• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

Yoast / wordpress-seo / 7254828754

18 Dec 2023 11:00PM UTC coverage: 49.39%. Remained the same
7254828754

push

github

web-flow
Merge pull request #20972 from Yoast/JRF/CS/concat-position

CS: consistently have concat operator at start of line

14 of 80 new or added lines in 11 files covered. (17.5%)

3 existing lines in 3 files now uncovered.

15426 of 31233 relevant lines covered (49.39%)

4.07 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0
/admin/class-bulk-editor-list-table.php
1
<?php
2
/**
3
 * WPSEO plugin file.
4
 *
5
 * @package WPSEO\Admin\Bulk Editor
6
 * @since   1.5.0
7
 */
8

9
/**
10
 * Implements table for bulk editing.
11
 */
12
class WPSEO_Bulk_List_Table extends WP_List_Table {
13

14
        /**
15
         * The nonce that was passed with the request.
16
         *
17
         * @var string
18
         */
19
        private $nonce;
20

21
        /**
22
         * Array of post types for which the current user has `edit_others_posts` capabilities.
23
         *
24
         * @var array
25
         */
26
        private $all_posts;
27

28
        /**
29
         * Array of post types for which the current user has `edit_posts` capabilities, but not `edit_others_posts`.
30
         *
31
         * @var array
32
         */
33
        private $own_posts;
34

35
        /**
36
         * Saves all the metadata into this array.
37
         *
38
         * @var array
39
         */
40
        protected $meta_data = [];
41

42
        /**
43
         * The current requested page_url.
44
         *
45
         * @var string
46
         */
47
        private $request_url = '';
48

49
        /**
50
         * The current page (depending on $_GET['paged']) if current tab is for current page_type, else it will be 1.
51
         *
52
         * @var int
53
         */
54
        private $current_page;
55

56
        /**
57
         * The current post filter, if is used (depending on $_GET['post_type_filter']).
58
         *
59
         * @var string
60
         */
61
        private $current_filter;
62

63
        /**
64
         * The current post status, if is used (depending on $_GET['post_status']).
65
         *
66
         * @var string
67
         */
68
        private $current_status;
69

70
        /**
71
         * The current sorting, if used (depending on $_GET['order'] and $_GET['orderby']).
72
         *
73
         * @var string
74
         */
75
        private $current_order;
76

77
        /**
78
         * The page_type for current class instance (for example: title / description).
79
         *
80
         * @var string
81
         */
82
        protected $page_type;
83

84
        /**
85
         * Based on the page_type ($this->page_type) there will be constructed an url part, for subpages and
86
         * navigation.
87
         *
88
         * @var string
89
         */
90
        protected $page_url;
91

92
        /**
93
         * The settings which will be used in the __construct.
94
         *
95
         * @var array
96
         */
97
        protected $settings;
98

99
        /**
100
         * Holds the pagination config.
101
         *
102
         * @var array
103
         */
104
        protected $pagination = [];
105

106
        /**
107
         * Holds the sanitized data from the user input.
108
         *
109
         * @var array
110
         */
111
        protected $input_fields = [];
112

113
        /**
114
         * Class constructor.
115
         *
116
         * @param array $args The arguments.
117
         */
118
        public function __construct( $args = [] ) {
×
119
                parent::__construct( $this->settings );
×
120

121
                $args = wp_parse_args(
×
122
                        $args,
×
123
                        [
×
124
                                'nonce'        => '',
×
125
                                'input_fields' => [],
×
126
                        ]
×
127
                );
×
128

129
                $this->input_fields = $args['input_fields'];
×
130
                if ( isset( $_SERVER['REQUEST_URI'] ) ) {
×
131
                        $this->request_url = sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) );
×
132
                }
133

134
                $this->current_page   = ( ! empty( $this->input_fields['paged'] ) ) ? $this->input_fields['paged'] : 1;
×
135
                $this->current_filter = ( ! empty( $this->input_fields['post_type_filter'] ) ) ? $this->input_fields['post_type_filter'] : 1;
×
136
                $this->current_status = ( ! empty( $this->input_fields['post_status'] ) ) ? $this->input_fields['post_status'] : 1;
×
137
                $this->current_order  = [
×
138
                        'order'   => ( ! empty( $this->input_fields['order'] ) ) ? $this->input_fields['order'] : 'asc',
×
139
                        'orderby' => ( ! empty( $this->input_fields['orderby'] ) ) ? $this->input_fields['orderby'] : 'post_title',
×
140
                ];
×
141

142
                $this->nonce    = $args['nonce'];
×
143
                $this->page_url = "&nonce={$this->nonce}&type={$this->page_type}#top#{$this->page_type}";
×
144

145
                $this->populate_editable_post_types();
×
146
        }
147

148
        /**
149
         * Prepares the data and renders the page.
150
         */
151
        public function show_page() {
×
152
                $this->prepare_page_navigation();
×
153
                $this->prepare_items();
×
154

155
                $this->views();
×
156
                $this->display();
×
157
        }
158

159
        /**
160
         * Used in the constructor to build a reference list of post types the current user can edit.
161
         */
162
        protected function populate_editable_post_types() {
×
163
                $post_types = get_post_types(
×
164
                        [
×
165
                                'public'              => true,
×
166
                                'exclude_from_search' => false,
×
167
                        ],
×
168
                        'object'
×
169
                );
×
170

171
                $this->all_posts = [];
×
172
                $this->own_posts = [];
×
173

174
                if ( is_array( $post_types ) && $post_types !== [] ) {
×
175
                        foreach ( $post_types as $post_type ) {
×
176
                                if ( ! current_user_can( $post_type->cap->edit_posts ) ) {
×
177
                                        continue;
×
178
                                }
179

180
                                if ( current_user_can( $post_type->cap->edit_others_posts ) ) {
×
181
                                        $this->all_posts[] = esc_sql( $post_type->name );
×
182
                                }
183
                                else {
184
                                        $this->own_posts[] = esc_sql( $post_type->name );
×
185
                                }
186
                        }
187
                }
188
        }
189

190
        /**
191
         * Will show the navigation for the table like page navigation and page filter.
192
         *
193
         * @param string $which Table nav location (such as top).
194
         */
195
        public function display_tablenav( $which ) {
×
196
                // phpcs:disable WordPress.Security.NonceVerification.Recommended -- Reason: We are not processing form information.
197
                $post_status      = isset( $_GET['post_status'] ) && is_string( $_GET['post_status'] ) ? sanitize_text_field( wp_unslash( $_GET['post_status'] ) ) : '';
×
198
                $order_by         = isset( $_GET['orderby'] ) && is_string( $_GET['orderby'] ) ? sanitize_text_field( wp_unslash( $_GET['orderby'] ) ) : '';
×
199
                $order            = isset( $_GET['order'] ) && is_string( $_GET['order'] ) ? sanitize_text_field( wp_unslash( $_GET['order'] ) ) : '';
×
200
                $post_type_filter = isset( $_GET['post_type_filter'] ) && is_string( $_GET['post_type_filter'] ) ? sanitize_text_field( wp_unslash( $_GET['post_type_filter'] ) ) : '';
×
201
                // phpcs:enable WordPress.Security.NonceVerification.Recommended;
202
                ?>
203
                <div class="tablenav <?php echo esc_attr( $which ); ?>">
204

205
                        <?php if ( $which === 'top' ) { ?>
206
                        <form id="posts-filter" action="" method="get">
×
207
                                <input type="hidden" name="nonce" value="<?php echo esc_attr( $this->nonce ); ?>"/>
208
                                <input type="hidden" name="page" value="wpseo_tools"/>
209
                                <input type="hidden" name="tool" value="bulk-editor"/>
210
                                <input type="hidden" name="type" value="<?php echo esc_attr( $this->page_type ); ?>"/>
211
                                <input type="hidden" name="orderby"
212
                                        value="<?php echo esc_attr( $order_by ); ?>"/>
213
                                <input type="hidden" name="order"
214
                                        value="<?php echo esc_attr( $order ); ?>"/>
215
                                <input type="hidden" name="post_type_filter"
216
                                        value="<?php echo esc_attr( $post_type_filter ); ?>"/>
217
                                <?php if ( ! empty( $post_status ) ) { ?>
218
                                        <input type="hidden" name="post_status" value="<?php echo esc_attr( $post_status ); ?>"/>
219
                                <?php } ?>
220
                                <?php } ?>
221

222
                                <?php
223
                                $this->extra_tablenav( $which );
×
224
                                $this->pagination( $which );
×
225
                                ?>
226

227
                                <br class="clear"/>
×
228
                                <?php if ( $which === 'top' ) { ?>
229
                        </form>
×
230
                <?php } ?>
231
                </div>
×
232

233
                <?php
234
        }
235

236
        /**
237
         * This function builds the base sql subquery used in this class.
238
         *
239
         * This function takes into account the post types in which the current user can
240
         * edit all posts, and the ones the current user can only edit his/her own.
241
         *
242
         * @return string The subquery, which should always be used in $wpdb->prepare(),
243
         *                passing the current user_id in as the first parameter.
244
         */
245
        public function get_base_subquery() {
×
246
                global $wpdb;
×
247

248
                $all_posts_string = "'" . implode( "', '", $this->all_posts ) . "'";
×
249
                $own_posts_string = "'" . implode( "', '", $this->own_posts ) . "'";
×
250

251
                $post_author = esc_sql( (int) get_current_user_id() );
×
252

253
                $subquery = "(
×
254
                                SELECT *
255
                                FROM {$wpdb->posts}
×
256
                                WHERE post_type IN ({$all_posts_string})
×
257
                                UNION ALL
258
                                SELECT *
259
                                FROM {$wpdb->posts}
×
260
                                WHERE post_type IN ({$own_posts_string}) AND post_author = {$post_author}
×
261
                        ) sub_base";
×
262

263
                return $subquery;
×
264
        }
265

266
        /**
267
         * Gets the views.
268
         *
269
         * @return array The views.
270
         */
271
        public function get_views() {
×
272
                global $wpdb;
×
273

274
                $status_links = [];
×
275

276
                $states   = get_post_stati( [ 'show_in_admin_all_list' => true ] );
×
277
                $subquery = $this->get_base_subquery();
×
278

279
                $total_posts = $wpdb->get_var(
×
280
                        $wpdb->prepare(
×
281
                                "SELECT COUNT(ID) FROM {$subquery}
×
NEW
282
                                        WHERE post_status IN ("
×
NEW
283
                                                . implode( ', ', array_fill( 0, count( $states ), '%s' ) )
×
NEW
284
                                        . ')',
×
285
                                $states
×
286
                        )
×
287
                );
×
288

289
                $post_status             = isset( $_GET['post_status'] ) && is_string( $_GET['post_status'] ) ? sanitize_text_field( wp_unslash( $_GET['post_status'] ) ) : '';
×
290
                $current_link_attributes = empty( $post_status ) ? ' class="current" aria-current="page"' : '';
×
291
                $localized_text          = sprintf(
×
292
                        /* translators: %s expands to the number of posts in localized format. */
293
                        _nx( 'All <span class="count">(%s)</span>', 'All <span class="count">(%s)</span>', $total_posts, 'posts', 'wordpress-seo' ),
×
294
                        number_format_i18n( $total_posts )
×
295
                );
×
296

297
                $status_links['all'] = '<a href="' . esc_url( admin_url( 'admin.php?page=wpseo_tools&tool=bulk-editor' . $this->page_url ) ) . '"' . $current_link_attributes . '>' . $localized_text . '</a>';
×
298

299
                $post_stati = get_post_stati( [ 'show_in_admin_all_list' => true ], 'objects' );
×
300
                if ( is_array( $post_stati ) && $post_stati !== [] ) {
×
301
                        foreach ( $post_stati as $status ) {
×
302

303
                                $status_name = esc_sql( $status->name );
×
304

305
                                $total = (int) $wpdb->get_var(
×
306
                                        $wpdb->prepare(
×
307
                                                "
×
308
                                                                SELECT COUNT(ID) FROM {$subquery}
×
309
                                                                WHERE post_status = %s
310
                                                        ",
×
311
                                                $status_name
×
312
                                        )
×
313
                                );
×
314

315
                                if ( $total === 0 ) {
×
316
                                        continue;
×
317
                                }
318

319
                                $current_link_attributes = '';
×
320
                                if ( $status_name === $post_status ) {
×
321
                                        $current_link_attributes = ' class="current" aria-current="page"';
×
322
                                }
323

324
                                $status_links[ $status_name ] = '<a href="' . esc_url( add_query_arg( [ 'post_status' => $status_name ], admin_url( 'admin.php?page=wpseo_tools&tool=bulk-editor' . $this->page_url ) ) ) . '"' . $current_link_attributes . '>' . sprintf( translate_nooped_plural( $status->label_count, $total ), number_format_i18n( $total ) ) . '</a>';
×
325
                        }
326
                }
327
                unset( $post_stati, $status, $status_name, $total, $current_link_attributes );
×
328

329
                $trashed_posts = $wpdb->get_var(
×
330
                        "SELECT COUNT(ID) FROM {$subquery}
×
331
                                WHERE post_status IN ('trash')
332
                        "
×
333
                );
×
334

335
                $current_link_attributes = '';
×
336
                if ( $post_status === 'trash' ) {
×
337
                        $current_link_attributes = 'class="current" aria-current="page"';
×
338
                }
339

340
                $localized_text = sprintf(
×
341
                        /* translators: %s expands to the number of trashed posts in localized format. */
342
                        _nx( 'Trash <span class="count">(%s)</span>', 'Trash <span class="count">(%s)</span>', $trashed_posts, 'posts', 'wordpress-seo' ),
×
343
                        number_format_i18n( $trashed_posts )
×
344
                );
×
345

346
                $status_links['trash'] = '<a href="' . esc_url( admin_url( 'admin.php?page=wpseo_tools&tool=bulk-editor&post_status=trash' . $this->page_url ) ) . '"' . $current_link_attributes . '>' . $localized_text . '</a>';
×
347

348
                return $status_links;
×
349
        }
350

351
        /**
352
         * Outputs extra table navigation.
353
         *
354
         * @param string $which Table nav location (such as top).
355
         */
356
        public function extra_tablenav( $which ) {
×
357

358
                if ( $which === 'top' ) {
×
359
                        $post_types = get_post_types(
×
360
                                [
×
361
                                        'public'              => true,
×
362
                                        'exclude_from_search' => false,
×
363
                                ]
×
364
                        );
×
365

366
                        $instance_type = esc_attr( $this->page_type );
×
367

368
                        if ( is_array( $post_types ) && $post_types !== [] ) {
×
369
                                global $wpdb;
×
370

371
                                echo '<div class="alignleft actions">';
×
372

373
                                $post_types = esc_sql( $post_types );
×
374
                                $post_types = "'" . implode( "', '", $post_types ) . "'";
×
375

376
                                $states          = get_post_stati( [ 'show_in_admin_all_list' => true ] );
×
377
                                $states['trash'] = 'trash';
×
378

379
                                $subquery = $this->get_base_subquery();
×
380

381
                                $post_types = $wpdb->get_results(
×
382
                                        $wpdb->prepare(
×
383
                                                "SELECT DISTINCT post_type FROM {$subquery}
×
NEW
384
                                                        WHERE post_status IN ("
×
NEW
385
                                                                . implode( ', ', array_fill( 0, count( $states ), '%s' ) )
×
NEW
386
                                                        . ') ORDER BY post_type ASC',
×
387
                                                $states
×
388
                                        )
×
389
                                );
×
390

391
                                $post_type_filter = isset( $_GET['post_type_filter'] ) && is_string( $_GET['post_type_filter'] ) ? sanitize_text_field( wp_unslash( $_GET['post_type_filter'] ) ) : '';
×
392
                                $selected         = ( ! empty( $post_type_filter ) ) ? $post_type_filter : '-1';
×
393

394
                                $options = '<option value="-1">' . esc_html__( 'Show All Content Types', 'wordpress-seo' ) . '</option>';
×
395

396
                                if ( is_array( $post_types ) && $post_types !== [] ) {
×
397
                                        foreach ( $post_types as $post_type ) {
×
398
                                                $obj      = get_post_type_object( $post_type->post_type );
×
399
                                                $options .= sprintf(
×
400
                                                        '<option value="%2$s" %3$s>%1$s</option>',
×
401
                                                        esc_html( $obj->labels->name ),
×
402
                                                        esc_attr( $post_type->post_type ),
×
403
                                                        selected( $selected, $post_type->post_type, false )
×
404
                                                );
×
405
                                        }
406
                                }
407

408
                                printf(
×
409
                                        '<label for="%1$s" class="screen-reader-text">%2$s</label>',
×
410
                                        esc_attr( 'post-type-filter-' . $instance_type ),
×
411
                                        /* translators: Hidden accessibility text. */
412
                                        esc_html__( 'Filter by content type', 'wordpress-seo' )
×
413
                                );
×
414
                                printf(
×
415
                                        '<select name="post_type_filter" id="%2$s">%1$s</select>',
×
416
                                        // phpcs:ignore WordPress.Security.EscapeOutput -- Reason: $options is properly escaped above.
417
                                        $options,
×
418
                                        esc_attr( 'post-type-filter-' . $instance_type )
×
419
                                );
×
420

421
                                submit_button( esc_html__( 'Filter', 'wordpress-seo' ), 'button', false, false, [ 'id' => 'post-query-submit' ] );
×
422
                                echo '</div>';
×
423
                        }
424
                }
425
        }
426

427
        /**
428
         * Gets a list of sortable columns.
429
         *
430
         * The format is: 'internal-name' => array( 'orderby', bool ).
431
         *
432
         * @return array
433
         */
434
        public function get_sortable_columns() {
×
435
                return [
×
436
                        'col_page_title' => [ 'post_title', true ],
×
437
                        'col_post_type'  => [ 'post_type', false ],
×
438
                        'col_post_date'  => [ 'post_date', false ],
×
439
                ];
×
440
        }
441

442
        /**
443
         * Sets the correct pagenumber and pageurl for the navigation.
444
         */
445
        public function prepare_page_navigation() {
×
446

447
                $request_url = $this->request_url . $this->page_url;
×
448

449
                $current_page   = $this->current_page;
×
450
                $current_filter = $this->current_filter;
×
451
                $current_status = $this->current_status;
×
452
                $current_order  = $this->current_order;
×
453

454
                /*
455
                 * If current type doesn't compare with objects page_type, then we have to unset
456
                 * some vars in the requested url (which will be used for internal table urls).
457
                 */
458
                if ( isset( $this->input_fields['type'] ) && $this->input_fields['type'] !== $this->page_type ) {
×
459
                        $request_url = remove_query_arg( 'paged', $request_url ); // Page will be set with value 1 below.
×
460
                        $request_url = remove_query_arg( 'post_type_filter', $request_url );
×
461
                        $request_url = remove_query_arg( 'post_status', $request_url );
×
462
                        $request_url = remove_query_arg( 'orderby', $request_url );
×
463
                        $request_url = remove_query_arg( 'order', $request_url );
×
464
                        $request_url = add_query_arg( 'pages', 1, $request_url );
×
465

466
                        $current_page   = 1;
×
467
                        $current_filter = '-1';
×
468
                        $current_status = '';
×
469
                        $current_order  = [
×
470
                                'orderby' => 'post_title',
×
471
                                'order'   => 'asc',
×
472
                        ];
×
473
                }
474

475
                $_SERVER['REQUEST_URI'] = $request_url;
×
476

477
                $_GET['paged']                = $current_page;
×
478
                $_REQUEST['paged']            = $current_page;
×
479
                $_REQUEST['post_type_filter'] = $current_filter;
×
480
                $_GET['post_type_filter']     = $current_filter;
×
481
                $_GET['post_status']          = $current_status;
×
482
                $_GET['orderby']              = $current_order['orderby'];
×
483
                $_GET['order']                = $current_order['order'];
×
484
        }
485

486
        /**
487
         * Preparing the requested pagerows and setting the needed variables.
488
         */
489
        public function prepare_items() {
×
490

491
                $post_type_clause = $this->get_post_type_clause();
×
492
                $all_states       = $this->get_all_states();
×
493
                $subquery         = $this->get_base_subquery();
×
494

495
                // Setting the column headers.
496
                $this->set_column_headers();
×
497

498
                // Count the total number of needed items and setting pagination given $total_items.
499
                $total_items = $this->count_items( $subquery, $all_states, $post_type_clause );
×
500
                $this->set_pagination( $total_items );
×
501

502
                // Getting items given $query.
503
                $query = $this->parse_item_query( $subquery, $all_states, $post_type_clause );
×
504
                $this->get_items( $query );
×
505

506
                // Get the metadata for the current items ($this->items).
507
                $this->get_meta_data();
×
508
        }
509

510
        /**
511
         * Getting the columns for first row.
512
         *
513
         * @return array
514
         */
515
        public function get_columns() {
×
516
                return $this->merge_columns();
×
517
        }
518

519
        /**
520
         * Setting the column headers.
521
         */
522
        protected function set_column_headers() {
×
523
                $columns               = $this->get_columns();
×
524
                $hidden                = [];
×
525
                $sortable              = $this->get_sortable_columns();
×
526
                $this->_column_headers = [ $columns, $hidden, $sortable ];
×
527
        }
528

529
        /**
530
         * Counting total items.
531
         *
532
         * @param string $subquery         SQL FROM part.
533
         * @param string $all_states       SQL IN part.
534
         * @param string $post_type_clause SQL post type part.
535
         *
536
         * @return mixed
537
         */
538
        protected function count_items( $subquery, $all_states, $post_type_clause ) {
×
539
                global $wpdb;
×
540

541
                return (int) $wpdb->get_var(
×
542
                        "SELECT COUNT(ID) FROM {$subquery}
×
543
                                WHERE post_status IN ({$all_states})
×
544
                                        {$post_type_clause}
×
545
                        "
×
546
                );
×
547
        }
548

549
        /**
550
         * Getting the post_type_clause filter.
551
         *
552
         * @return string
553
         */
554
        protected function get_post_type_clause() {
×
555
                // Filter Block.
556
                $post_type_clause = '';
×
557
                $post_type_filter = isset( $_GET['post_type_filter'] ) && is_string( $_GET['post_type_filter'] ) ? sanitize_text_field( wp_unslash( $_GET['post_type_filter'] ) ) : '';
×
558

559
                if ( ! empty( $post_type_filter ) && get_post_type_object( $post_type_filter ) ) {
×
560
                        $post_types       = esc_sql( $post_type_filter );
×
561
                        $post_type_clause = "AND post_type IN ('{$post_types}')";
×
562
                }
563

564
                return $post_type_clause;
×
565
        }
566

567
        /**
568
         * Setting the pagination.
569
         *
570
         * Total items is the number of all visible items.
571
         *
572
         * @param int $total_items Total items counts.
573
         */
574
        protected function set_pagination( $total_items ) {
×
575
                // Calculate items per page.
576
                $per_page = $this->get_items_per_page( 'wpseo_posts_per_page', 10 );
×
577
                $paged    = isset( $_GET['paged'] ) && is_string( $_GET['paged'] ) ? esc_sql( sanitize_text_field( wp_unslash( $_GET['paged'] ) ) ) : '';
×
578

579
                if ( empty( $paged ) || ! is_numeric( $paged ) ) {
×
580
                        $paged = 1;
×
581
                }
582
                else {
583
                        $paged = (int) $paged;
×
584
                }
585

586
                if ( $paged <= 0 ) {
×
587
                        $paged = 1;
×
588
                }
589

590
                $this->set_pagination_args(
×
591
                        [
×
592
                                'total_items' => $total_items,
×
593
                                'total_pages' => ceil( $total_items / $per_page ),
×
594
                                'per_page'    => $per_page,
×
595
                        ]
×
596
                );
×
597

598
                $this->pagination = [
×
599
                        'per_page' => $per_page,
×
600
                        'offset'   => ( ( $paged - 1 ) * $per_page ),
×
601
                ];
×
602
        }
603

604
        /**
605
         * Parse the query to get items from database.
606
         *
607
         * Based on given parameters there will be parse a query which will get all the pages/posts and other post_types
608
         * from the database.
609
         *
610
         * @param string $subquery         SQL FROM part.
611
         * @param string $all_states       SQL IN part.
612
         * @param string $post_type_clause SQL post type part.
613
         *
614
         * @return string
615
         */
616
        protected function parse_item_query( $subquery, $all_states, $post_type_clause ) {
×
617
                // Order By block.
618
                $orderby = isset( $_GET['orderby'] ) && is_string( $_GET['orderby'] ) ? sanitize_text_field( wp_unslash( $_GET['orderby'] ) ) : '';
×
619

620
                $orderby = ! empty( $orderby ) ? esc_sql( $orderby ) : 'post_title';
×
621
                $orderby = $this->sanitize_orderby( $orderby );
×
622

623
                // Order clause.
624
                $order = isset( $_GET['order'] ) && is_string( $_GET['order'] ) ? sanitize_text_field( wp_unslash( $_GET['order'] ) ) : '';
×
625
                $order = ! empty( $order ) ? esc_sql( strtoupper( $order ) ) : 'ASC';
×
626
                $order = $this->sanitize_order( $order );
×
627

628
                // Get all needed results.
629
                $query = "
×
630
                        SELECT ID, post_title, post_type, post_status, post_modified, post_date
631
                                FROM {$subquery}
×
632
                                WHERE post_status IN ({$all_states}) $post_type_clause
×
633
                                ORDER BY {$orderby} {$order}
×
634
                                LIMIT %d,%d
635
                        ";
×
636

637
                return $query;
×
638
        }
639

640
        /**
641
         * Heavily restricts the possible columns by which a user can order the table
642
         * in the bulk editor, thereby preventing a possible CSRF vulnerability.
643
         *
644
         * @param string $orderby The column by which we want to order.
645
         *
646
         * @return string
647
         */
648
        protected function sanitize_orderby( $orderby ) {
×
649
                $valid_column_names = [
×
650
                        'post_title',
×
651
                        'post_type',
×
652
                        'post_date',
×
653
                ];
×
654

655
                if ( in_array( $orderby, $valid_column_names, true ) ) {
×
656
                        return $orderby;
×
657
                }
658

659
                return 'post_title';
×
660
        }
661

662
        /**
663
         * Makes sure the order clause is always ASC or DESC for the bulk editor table,
664
         * thereby preventing a possible CSRF vulnerability.
665
         *
666
         * @param string $order Whether we want to sort ascending or descending.
667
         *
668
         * @return string SQL order string (ASC, DESC).
669
         */
670
        protected function sanitize_order( $order ) {
×
671
                if ( in_array( strtoupper( $order ), [ 'ASC', 'DESC' ], true ) ) {
×
672
                        return $order;
×
673
                }
674

675
                return 'ASC';
×
676
        }
677

678
        /**
679
         * Getting all the items.
680
         *
681
         * @param string $query SQL query to use.
682
         */
683
        protected function get_items( $query ) {
×
684
                global $wpdb;
×
685

686
                $this->items = $wpdb->get_results(
×
687
                        $wpdb->prepare(
×
688
                                $query,
×
689
                                $this->pagination['offset'],
×
690
                                $this->pagination['per_page']
×
691
                        )
×
692
                );
×
693
        }
694

695
        /**
696
         * Getting all the states.
697
         *
698
         * @return string
699
         */
700
        protected function get_all_states() {
×
701
                global $wpdb;
×
702

703
                $states          = get_post_stati( [ 'show_in_admin_all_list' => true ] );
×
704
                $states['trash'] = 'trash';
×
705

706
                if ( ! empty( $this->input_fields['post_status'] ) ) {
×
707
                        $requested_state = $this->input_fields['post_status'];
×
708
                        if ( in_array( $requested_state, $states, true ) ) {
×
709
                                $states = [ $requested_state ];
×
710
                        }
711

712
                        if ( $requested_state !== 'trash' ) {
×
713
                                unset( $states['trash'] );
×
714
                        }
715
                }
716

717
                return $wpdb->prepare(
×
718
                        implode( ', ', array_fill( 0, count( $states ), '%s' ) ),
×
719
                        $states
×
720
                );
×
721
        }
722

723
        /**
724
         * Based on $this->items and the defined columns, the table rows will be displayed.
725
         */
726
        public function display_rows() {
×
727

728
                $records = $this->items;
×
729

730
                list( $columns, $hidden, $sortable, $primary ) = $this->get_column_info();
×
731

732
                if ( ( is_array( $records ) && $records !== [] ) && ( is_array( $columns ) && $columns !== [] ) ) {
×
733

734
                        foreach ( $records as $record ) {
×
735

736
                                echo '<tr id="', esc_attr( 'record_' . $record->ID ), '">';
×
737

738
                                foreach ( $columns as $column_name => $column_display_name ) {
×
739

740
                                        $classes = '';
×
741
                                        if ( $primary === $column_name ) {
×
742
                                                $classes .= ' has-row-actions column-primary';
×
743
                                        }
744

745
                                        $attributes = $this->column_attributes( $column_name, $hidden, $classes, $column_display_name );
×
746

747
                                        $column_value = $this->parse_column( $column_name, $record );
×
748

749
                                        if ( method_exists( $this, 'parse_page_specific_column' ) && empty( $column_value ) ) {
×
750
                                                $column_value = $this->parse_page_specific_column( $column_name, $record, $attributes );
×
751
                                        }
752

753
                                        if ( ! empty( $column_value ) ) {
×
754
                                                printf( '<td %2$s>%1$s</td>', $column_value, $attributes );
×
755
                                        }
756
                                }
757

758
                                echo '</tr>';
×
759
                        }
760
                }
761
        }
762

763
        /**
764
         * Getting the attributes for each table cell.
765
         *
766
         * @param string $column_name         Column name string.
767
         * @param array  $hidden              Set of hidden columns.
768
         * @param string $classes             Additional CSS classes.
769
         * @param string $column_display_name Column display name string.
770
         *
771
         * @return string
772
         */
773
        protected function column_attributes( $column_name, $hidden, $classes, $column_display_name ) {
×
774

775
                $attributes = '';
×
776
                $class      = [ $column_name, "column-$column_name$classes" ];
×
777

778
                if ( in_array( $column_name, $hidden, true ) ) {
×
779
                        $class[] = 'hidden';
×
780
                }
781

782
                if ( ! empty( $class ) ) {
×
783
                        $attributes = 'class="' . esc_attr( implode( ' ', $class ) ) . '"';
×
784
                }
785

786
                $attributes .= ' data-colname="' . esc_attr( $column_display_name ) . '"';
×
787

788
                return $attributes;
×
789
        }
790

791
        /**
792
         * Parsing the title.
793
         *
794
         * @param WP_Post $rec Post object.
795
         *
796
         * @return string
797
         */
798
        protected function parse_page_title_column( $rec ) {
×
799

800
                $title = empty( $rec->post_title ) ? __( '(no title)', 'wordpress-seo' ) : $rec->post_title;
×
801

802
                $return = sprintf( '<strong>%1$s</strong>', stripslashes( wp_strip_all_tags( $title ) ) );
×
803

804
                $post_type_object = get_post_type_object( $rec->post_type );
×
805
                $can_edit_post    = current_user_can( $post_type_object->cap->edit_post, $rec->ID );
×
806

807
                $actions = [];
×
808

809
                if ( $can_edit_post && $rec->post_status !== 'trash' ) {
×
810
                        $actions['edit'] = sprintf(
×
811
                                '<a href="%s" aria-label="%s">%s</a>',
×
812
                                esc_url( get_edit_post_link( $rec->ID, true ) ),
×
813
                                /* translators: Hidden accessibility text; %s: post title. */
814
                                esc_attr( sprintf( __( 'Edit &#8220;%s&#8221;', 'wordpress-seo' ), $title ) ),
×
815
                                __( 'Edit', 'wordpress-seo' )
×
816
                        );
×
817
                }
818

819
                if ( $post_type_object->public ) {
×
820
                        if ( in_array( $rec->post_status, [ 'pending', 'draft', 'future' ], true ) ) {
×
821
                                if ( $can_edit_post ) {
×
822
                                        $actions['view'] = sprintf(
×
823
                                                '<a href="%s" aria-label="%s">%s</a>',
×
824
                                                esc_url( add_query_arg( 'preview', 'true', get_permalink( $rec->ID ) ) ),
×
825
                                                /* translators: Hidden accessibility text; %s: post title. */
826
                                                esc_attr( sprintf( __( 'Preview &#8220;%s&#8221;', 'wordpress-seo' ), $title ) ),
×
827
                                                __( 'Preview', 'wordpress-seo' )
×
828
                                        );
×
829
                                }
830
                        }
831
                        elseif ( $rec->post_status !== 'trash' ) {
×
832
                                $actions['view'] = sprintf(
×
833
                                        '<a href="%s" aria-label="%s" rel="bookmark">%s</a>',
×
834
                                        esc_url( get_permalink( $rec->ID ) ),
×
835
                                        /* translators: Hidden accessibility text; %s: post title. */
836
                                        esc_attr( sprintf( __( 'View &#8220;%s&#8221;', 'wordpress-seo' ), $title ) ),
×
837
                                        __( 'View', 'wordpress-seo' )
×
838
                                );
×
839
                        }
840
                }
841

842
                $return .= $this->row_actions( $actions );
×
843

844
                return $return;
×
845
        }
846

847
        /**
848
         * Parsing the column based on the $column_name.
849
         *
850
         * @param string  $column_name Column name.
851
         * @param WP_Post $rec         Post object.
852
         *
853
         * @return string
854
         */
855
        protected function parse_column( $column_name, $rec ) {
×
856

857
                static $date_format;
×
858

859
                if ( ! isset( $date_format ) ) {
×
860
                        $date_format = get_option( 'date_format' );
×
861
                }
862

863
                switch ( $column_name ) {
864
                        case 'col_page_title':
×
865
                                $column_value = $this->parse_page_title_column( $rec );
×
866
                                break;
×
867

868
                        case 'col_page_slug':
×
869
                                $permalink    = get_permalink( $rec->ID );
×
870
                                $display_slug = str_replace( get_bloginfo( 'url' ), '', $permalink );
×
871
                                $column_value = sprintf( '<a href="%2$s" target="_blank">%1$s</a>', stripslashes( rawurldecode( $display_slug ) ), esc_url( $permalink ) );
×
872
                                break;
×
873

874
                        case 'col_post_type':
×
875
                                $post_type    = get_post_type_object( $rec->post_type );
×
876
                                $column_value = $post_type->labels->singular_name;
×
877
                                break;
×
878

879
                        case 'col_post_status':
×
880
                                $post_status  = get_post_status_object( $rec->post_status );
×
881
                                $column_value = $post_status->label;
×
882
                                break;
×
883

884
                        case 'col_post_date':
×
885
                                $column_value = date_i18n( $date_format, strtotime( $rec->post_date ) );
×
886
                                break;
×
887

888
                        case 'col_row_action':
×
889
                                $column_value = sprintf(
×
890
                                        '<a href="#" role="button" class="wpseo-save" data-id="%1$s">%2$s</a> <span aria-hidden="true">|</span> <a href="#" role="button" class="wpseo-save-all">%3$s</a>',
×
891
                                        $rec->ID,
×
892
                                        esc_html__( 'Save', 'wordpress-seo' ),
×
893
                                        esc_html__( 'Save all', 'wordpress-seo' )
×
894
                                );
×
895
                                break;
×
896
                }
897

898
                if ( ! empty( $column_value ) ) {
×
899
                        return $column_value;
×
900
                }
901
        }
902

903
        /**
904
         * Parse the field where the existing meta-data value is displayed.
905
         *
906
         * @param int        $record_id  Record ID.
907
         * @param string     $attributes HTML attributes.
908
         * @param bool|array $values     Optional values data array.
909
         *
910
         * @return string
911
         */
912
        protected function parse_meta_data_field( $record_id, $attributes, $values = false ) {
×
913

914
                // Fill meta data if exists in $this->meta_data.
915
                $meta_data  = ( ! empty( $this->meta_data[ $record_id ] ) ) ? $this->meta_data[ $record_id ] : [];
×
916
                $meta_key   = WPSEO_Meta::$meta_prefix . $this->target_db_field;
×
917
                $meta_value = ( ! empty( $meta_data[ $meta_key ] ) ) ? $meta_data[ $meta_key ] : '';
×
918

919
                if ( ! empty( $values ) ) {
×
920
                        $meta_value = $values[ $meta_value ];
×
921
                }
922

923
                $id = "wpseo-existing-$this->target_db_field-$record_id";
×
924

925
                // $attributes correctly escaped, verified by Alexander. See WPSEO_Bulk_Description_List_Table::parse_page_specific_column.
926
                return sprintf( '<td %2$s id="%3$s">%1$s</td>', esc_html( $meta_value ), $attributes, esc_attr( $id ) );
×
927
        }
928

929
        /**
930
         * Method for setting the meta data, which belongs to the records that will be shown on the current page.
931
         *
932
         * This method will loop through the current items ($this->items) for getting the post_id. With this data
933
         * ($needed_ids) the method will query the meta-data table for getting the title.
934
         */
935
        protected function get_meta_data() {
×
936

937
                $post_ids  = $this->get_post_ids();
×
938
                $meta_data = $this->get_meta_data_result( $post_ids );
×
939

940
                $this->parse_meta_data( $meta_data );
×
941

942
                // Little housekeeping.
943
                unset( $post_ids, $meta_data );
×
944
        }
945

946
        /**
947
         * Getting all post_ids from to $this->items.
948
         *
949
         * @return array
950
         */
951
        protected function get_post_ids() {
×
952
                $post_ids = [];
×
953
                foreach ( $this->items as $item ) {
×
954
                        $post_ids[] = $item->ID;
×
955
                }
956

957
                return $post_ids;
×
958
        }
959

960
        /**
961
         * Getting the meta_data from database.
962
         *
963
         * @param array $post_ids Post IDs for SQL IN part.
964
         *
965
         * @return mixed
966
         */
967
        protected function get_meta_data_result( array $post_ids ) {
×
968
                global $wpdb;
×
969

970
                $where = $wpdb->prepare(
×
971
                        'post_id IN (' . implode( ', ', array_fill( 0, count( $post_ids ), '%d' ) ) . ')',
×
972
                        $post_ids
×
973
                );
×
974

975
                $where .= $wpdb->prepare( ' AND meta_key = %s', WPSEO_Meta::$meta_prefix . $this->target_db_field );
×
976

977
                // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- They are prepared on the lines above.
978
                return $wpdb->get_results( "SELECT * FROM {$wpdb->postmeta} WHERE {$where}" );
×
979
        }
980

981
        /**
982
         * Setting $this->meta_data.
983
         *
984
         * @param array $meta_data Meta data set.
985
         */
986
        protected function parse_meta_data( $meta_data ) {
×
987

988
                foreach ( $meta_data as $row ) {
×
989
                        $this->meta_data[ $row->post_id ][ $row->meta_key ] = $row->meta_value;
×
990
                }
991
        }
992

993
        /**
994
         * This method will merge general array with given parameter $columns.
995
         *
996
         * @param array $columns Optional columns set.
997
         *
998
         * @return array
999
         */
1000
        protected function merge_columns( $columns = [] ) {
×
1001
                $columns = array_merge(
×
1002
                        [
×
1003
                                'col_page_title'  => __( 'WP Page Title', 'wordpress-seo' ),
×
1004
                                'col_post_type'   => __( 'Content Type', 'wordpress-seo' ),
×
1005
                                'col_post_status' => __( 'Post Status', 'wordpress-seo' ),
×
1006
                                'col_post_date'   => __( 'Publication date', 'wordpress-seo' ),
×
1007
                                'col_page_slug'   => __( 'Page URL/Slug', 'wordpress-seo' ),
×
1008
                        ],
×
1009
                        $columns
×
1010
                );
×
1011

1012
                $columns['col_row_action'] = __( 'Action', 'wordpress-seo' );
×
1013

1014
                return $columns;
×
1015
        }
1016
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc