.comment_type IN ('sensei_lesson_status') AND ( {$wpdb->commentmeta}.meta_key = 'grade')"
1286+
);
12861287

12871288
return $number_of_graded_lessons;
12881289
}
@@ -1291,22 +1292,18 @@ public static function get_graded_lessons_count() {
12911292
* Add together all the graded lesson grades
12921293
*
12931294
* @since 1.9.0
1294-
* @return double $sum_of_all_grades
1295+
* @return int $sum_of_all_grades
12951296
*/
12961297
public static function get_graded_lessons_sum() {
1297-
12981298
global $wpdb;
12991299

1300-
$comment_query_piece = [];
1301-
$comment_query_piece['select'] = "SELECT SUM({$wpdb->commentmeta}.meta_value) AS meta_sum";
1302-
$comment_query_piece['from'] = " FROM {$wpdb->comments} INNER JOIN {$wpdb->commentmeta} ON ( {$wpdb->comments}.comment_ID = {$wpdb->commentmeta}.comment_id ) ";
1303-
$comment_query_piece['where'] = " WHERE {$wpdb->comments}.comment_type IN ('sensei_lesson_status') AND ( {$wpdb->commentmeta}.meta_key = 'grade')";
1304-
1305-
$comment_query = $comment_query_piece['select'] . $comment_query_piece['from'] . $comment_query_piece['where'];
1306-
$sum_of_all_grades = intval( $wpdb->get_var( $comment_query, 0, 0 ) );
1300+
$sum_of_all_grades = (int) $wpdb->get_var(
1301+
"SELECT SUM({$wpdb->commentmeta}.meta_value) AS meta_sum
1302+
FROM {$wpdb->comments} INNER JOIN {$wpdb->commentmeta} ON ( {$wpdb->comments}.comment_ID = {$wpdb->commentmeta}.comment_id )
1303+
WHERE {$wpdb->comments}.comment_type IN ('sensei_lesson_status') AND ( {$wpdb->commentmeta}.meta_key = 'grade')"
1304+
);
13071305

13081306
return $sum_of_all_grades;
1309-
13101307
}
13111308

13121309
/**
@@ -1339,19 +1336,19 @@ public function get_graded_lessons_average_grade() {
13391336
*
13401337
* @since 1.9.0
13411338
* @param $user_id
1342-
* @return double
1339+
* @return int
13431340
*/
13441341
public static function get_user_graded_lessons_sum( $user_id ) {
13451342
global $wpdb;
13461343

1347-
$clean_user_id = esc_sql( $user_id );
1348-
$comment_query_piece = [];
1349-
$comment_query_piece['select'] = "SELECT SUM({$wpdb->commentmeta}.meta_value) AS meta_sum";
1350-
$comment_query_piece['from'] = " FROM {$wpdb->comments} INNER JOIN {$wpdb->commentmeta} ON ( {$wpdb->comments}.comment_ID = {$wpdb->commentmeta}.comment_id ) ";
1351-
$comment_query_piece['where'] = " WHERE {$wpdb->comments}.comment_type IN ('sensei_lesson_status') AND ( {$wpdb->commentmeta}.meta_key = 'grade') AND {$wpdb->comments}.user_id = {$clean_user_id} ";
1352-
1353-
$comment_query = $comment_query_piece['select'] . $comment_query_piece['from'] . $comment_query_piece['where'];
1354-
$sum_of_all_grades = intval( $wpdb->get_var( $comment_query, 0, 0 ) );
1344+
$sum_of_all_grades = (int) $wpdb->get_var(
1345+
$wpdb->prepare(
1346+
"SELECT SUM({$wpdb->commentmeta}.meta_value) AS meta_sum
1347+
FROM {$wpdb->comments} INNER JOIN {$wpdb->commentmeta} ON ( {$wpdb->comments}.comment_ID = {$wpdb->commentmeta}.comment_id )
1348+
WHERE {$wpdb->comments}.comment_type IN ('sensei_lesson_status') AND ( {$wpdb->commentmeta}.meta_key = 'grade') AND {$wpdb->comments}.user_id = %d ",
1349+
$user_id
1350+
)
1351+
);
13551352

13561353
return $sum_of_all_grades;
13571354
}
@@ -1362,23 +1359,21 @@ public static function get_user_graded_lessons_sum( $user_id ) {
13621359
* @since 1.9.0
13631360
*
13641361
* @param int lesson_id
1365-
* @return double
1362+
* @return int
13661363
*/
13671364
public static function get_lessons_users_grades_sum( $lesson_id ) {
1368-
13691365
global $wpdb;
13701366

1371-
$clean_lesson_id = esc_sql( $lesson_id );
1372-
$comment_query_piece = [];
1373-
$comment_query_piece['select'] = "SELECT SUM({$wpdb->commentmeta}.meta_value) AS meta_sum";
1374-
$comment_query_piece['from'] = " FROM {$wpdb->comments} INNER JOIN {$wpdb->commentmeta} ON ( {$wpdb->comments}.comment_ID = {$wpdb->commentmeta}.comment_id ) ";
1375-
$comment_query_piece['where'] = " WHERE {$wpdb->comments}.comment_type IN ('sensei_lesson_status') AND ( {$wpdb->commentmeta}.meta_key = 'grade') AND {$wpdb->comments}.comment_post_ID = {$clean_lesson_id} ";
1376-
1377-
$comment_query = $comment_query_piece['select'] . $comment_query_piece['from'] . $comment_query_piece['where'];
1378-
$sum_of_all_grades = intval( $wpdb->get_var( $comment_query, 0, 0 ) );
1367+
$sum_of_all_grades = (int) $wpdb->get_var(
1368+
$wpdb->prepare(
1369+
"SELECT SUM({$wpdb->commentmeta}.meta_value) AS meta_sum
1370+
FROM {$wpdb->comments} INNER JOIN {$wpdb->commentmeta} ON ( {$wpdb->comments}.comment_ID = {$wpdb->commentmeta}.comment_id )
1371+
WHERE {$wpdb->comments}.comment_type IN ('sensei_lesson_status') AND ( {$wpdb->commentmeta}.meta_key = 'grade') AND {$wpdb->comments}.comment_post_ID = %d ",
1372+
$lesson_id
1373+
)
1374+
);
13791375

13801376
return $sum_of_all_grades;
1381-
13821377
}
13831378

13841379
/**
@@ -1387,29 +1382,31 @@ public static function get_lessons_users_grades_sum( $lesson_id ) {
13871382
* @since 1.9.0
13881383
*
13891384
* @param int $course_id
1390-
* @return double
1385+
* @return int
13911386
*/
13921387
public static function get_course_users_grades_sum( $course_id ) {
13931388
global $wpdb;
13941389

13951390
$lesson_ids = Sensei()->course->course_lessons( $course_id, 'any', 'ids' );
1396-
13971391
if ( ! $lesson_ids ) {
13981392
return 0;
13991393
}
14001394

1401-
$comment_query_piece = [];
1402-
$clean_lesson_ids = implode( ',', esc_sql( $lesson_ids ) );
1403-
$comment_query_piece['select'] = "SELECT SUM({$wpdb->commentmeta}.meta_value) AS meta_sum";
1404-
$comment_query_piece['from'] = " FROM {$wpdb->comments} INNER JOIN {$wpdb->commentmeta} ON ( {$wpdb->comments}.comment_ID = {$wpdb->commentmeta}.comment_id ) ";
1405-
$comment_query_piece['where'] = " WHERE {$wpdb->comments}.comment_type IN ('sensei_lesson_status') AND {$wpdb->comments}.comment_approved IN ('graded', 'passed', 'failed') AND ( {$wpdb->commentmeta}.meta_key = 'grade')
1406-
AND {$wpdb->comments}.comment_post_ID IN ({$clean_lesson_ids}) ";
1395+
$lesson_ids_placeholder = implode( ', ', array_fill( 0, count( $lesson_ids ), '%d' ) );
14071396

1408-
$comment_query = $comment_query_piece['select'] . $comment_query_piece['from'] . $comment_query_piece['where'];
1409-
$sum_of_all_grades = intval( $wpdb->get_var( $comment_query, 0, 0 ) );
1397+
// phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare -- Placeholders created dynamically.
1398+
$sum_of_all_grades = (int) $wpdb->get_var(
1399+
$wpdb->prepare(
1400+
"SELECT SUM({$wpdb->commentmeta}.meta_value) AS meta_sum
1401+
FROM {$wpdb->comments} INNER JOIN {$wpdb->commentmeta} ON ( {$wpdb->comments}.comment_ID = {$wpdb->commentmeta}.comment_id )
1402+
WHERE {$wpdb->comments}.comment_type IN ('sensei_lesson_status') AND {$wpdb->comments}.comment_approved IN ('graded', 'passed', 'failed') AND ( {$wpdb->commentmeta}.meta_key = 'grade')
1403+
AND {$wpdb->comments}.comment_post_ID IN ({$lesson_ids_placeholder}) ",
1404+
$lesson_ids
1405+
)
1406+
);
1407+
// phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared, WordPress.DB.PreparedSQLPlaceholders.UnfinishedPrepare
14101408

14111409
return $sum_of_all_grades;
1412-
14131410
}
14141411

14151412
/**

0 commit comments

Comments
 (0)