security issue fixed

edwiser-bridge/admin/class-eb-settings-ajax-initiater.php

@@ -236,7 +236,8 @@ public function check_course_options() {
 			}
 
 			global $wpdb;
-			$query = 'SELECT `product_id` FROM ' . $wpdb->prefix . "eb_moodle_course_products WHERE `moodle_post_id` = '" . $course_id . "'";
+			// $query = 'SELECT `product_id` FROM ' . $wpdb->prefix . "eb_moodle_course_products WHERE `moodle_post_id` = '" . $course_id . "'";
+			$query = $wpdb->prepare( "SELECT `product_id` FROM {$wpdb->prefix}eb_moodle_course_products WHERE `moodle_post_id` = %d", $course_id ); // @codingStandardsIgnoreLine
 
 			$product_id = $wpdb->get_var( $query ); // @codingStandardsIgnoreLine
 

edwiser-bridge/edwiser-bridge.php

@@ -10,7 +10,7 @@
  * Plugin Name:       Edwiser Bridge - WordPress Moodle LMS Integration
  * Plugin URI:        https://edwiser.org/bridge/
  * Description:       Edwiser Bridge integrates WordPress with the Moodle LMS. The plugin provides an easy option to import Moodle courses to WordPress and sell them using PayPal. The plugin also allows automatic registration of WordPress users on the Moodle website along with single login credentials for both the systems.
- * Version:           3.0.2
+ * Version:           3.0.3
  * Author:            WisdmLabs
  * Author URI:        https://edwiser.org
  * License:           GPL-2.0+
@@ -31,7 +31,7 @@
 $eb_plugin_data = array(
 	'name'           => 'Edwiser Bridge - WordPress Moodle LMS Integration',
 	'slug'           => 'edwiser-bridge',
-	'version'        => '3.0.2',
+	'version'        => '3.0.3',
 	'mdl_plugin_url' => 'https://edwiser.org/plugins/edwiserbridge.zip',
 );
 
@@ -129,7 +129,7 @@ function wdm_plugin_row_meta( $links, $file ) {
  * Upgrade.
  */
 function process_upgrade() {
-	$new_version     = '3.0.2';
+	$new_version     = '3.0.3';
 	$current_version = get_option( 'eb_current_version' );
 	if ( false === $current_version || $current_version !== $new_version ) {
 		require_once plugin_dir_path( __FILE__ ) . 'includes/class-eb-activator.php';

edwiser-bridge/includes/class-eb-course-manager.php

@@ -690,10 +690,10 @@ public function create_course_categories_on_wordpress( $category_response ) {
 				);
 
 				if ( $parent_term && ! term_exists( $cat_name_lower, 'eb_course_cat', $parent_term ) ) {
-					// check if same category exists
-					if( term_exists( $cat_name_lower, 'eb_course_cat' ) ) {
+					// check if same category exists.
+					if ( term_exists( $cat_name_lower, 'eb_course_cat' ) ) {
 						$cat_name_lower = $cat_name_lower . '_' . $category->id;
-						if( term_exists( $cat_name_lower, 'eb_course_cat', $parent_term ) ) {
+						if ( term_exists( $cat_name_lower, 'eb_course_cat', $parent_term ) ) {
 							continue;
 						}
 					}

edwiser-bridge/includes/class-eb-custom-list-table.php

@@ -79,7 +79,7 @@ private function eb_get_filter_query( $filter, $search_text, $from, $to, $order,
 			$where      = '';
 			$post_table = '';
 			$user_table = '';
-			$date       = empty( $from ) ? '' : "time> '" . $from . "'" . ( empty( $to ) ? '' : " AND time< '" . $to . "'" );
+			$date       = empty( $from ) ? '' : "time> '" . esc_sql( $from ) . "'" . ( empty( $to ) ? '' : " AND time< '" . esc_sql( $to ) . "'" );
 
 			// There are 2 filters which need join query.
 			// 1. Course name.
@@ -135,14 +135,24 @@ public function bp_get_table( $post_data, $search_text, $current_page ) {
 			$order_by = ! empty( $_REQUEST['orderby'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['orderby'] ) ) : 'id'; // WPCS: CSRF ok, input var ok. // @codingStandardsIgnoreLine.
 			// If no order, default to asc.
 			$order = ! empty( $_REQUEST['order'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['order'] ) ) : 'asc'; // WPCS: CSRF ok, input var ok. // @codingStandardsIgnoreLine.
-			$date  = empty( $from ) ? '' : "time> '" . $from . "'" . ( empty( $to ) ? '' : " AND time< '" . $to . "'" );
+			$date  = empty( $from ) ? '' : "time> '" . esc_sql( $from ) . "'" . ( empty( $to ) ? '' : " AND time< '" . esc_sql( $to ) . "'" );
 
+			$allowed_orderby = $this->get_sortable_columns();
+			if ( ! array_key_exists( $order_by, $allowed_orderby ) ) {
+				$order_by = 'id';
+			}
+			if ( ! in_array( strtoupper( $order ), array( 'ASC', 'DESC' ), true ) ) {
+				$order = 'ASC';
+			}
 			if ( 'rId' === $order_by ) {
 				$order_by = 'id';
 			} elseif ( 'enrolled_date' === $order_by ) {
 				$order_by = 'time';
 			}
 
+			$order_by = $wpdb->_real_escape( $order_by );
+			$order    = $wpdb->_real_escape( $order );
+
 			$order_query = $order_by . ' ' . strtoupper( $order );
 
 			// Determine sort order.

edwiser-bridge/includes/class-eb-enrollment-manager.php

@@ -731,7 +731,7 @@ public static function access_remianing( $user_id, $course_id ) {
 		$curr_date   = new \DateTime( ( gmdate( 'Y-m-d H:i:s' ) ) );
 		$expire_date = $wpdb->get_var( $wpdb->prepare( "SELECT expire_time	FROM {$wpdb->prefix}moodle_enrollment WHERE course_id=%d AND user_id=%d;", $course_id, $user_id ) ); // @codingStandardsIgnoreLine
 
-		if ( '0000-00-00 00:00:00' === $expire_date || empty($expire_date) ) {
+		if ( '0000-00-00 00:00:00' === $expire_date || empty( $expire_date ) ) {
 			return '0000-00-00 00:00:00';
 		}
 

edwiser-bridge/includes/class-eb-post-types.php

@@ -531,7 +531,7 @@ public function render_metabox_fields( $args ) {
 				if ( ! is_array( $data ) ) {
 					$data = array( $data );
 				}
-				
+
 				foreach ( $field['options'] as $k => $v ) {
 					$selected = false;
 					if ( in_array( trim( $k ), $data, true ) ) {

edwiser-bridge/includes/class-eb-user-manager.php

@@ -1144,7 +1144,7 @@ public function display_users_enrolled_courses( $user ) {
 			$courses     = get_posts( $course_args );
 
 			$user_enrolled_courses = eb_get_user_enrolled_courses( $user_id );
-			// make sure all the courses are in int
+			// make sure all the courses are in int.
 			$user_enrolled_courses = array_map( 'intval', $user_enrolled_courses );
 			?>
 			<table>
@@ -1246,11 +1246,11 @@ public function update_courses_on_profile_update( $user_id ) {
 					$enroll_courses = (array) wp_unslash( $_POST['eb_enroll_courses'] );
 				}
 				$enroll_courses = json_decode( $enroll_courses[0], true );
-				
+
 				$user_enrolled_courses = eb_get_user_enrolled_courses( $user_id );
 
 				// enroll user to courses.
-				$to_enroll = array_diff( $enroll_courses, $user_enrolled_courses );
+				$to_enroll   = array_diff( $enroll_courses, $user_enrolled_courses );
 				$to_unenroll = array_diff( $user_enrolled_courses, $enroll_courses );
 
 				if ( is_array( $to_enroll ) ) {

edwiser-bridge/readme.txt

@@ -2,7 +2,7 @@
 Contributors: WisdmLabs
 Tags: Moodle, Moodle ecommerce, WordPress Moodle, Sell Moodle Courses, LMS Integration, Moodle Integration, Moodle WordPress, WP Moodle, eLearning, WooCommerce
 Requires at least: 5.8
-Tested up to: 6.3
+Tested up to: 6.4
 Stable tag: trunk
 License: GPLv3
 License URI: http://www.gnu.org/licenses/gpl-3.0.html
@@ -205,6 +205,9 @@ Also, check our knowledge base for more queries
 
 
  ==  Changelog  ==
+= 3.0.3 =
+* Tweak - Security issues fixed.
+
 = 3.0.2 =
 * Tweak - WooCommerce HPOS compatibility.
 * Tweak - PHP 8.1 compatibility.