sha256  7f6092f4ea58b5c5c0dba72ba014b9395bf9608f9aeeb95206e80dc14f0b17e5  /data/pruva/runs/52897a84-76e4-425d-abf6-ea2f2eb78fb0/bundle/repro/vendor/wp-review-slider-pro_v12.6.7.zip
--- Plugin header from bundled real product zip ---
 * @wordpress-plugin
 * Plugin Name: WP Review Slider Pro (Premium)
 * Plugin URI:        https://wpreviewslider.com/
 * Description:       Pro Version - Allows you to easily display your Facebook Page, Yelp, Google, Manually Input, and 80+ other site reviews in your Posts, Pages, and Widget areas.
 * Version:           12.6.7
 * Update URI: https://api.freemius.com
 * Author:            LJ Apps
 * Author URI:        http://ljapps.com/
--- Original notinstring vulnerable construction ---
    32				//add a not in statement after $sortdir if we are rand search ex: AND book_price NOT IN (100,200)
    33				if($notinstring!=''){
    34					//explode implode for safety
    35					$tempnotinarray = explode(",",$notinstring);
    36					if(is_array($tempnotinarray)){
    37						$notinstring = implode(",",$tempnotinarray);
    38						$notinsearchstring = " AND id NOT IN (".$notinstring.") ";
    39					}
--- Alternate public filter candidates in GetReviews_Functions::wppro_queryreviews() ---
    57			//add text search if we are using pagination and the search box
    58			$textsearchquery = '';
    59			$tagsearch='';
    60			if(!isset($template_misc_array['header_tag_search'])){
    61				$template_misc_array['header_tag_search']='';
    62			}
    63			if($textsearch!=''){
    64				if($template_misc_array['header_tag_search']=='tags'){
    65					$textsearchquery = "AND (tags LIKE '%%".sanitize_text_field($textsearch)."%%')";
    66				} else if($template_misc_array['header_tag_search']=='both'){
    67					$textsearchquery = "AND (reviewer_name LIKE '%%".sanitize_text_field($textsearch)."%%' or review_text LIKE '%%".sanitize_text_field($textsearch)."%%' or review_title LIKE '%%".sanitize_text_field($textsearch)."%%' or tags LIKE '%%".sanitize_text_field($textsearch)."%%' or type LIKE '%%".sanitize_text_field($textsearch)."%%' or meta_data LIKE '%%".sanitize_text_field($textsearch)."%%')";
    68				} else {
    69				$textsearchquery = "AND (reviewer_name LIKE '%%".sanitize_text_field($textsearch)."%%' or review_text LIKE '%%".sanitize_text_field($textsearch)."%%' or review_title LIKE '%%".sanitize_text_field($textsearch)."%%' or type LIKE '%%".sanitize_text_field($textsearch)."%%')";
    70				}
   490			}
   491			//language code filter on front end
   492			$publiclangfilter='';
   493			if($textlang!='' && $textlang!='unset'){
   494				$publiclangfilter = " AND language_code = '".sanitize_text_field($textlang)."'";
   495			}
   496			//source code filter on front end
   497			$publicsourcefilter='';
   498			if($textsource!='' && $textsource!='unset'){
   499				$publicsourcefilter = " AND pageid = '".sanitize_text_field($textsource)."'";
   500			}
   501			
--- Query concatenation that appends filters ---
   690				//find total and average in db
   691				$nolimitreviews = $wpdb->get_results($querynolimit,ARRAY_A);
   692			}
   693			} else {
   694				$totalreviews = $wpdb->get_results(
   695					$wpdb->prepare("SELECT * FROM ".$table_name."
   696					 ".$hidenquery." ".$lengthquery." ".$rtypefilter." ".$rpagefilter." ".$rpostidfilter." ".$rstringfilter." ".$rstringfilternot." ".$rcatidfilter." ".$tagfilter." ".$mediafilter." ".$langfilter." ".$shortlangfilter." ".$shortcodetagfilter." ".$randlimitfilter."".$ratingquery."".$notinsearchstring."".$textsearchquery."".$ratingquerypublic."".$publiclangfilter."".$publicsourcefilter."".$publicrtypefilter."
   697					ORDER BY ".$sorttable." ".$sortdir." LIMIT ".$tablelimit." ",$hidenqueryvar)
   698			);
   699			$totalreviewsarray['dbcall'] = $wpdb->last_query;
   700			//run another query if we need total and average.
   701			if(!$skip_aggregate_queries && ($currentform[0]->google_snippet_add=='yes' || $currentform[0]->load_more=='yes' ||  $template_misc_array['header_text']!='' || $template_misc_array['header_rtypes']=='yes' || $template_misc_array['header_banner']!='')){
   702				$notinsearchstring ='';
   703				$nolimitreviews = $wpdb->get_results(
   704				$wpdb->prepare("SELECT * FROM ".$table_name."
   705					 ".$hidenquery." ".$lengthquery." ".$rtypefilter." ".$rpagefilter." ".$rpostidfilter." ".$rstringfilter." ".$rstringfilternot." ".$rcatidfilter." ".$tagfilter." ".$mediafilter." ".$langfilter." ".$shortlangfilter." ".$shortcodetagfilter." ".$randlimitfilter."".$ratingquery."".$notinsearchstring."".$textsearchquery."".$ratingquerypublic."".$publiclangfilter."".$publicsourcefilter."".$publicrtypefilter."
   706					ORDER BY ".$sorttable." ".$sortdir." ",$hidenqueryvar),ARRAY_A);
--- Public unauthenticated AJAX action registration ---
  1556				
  1557				//add ajax for getting the load more reviews, called when someone clicks the load more button
  1558				$this->loader->add_action( 'wp_ajax_wprp_load_more_revs', $plugin_public, 'wppro_loadmore_revs_ajax' );
  1559				$this->loader->add_action( 'wp_ajax_nopriv_wprp_load_more_revs', $plugin_public, 'wppro_loadmore_revs_ajax' );
  1560