';
$GLOBALS['wp_admin_bar']->add_node([
'id' => 'slimstat-adminbar-cta',
'parent' => 'slimstat-header',
'title' => $cta_html,
'meta' => ['class' => 'slimstat-adminbar__cta-wrapper'],
]);
}
// Add footer node
$footer_html = '';
$GLOBALS['wp_admin_bar']->add_node([
'id' => 'slimstat-adminbar-footer',
'parent' => 'slimstat-header',
'title' => $footer_html,
'meta' => ['class' => 'slimstat-adminbar__footer-wrapper'],
]);
}
// END: add_menu_to_adminbar
/**
* Includes the appropriate panel to view the stats
*/
public static function wp_slimstat_include_view()
{
include(__DIR__ . '/view/index.php');
}
// END: wp_slimstat_include_view
/**
* Includes the screen to arrange the reports
*/
public static function wp_slimstat_include_layout()
{
include(__DIR__ . '/view/layout.php');
}
// END: wp_slimstat_include_layout
/**
* Includes the email report screen
*/
public static function wp_slimstat_include_email_report()
{
include(__DIR__ . '/view/email-report.php');
}
// END: wp_slimstat_include_email_report
/**
* Handles the upgrade to pro from the free version
*/
public static function wp_slimstat_pro()
{
include(__DIR__ . '/view/upgrade-pro.php');
}
// END: wp_slimstat_include_addons
/**
* Includes the appropriate panel to configure Slimstat
*/
public static function wp_slimstat_include_config()
{
include(__DIR__ . '/config/index.php');
}
// END: wp_slimstat_include_config
/**
* Retrieves all the information to be used in the custom column on posts, pages and CPTs
*/
public static function init_data_for_column()
{
if (!is_array($GLOBALS['wp_query']->posts)) {
return 0;
}
foreach ($GLOBALS['wp_query']->posts as $a_post) {
self::$data_for_column['url'][$a_post->ID] = parse_url(get_permalink($a_post->ID));
self::$data_for_column['url'][$a_post->ID] = self::$data_for_column['url'][$a_post->ID]['path'] . (empty(self::$data_for_column['url'][$a_post->ID]['query']) ? '' : '?' . self::$data_for_column['url'][$a_post->ID]['query']);
self::$data_for_column['sql'][$a_post->ID] = self::$data_for_column['url'][$a_post->ID] . '%';
}
/**
* https://wordpress.org/support/topic/you-have-an-error-in-your-sql-syntax-22/#post-12565619
*/
if (empty(self::$data_for_column) || empty(self::$data_for_column['url'])) {
return 0;
}
wp_slimstat_db::init('interval equals -' . wp_slimstat::$settings['posts_column_day_interval']);
$column = ('on' == wp_slimstat::$settings['posts_column_pageviews']) ? 'id' : 'ip';
$where = wp_slimstat_db::get_combined_where('(' . implode(' OR ', array_fill(1, count(self::$data_for_column['url']), 'resource LIKE %s')) . ')', '*', true);
$sql = wp_slimstat::$wpdb->prepare("
SELECT resource, COUNT( DISTINCT {$column} ) as counthits
FROM {$GLOBALS['wpdb']->prefix}slim_stats
WHERE " . $where . '
GROUP BY resource
LIMIT 0, ' . wp_slimstat_db::$filters_normalized['misc']['limit_results'], self::$data_for_column['sql']);
$results = wp_slimstat_db::get_results($sql);
foreach (self::$data_for_column['url'] as $post_id => $a_url) {
self::$data_for_column['count'][$post_id] = 0;
foreach ($results as $i => $a_row) {
if (false !== strpos($a_row['resource'], (string) $a_url)) {
self::$data_for_column['count'][$post_id] += $a_row['counthits'];
unset($results[$i]);
}
}
}
return null;
}
// END: init_data_for_column
/**
* Adds a new column header to the Posts panel (to show the number of pageviews for each post)
*/
public static function add_column_header($_columns = [])
{
if (empty(wp_slimstat::$settings['posts_column_day_interval'])) {
wp_slimstat::$settings['posts_column_day_interval'] = 28;
}
if ('on' == wp_slimstat::$settings['posts_column_pageviews']) {
$_columns['wp-slimstat'] = '' . __('Views') . '';
} else {
$_columns['wp-slimstat'] = '';
}
return $_columns;
}
// END: add_comment_column_header
/**
* Adds a new column to the Posts management panel
*/
public static function add_post_column($_column_name, $_post_id)
{
if ('wp-slimstat' != $_column_name || empty(self::$data_for_column['url'][$_post_id])) {
return 0;
}
$count = empty(self::$data_for_column['count'][$_post_id]) ? 0 : self::$data_for_column['count'][$_post_id];
echo '' . $count . '';
return null;
}
// END: add_column
/**
* Displays an alert message
*/
public static function show_message($_message = '', $_type = 'info', $_dismiss_handle = '')
{
if (empty($_message)) {
return 0;
}
$_message = wpautop(wp_kses_post($_message));
if (!empty($_dismiss_handle)) {
echo '
' . $_message . '
';
} else {
echo '
' . $_message . '
';
}
return null;
}
// END: show_message
/**
* Displays a message related to the current version of Slimstat
*/
public static function show_latest_news()
{
self::show_message(self::$admin_notice, 'info', 'latest-news');
}
// END: show_latest_news
/**
* Handles the Ajax request to hide the admin notice
*/
public static function notices_handler()
{
$tag = current_filter();
if (!empty($tag) && current_user_can('manage_options') && wp_verify_nonce($_POST['security'], 'meta-box-order')) {
$tag = str_replace('wp_ajax_slimstat_', '', $tag);
wp_slimstat::$settings[$tag] = 'no';
// Save the default values in the database
wp_slimstat::update_option('slimstat_options', wp_slimstat::$settings);
}
exit();
}
// END: notices_handler
// ---- Goals & Funnels CRUD ---- //
/**
* Invalidates all goal/funnel/visitor caches by incrementing version.
* Works with both wp_options and external object cache (Redis/Memcached).
*
* When no persistent object cache is present, orphaned version-keyed
* transient rows in wp_options aren't cleaned up until WordPress's
* `delete_expired_transients` cron fires (every 12h). We GC them here
* so frequently-edited installs don't accumulate hundreds of rows.
*/
private static function clear_goals_cache()
{
// Sub-second precision avoids collisions when two saves land in the
// same second (time() granularity was causing cache-miss no-ops).
update_option('slimstat_goals_cache_ver', (string) microtime(true), false);
if (function_exists('wp_using_ext_object_cache') && wp_using_ext_object_cache()) {
return;
}
global $wpdb;
if (!$wpdb) {
return;
}
$like_goal = $wpdb->esc_like('_transient_slimstat_goal_') . '%';
$like_goal_timeout = $wpdb->esc_like('_transient_timeout_slimstat_goal_') . '%';
$like_funnel = $wpdb->esc_like('_transient_slimstat_funnel_') . '%';
$like_funnel_t = $wpdb->esc_like('_transient_timeout_slimstat_funnel_') . '%';
// Unique-visitor denominator transients (CR math) — version-keyed since 5.5.0
// so they accumulate one row per date range; sweep them here too.
$like_uv = $wpdb->esc_like('_transient_slimstat_uv_') . '%';
$like_uv_timeout = $wpdb->esc_like('_transient_timeout_slimstat_uv_') . '%';
// LIMIT 1000 mirrors update_tables_and_options()'s bounded transient sweep so
// an install with many accumulated rows doesn't run an unbounded synchronous
// DELETE on an admin save.
$wpdb->query($wpdb->prepare(
"DELETE FROM {$wpdb->options} WHERE option_name LIKE %s OR option_name LIKE %s OR option_name LIKE %s OR option_name LIKE %s OR option_name LIKE %s OR option_name LIKE %s LIMIT 1000",
$like_goal,
$like_goal_timeout,
$like_funnel,
$like_funnel_t,
$like_uv,
$like_uv_timeout
));
}
/**
* Returns validated goal dimensions available for selection.
*/
public static function get_goal_dimensions()
{
return [
'resource' => __('Page URL', 'wp-slimstat'),
'content_type' => __('Content Type', 'wp-slimstat'),
'content_id' => __('Content ID', 'wp-slimstat'),
'searchterms' => __('Search Terms', 'wp-slimstat'),
'country' => __('Country', 'wp-slimstat'),
'browser' => __('Browser', 'wp-slimstat'),
'platform' => __('Operating System', 'wp-slimstat'),
'referer' => __('Referer', 'wp-slimstat'),
'username' => __('Username', 'wp-slimstat'),
'event_notes' => __('Event', 'wp-slimstat'),
];
}
/**
* Dimensions allowed for FUNNEL STEPS — a subset of get_goal_dimensions()
* restricted to action/journey-oriented entities. Attribute dimensions
* (Country, Browser, Operating System, Referer, Username) describe WHO a
* visitor is, not what they DID, so they make no sense as a funnel step
* ("Homepage → Chrome → Checkout") and stay reserved for goals. Sliced from
* get_goal_dimensions() via array_intersect_key so labels + order never
* drift from the canonical list. (#17)
*/
public static function get_funnel_step_dimensions()
{
$allowed = ['resource', 'content_type', 'content_id', 'searchterms', 'event_notes'];
return array_intersect_key(self::get_goal_dimensions(), array_flip($allowed));
}
/**
* Returns validated goal operators.
*/
public static function get_goal_operators()
{
return ['equals', 'is_not_equal_to', 'contains', 'does_not_contain', 'starts_with', 'ends_with', 'matches', 'is_empty', 'is_not_empty'];
}
/**
* Returns an operator-key => human-label map, sourced from wp_slimstat_db's
* canonical operator-names table. Falls back to the key when the DB class is
* not yet loaded (admin_footer hooks may fire before reports init in rare paths).
*
* @since 5.5.0
*/
public static function get_goal_operator_labels()
{
$labels = [];
$has_db = class_exists('wp_slimstat_db');
foreach (self::get_goal_operators() as $op) {
$labels[$op] = ($has_db && !empty(wp_slimstat_db::$operator_names[$op]))
? wp_slimstat_db::$operator_names[$op]
: $op;
}
return $labels;
}
/**
* Sanitizes and validates a goal definition array.
*
* Accepts raw slashed input (callers hand through `$_POST` directly) and
* runs wp_unslash() before the per-field sanitizers so admin-entered values
* containing quotes or backslashes round-trip correctly.
*/
private static function sanitize_goal($raw, $is_funnel_step = false)
{
if (!is_array($raw)) {
return false;
}
$raw = wp_unslash($raw);
// Funnel steps accept only action-oriented dimensions; goals accept all.
// Validating server-side keeps an attribute dimension from being POSTed
// past the (already-restricted) builder dropdown. (#17)
$dimensions = $is_funnel_step ? self::get_funnel_step_dimensions() : self::get_goal_dimensions();
$operators = self::get_goal_operators();
$goal = [
// A provided id is honoured only so callers can match an existing
// record for update; new records get a server-assigned id via
// next_record_id() (never a client value, never microtime — which
// collides on sub-ms saves and overflows on 32-bit PHP).
'id' => !empty($raw['id']) ? intval($raw['id']) : 0,
'name' => !empty($raw['name']) ? sanitize_text_field($raw['name']) : '',
'dimension' => !empty($raw['dimension']) && isset($dimensions[$raw['dimension']]) ? $raw['dimension'] : '',
'operator' => !empty($raw['operator']) && in_array($raw['operator'], $operators, true) ? $raw['operator'] : '',
'value' => isset($raw['value']) ? sanitize_text_field($raw['value']) : '',
'active' => isset($raw['active']) ? (bool) $raw['active'] : true,
];
if (empty($goal['name']) || empty($goal['dimension']) || empty($goal['operator'])) {
return false;
}
// A value-bearing operator must carry a non-empty value; otherwise the
// query builder emits an unbound "%s" placeholder that breaks the SQL and
// silently reports 0. Only the valueless operators may omit a value — sourced
// from the shared wp_slimstat_db list (guarded; the db class may not be loaded
// yet on the save path) so it never drifts. See #305.
$valueless = class_exists('wp_slimstat_db') ? wp_slimstat_db::$valueless_operators : ['is_empty', 'is_not_empty'];
if ('' === $goal['value'] && !in_array($goal['operator'], $valueless, true)) {
return false;
}
return $goal;
}
/**
* Returns a collision-free id for a new goal/funnel record: max existing id + 1.
* Replaces the old microtime()-based id (which collided on sub-millisecond
* saves and overflowed to 0 on 32-bit PHP), and is never client-supplied.
*/
private static function next_record_id(array $records)
{
$max = 0;
foreach ($records as $record) {
if (isset($record['id']) && (int) $record['id'] > $max) {
$max = (int) $record['id'];
}
}
return $max + 1;
}
/**
* AJAX: Save (create/update) a goal.
*/
public static function ajax_save_goal()
{
check_ajax_referer('slimstat_goals_nonce', 'security');
if (!current_user_can(wp_slimstat::$settings['capability_can_admin'])) {
wp_send_json_error(['message' => __('Insufficient permissions', 'wp-slimstat')]);
}
$goal = self::sanitize_goal($_POST);
if (!$goal) {
wp_send_json_error(['message' => __('Invalid goal definition', 'wp-slimstat')]);
}
$goals = get_option('slimstat_goals', []);
$max_goals = apply_filters('slimstat_max_goals', 1);
// Update only when a client-supplied id matches an existing goal; anything
// else is a create. New records get a server-assigned id (next_record_id)
// so a client can't force a collision/overwrite by sending an arbitrary id.
// NOTE: this read-modify-write of the slimstat_goals option assumes a single
// editor — concurrent admin saves can still last-writer-win (acceptable for
// an admin-only, low-frequency setting).
$found = false;
if (!empty($goal['id'])) {
foreach ($goals as $i => $existing) {
if ((int) $existing['id'] === (int) $goal['id']) {
$goals[$i] = $goal;
$found = true;
break;
}
}
}
if (!$found) {
// Hard cap on total stored goals (active + paused). Paused goals don't
// count against the active-tier limit below, so without this they could
// grow the slimstat_goals option without bound.
$hard_cap = (int) apply_filters('slimstat_goals_hard_cap', 50);
if (count($goals) >= $hard_cap) {
wp_send_json_error(['message' => __('Too many goals stored. Delete unused goals before adding more.', 'wp-slimstat')]);
}
$goal['id'] = self::next_record_id($goals);
}
// Count active goals in the state that *would* result from this save.
// For updates, $goals already reflects the incoming edit; for creates,
// append hypothetically for the check only. This catches the bypass
// where activating a previously-paused goal on update slipped past the
// limit because the old guard only ran on creates.
$post_save = $found ? $goals : array_merge($goals, [$goal]);
$active_count = count(array_filter($post_save, function ($g) {
return !empty($g['active']);
}));
if ($active_count > $max_goals) {
wp_send_json_error([
'message' => sprintf(
/* translators: %d is the max goal count for the tier */
__('Goal limit reached (%d). Upgrade to Pro for more goals.', 'wp-slimstat'),
$max_goals
),
]);
}
if (!$found) {
$goals[] = $goal;
}
update_option('slimstat_goals', $goals, false);
self::clear_goals_cache();
wp_send_json_success(['goals' => $goals]);
}
/**
* AJAX: Delete a goal by ID.
*/
public static function ajax_delete_goal()
{
check_ajax_referer('slimstat_goals_nonce', 'security');
if (!current_user_can(wp_slimstat::$settings['capability_can_admin'])) {
wp_send_json_error(['message' => __('Insufficient permissions', 'wp-slimstat')]);
}
$goal_id = isset($_POST['goal_id']) ? intval(wp_unslash($_POST['goal_id'])) : 0;
if ($goal_id <= 0) {
wp_send_json_error(['message' => __('Invalid goal id', 'wp-slimstat')]);
}
$goals = get_option('slimstat_goals', []);
$filtered = array_values(array_filter($goals, function ($g) use ($goal_id) {
return isset($g['id']) && (int) $g['id'] !== $goal_id;
}));
if (count($filtered) === count($goals)) {
wp_send_json_error(['message' => __('Goal not found', 'wp-slimstat')], 404);
}
update_option('slimstat_goals', $filtered, false);
self::clear_goals_cache();
wp_send_json_success(['goals' => $filtered]);
}
/**
* AJAX: Save (create/update) a funnel.
*/
public static function ajax_save_funnel()
{
check_ajax_referer('slimstat_goals_nonce', 'security');
if (!current_user_can(wp_slimstat::$settings['capability_can_admin'])) {
wp_send_json_error(['message' => __('Insufficient permissions', 'wp-slimstat')]);
}
$max_funnels = apply_filters('slimstat_max_funnels', 0);
if ($max_funnels <= 0) {
wp_send_json_error(['message' => __('Funnels require SlimStat Pro', 'wp-slimstat')]);
}
$raw_steps = isset($_POST['steps']) && is_array($_POST['steps']) ? $_POST['steps'] : [];
if (count($raw_steps) < 2 || count($raw_steps) > 5) {
wp_send_json_error(['message' => __('Funnels require 2-5 steps', 'wp-slimstat')]);
}
$steps = [];
foreach ($raw_steps as $raw_step) {
$step = self::sanitize_goal($raw_step, true);
if (!$step) {
wp_send_json_error(['message' => __('Invalid step definition', 'wp-slimstat')]);
}
$steps[] = $step;
}
$raw_funnel_name = isset($_POST['funnel_name']) ? wp_unslash((string) $_POST['funnel_name']) : '';
$incoming_id = !empty($_POST['funnel_id']) ? intval(wp_unslash($_POST['funnel_id'])) : 0;
$funnel = [
// Provisional id; reassigned with a server-side value for creates below
// (never microtime — it collides on sub-ms saves / overflows on 32-bit).
'id' => $incoming_id,
'name' => sanitize_text_field($raw_funnel_name),
'steps' => $steps,
];
if (empty($funnel['name'])) {
wp_send_json_error(['message' => __('Funnel name is required', 'wp-slimstat')]);
}
$funnels = get_option('slimstat_funnels', []);
// Update only when a client-supplied id matches an existing funnel; else create.
$found = false;
if ($incoming_id > 0) {
foreach ($funnels as $i => $existing) {
if ((int) $existing['id'] === $incoming_id) {
$funnels[$i] = $funnel;
$found = true;
break;
}
}
}
if (!$found) {
if (count($funnels) >= $max_funnels) {
wp_send_json_error([
'message' => sprintf(
__('Funnel limit reached (%d).', 'wp-slimstat'),
$max_funnels
),
]);
}
$funnel['id'] = self::next_record_id($funnels);
$funnels[] = $funnel;
}
update_option('slimstat_funnels', $funnels, false);
self::clear_goals_cache();
wp_send_json_success(['funnels' => $funnels]);
}
/**
* AJAX: Delete a funnel by ID.
*/
public static function ajax_delete_funnel()
{
check_ajax_referer('slimstat_goals_nonce', 'security');
if (!current_user_can(wp_slimstat::$settings['capability_can_admin'])) {
wp_send_json_error(['message' => __('Insufficient permissions', 'wp-slimstat')]);
}
$funnel_id = isset($_POST['funnel_id']) ? intval(wp_unslash($_POST['funnel_id'])) : 0;
if ($funnel_id <= 0) {
wp_send_json_error(['message' => __('Invalid funnel id', 'wp-slimstat')]);
}
$funnels = get_option('slimstat_funnels', []);
$filtered = array_values(array_filter($funnels, function ($f) use ($funnel_id) {
return isset($f['id']) && (int) $f['id'] !== $funnel_id;
}));
if (count($filtered) === count($funnels)) {
wp_send_json_error(['message' => __('Funnel not found', 'wp-slimstat')], 404);
}
update_option('slimstat_funnels', $filtered, false);
self::clear_goals_cache();
wp_send_json_success(['funnels' => $filtered]);
}
/**
* AJAX: Return per-step results + summary for a single funnel by id.
* Used by the funnel tab bar's lazy-load — inactive tabs fetch on click.
*
* @since 5.5.0
*/
public static function ajax_load_funnel_data()
{
check_ajax_referer('slimstat_goals_nonce', 'security');
if (!self::check_ajax_view_capability()) {
return;
}
$funnel_id = intval($_POST['funnel_id'] ?? 0);
$funnels = get_option('slimstat_funnels', []);
$funnel = null;
foreach ($funnels as $f) {
if (intval($f['id']) === $funnel_id) {
$funnel = $f;
break;
}
}
if (!$funnel) {
wp_send_json_error(['message' => __('Funnel not found', 'wp-slimstat')], 404);
}
// Hydrate the DB layer (columns + the on-screen date range). This AJAX
// action isn't covered by the admin bootstrap's init(), so without it the
// date filter collapses to `dt BETWEEN 0 AND 0` and every step returns 0 —
// which is why only the first, server-rendered funnel showed data. (#8)
self::ensure_goals_db_initialized();
$step_results = wp_slimstat_db::get_funnel_results($funnel);
// Summary: step count + total conversion rate (null when step 1 had no visitors,
// so the UI renders "No matching visitors" instead of a fake 100%).
$step_one_visitors = $step_results[0]['visitors'] ?? 0;
$total_cr = null;
if ($step_one_visitors > 0) {
$total_cr = (count($step_results) > 1)
? $step_results[count($step_results) - 1]['pct']
: 100;
}
$unreachable_count = 0;
foreach ($step_results as $step) {
if (!empty($step['unreachable'])) {
$unreachable_count++;
}
}
wp_send_json_success([
'funnel_id' => $funnel_id,
'steps' => $step_results,
'summary' => [
'step_count' => count($step_results),
'total_cr' => $total_cr,
'unreachable_count' => $unreachable_count,
],
]);
}
/**
* AJAX: Return the unique-visitor count for a single funnel step rule.
* Powers the builder's per-step "Test" affordance. A single step IS the
* same shape as a goal, so we forward to get_goal_results().
*
* @since 5.5.0
*/
public static function ajax_test_funnel_step()
{
check_ajax_referer('slimstat_goals_nonce', 'security');
// Builder-only action: it runs an arbitrary admin-supplied rule (including
// REGEXP) against slim_stats and each distinct rule misses the cache, so it
// is gated on the admin capability rather than the broader view capability.
if (!current_user_can(wp_slimstat::$settings['capability_can_admin'])) {
wp_send_json_error(['message' => __('Insufficient permissions', 'wp-slimstat')], 403);
}
$step = self::sanitize_goal($_POST, true);
if (!$step) {
wp_send_json_error(['message' => __('Step is missing required fields', 'wp-slimstat')]);
}
// Force a stable id derived from the rule so repeat Test-clicks on the
// same rule hit the get_goal_results() transient. sanitize_goal() default
// id is microtime-based (unique per call), which defeats caching here.
$step['id'] = crc32($step['dimension'] . '|' . $step['operator'] . '|' . (string) $step['value']);
// Same as ajax_load_funnel_data: initialize the DB layer + date range so
// the rule is tested against the selected window instead of
// `dt BETWEEN 0 AND 0` (which returned "0 matches" for pages that clearly
// exist, e.g. /contact). (#6)
self::ensure_goals_db_initialized();
$data = wp_slimstat_db::get_goal_results($step);
wp_send_json_success([
'visitors' => (int) ($data['uniques'] ?? 0),
'total' => (int) ($data['total'] ?? 0),
]);
}
/**
* Resolve the report date-picker's POSTed window into [start, end] Unix
* timestamps. Shared by get_filter_options() and ensure_goals_db_initialized()
* so autosuggest, the funnel-step Test, and funnel lazy-load all read the
* same range. Falls back to the last 28 days when nothing valid is supplied.
*
* @return array{0:?int,1:?int} [start, end] timestamps (null when unresolved).
*/
private static function resolve_requested_date_range()
{
$type = sanitize_text_field(wp_unslash($_POST['time_range_type'] ?? 'last_28_days'));
$from = sanitize_text_field(wp_unslash($_POST['time_range_from'] ?? ''));
$to = sanitize_text_field(wp_unslash($_POST['time_range_to'] ?? ''));
$start = null;
$end = null;
if ('custom' === $type && '' !== $from && '' !== $to) {
$start = strtotime($from);
$end = strtotime($to . ' 23:59:59');
} else {
$range = DateRangeHelper::get_range_by_preset($type);
if ($range) {
$start = $range['start'];
$end = $range['end'];
}
}
// Fallback to last 28 days when no valid range was supplied/parsed.
if (empty($start) || empty($end)) {
$range = DateRangeHelper::get_range_by_preset('last_28_days');
if ($range) {
$start = $range['start'];
$end = $range['end'];
}
}
// Clamp the end to "now", mirroring the SSR funnel render (wp-slimstat-db.php:852):
// presets return "today 23:59:59" (a future time), so without this the active
// (SSR) funnel queries [start..now] while an AJAX-loaded twin queries
// [start..23:59:59]. That gives different counts AND different cache-key hour
// buckets, so two identical funnels disagree. Clamping makes every goals/funnels
// AJAX window end at the same "now" as the SSR render. A custom past range is
// unaffected (its end is already < now). (#1)
$now = (int) date_i18n('U');
return [$start ? (int) $start : null, $end ? min((int) $end, $now) : null];
}
/**
* Hydrate wp_slimstat_db for the goals/funnels Test + lazy-load AJAX actions.
*
* These actions are NOT covered by the admin bootstrap that normally calls
* wp_slimstat_db::init() (only slimview pages + slimstat_load_report are —
* see the $is_slimstat_ajax guard). Without init(), $columns_names and
* $filters_normalized['utime'] stay empty, so get_combined_where() builds
* `dt BETWEEN 0 AND 0` (matching nothing) and emits undefined-array-key
* notices. We init() to populate columns + defaults, then pin the date
* window to the report's selected range (mirrors get_filter_options). (#6/#8)
*/
private static function ensure_goals_db_initialized()
{
if (!class_exists('wp_slimstat_db')) {
include_once plugin_dir_path(__FILE__) . 'view/wp-slimstat-db.php';
}
// Prefer the exact window the server-rendered funnel already used, posted back
// as gf_utime_start/end. Reusing it verbatim makes the AJAX funnel/Test query
// the IDENTICAL [start,end] (and funnel cache key) as the SSR render, so two
// identical funnels share one result instead of re-resolving the preset in the
// site timezone while the SSR path used legacy UTC day boundaries. (#1)
$pinned_start = isset($_POST['gf_utime_start']) ? (int) $_POST['gf_utime_start'] : 0;
$pinned_end = isset($_POST['gf_utime_end']) ? (int) $_POST['gf_utime_end'] : 0;
if ($pinned_start > 0 && $pinned_end > 0) {
$start = $pinned_start;
$end = $pinned_end;
} else {
list($start, $end) = self::resolve_requested_date_range();
}
// init() populates $columns_names/$operator_names plus a default
// $filters_normalized; then pin utime to the requested range.
wp_slimstat_db::init();
if (!isset(wp_slimstat_db::$filters_normalized['utime']) || !is_array(wp_slimstat_db::$filters_normalized['utime'])) {
wp_slimstat_db::$filters_normalized['utime'] = [];
}
if (!empty($start) && !empty($end)) {
wp_slimstat_db::$filters_normalized['utime']['start'] = (int) $start;
wp_slimstat_db::$filters_normalized['utime']['end'] = (int) $end;
}
}
// END: Goals & Funnels CRUD
/**
* Deletes a given pageview from the database
*/
public static function delete_pageview()
{
$my_wpdb = apply_filters('slimstat_custom_wpdb', $GLOBALS['wpdb']);
$pageview_id = intval($_POST['pageview_id']);
// Delete page view if user has enough access
$current_user_can_delete = (current_user_can(wp_slimstat::$settings['capability_can_admin']) && !is_network_admin());
if (!$current_user_can_delete || !wp_verify_nonce($_POST['security'], 'meta-box-order')) {
return;
}
$my_wpdb->query(sprintf('DELETE ts FROM %sslim_stats ts WHERE ts.id = %d', $GLOBALS['wpdb']->prefix, $pageview_id));
exit();
}
// END: delete_pageview
/**
* Deletes a given pageview from the database
*/
public static function rmdir($path)
{
if (!file_exists($path)) {
return true;
}
if (!is_dir($path)) {
return unlink($path);
}
foreach (scandir($path) as $a_item) {
if ('.' === $a_item || '..' === $a_item) {
continue;
}
if (!wp_slimstat_admin::rmdir($path . DIRECTORY_SEPARATOR . $a_item)) {
return false;
}
}
return rmdir($path);
}
// END: delete_pageview
/**
* Handles the Ajax requests to load, save or delete existing filters
*/
public static function manage_filters()
{
check_ajax_referer('meta-box-order', 'security');
// If this user is whitelisted, we use the minimum capability
$minimum_capability = 'read';
if (false === strpos(wp_slimstat::$settings['can_view'], (string) $GLOBALS['current_user']->user_login) && !empty(wp_slimstat::$settings['capability_can_view'])) {
$minimum_capability = wp_slimstat::$settings['capability_can_view'];
}
if (!current_user_can($minimum_capability)) {
return;
}
// Initialize the new Reports system FIRST before legacy system loads
\SlimStat\Reports\Bootstrap::get_instance()->init();
include_once(plugin_dir_path(__FILE__) . 'view/wp-slimstat-reports.php');
wp_slimstat_reports::init();
$saved_filters = get_option('slimstat_filters', []);
switch (sanitize_key(wp_unslash($_POST['type'] ?? ''))) {
case 'save':
$new_filter = json_decode(stripslashes_deep(sanitize_text_field($_POST['filter_array'])), true);
// Check if this filter is already saved
foreach ($saved_filters as $a_saved_filter) {
$filter_found = 0;
if (count($a_saved_filter) !== count($new_filter) || count(array_intersect_key($a_saved_filter, $new_filter)) !== count($new_filter)) {
$filter_found = 1;
continue;
}
foreach ($a_saved_filter as $a_key => $a_value) {
$filter_found += ($a_value == $new_filter[$a_key]) ? 0 : 1;
}
if (0 == $filter_found) {
echo __('Already saved', 'wp-slimstat');
break;
}
}
if (empty($saved_filters) || $filter_found > 0) {
$saved_filters[] = $new_filter;
update_option('slimstat_filters', $saved_filters);
echo __('Saved', 'wp-slimstat');
}
break;
case 'delete':
unset($saved_filters[intval($_POST['filter_id'])]);
update_option('slimstat_filters', $saved_filters);
// no break here - We want to return the new list of filters!
default:
echo '
';
break;
}
exit();
}
// END: manage_filters
/**
* Check AJAX capability for view access.
* Returns true if user has permission, sends JSON error and returns false otherwise.
*
* @since 5.4.3
* @return bool
*/
private static function check_ajax_view_capability()
{
$minimum_capability = 'read';
if (false === strpos(wp_slimstat::$settings['can_view'], (string) $GLOBALS['current_user']->user_login) && !empty(wp_slimstat::$settings['capability_can_view'])) {
$minimum_capability = wp_slimstat::$settings['capability_can_view'];
}
if (!current_user_can($minimum_capability)) {
wp_send_json_error(['message' => esc_html__('Insufficient permissions', 'wp-slimstat')], 403);
return false;
}
return true;
}
/**
* Get online visitors count (30-minute window, session-spanning).
* Shared by get_online_visitors() and get_adminbar_stats().
*
* @since 5.4.3
* @return int
*/
private static function query_online_count()
{
$wpdb = wp_slimstat::$wpdb;
$table = "{$GLOBALS['wpdb']->prefix}slim_stats";
$current_minute_start = (int) floor(wp_slimstat::now() / 60) * 60;
$window_start = $current_minute_start - (29 * 60); // 30-minute window
$count = (int) $wpdb->get_var($wpdb->prepare(
"SELECT COUNT(*) FROM (
SELECT visit_id, MAX(
CASE
WHEN dt_out IS NOT NULL AND dt_out > 0 AND dt_out >= dt THEN dt_out
ELSE dt
END
) AS last_activity
FROM {$table}
WHERE visit_id > 0
AND (dt >= %d OR (dt_out IS NOT NULL AND dt_out >= %d))
GROUP BY visit_id
HAVING (FLOOR(last_activity / 60) * 60 + 59) >= %d
) live_sessions",
$window_start, $window_start, $window_start
));
return max(0, $count);
}
/**
* AJAX handler to get current online visitors count
*/
public static function get_online_visitors()
{
check_ajax_referer('meta-box-order', 'security');
if (!self::check_ajax_view_capability()) {
return;
}
$online_visitors = self::query_online_count();
wp_send_json_success([
'count' => $online_visitors,
'formatted' => number_format_i18n($online_visitors)
]);
}
// END: get_online_visitors
/**
* AJAX handler: Returns all admin bar modal stats in a single request.
* Called every minute by adminbar-realtime.js and admin.js.
*
* @since 5.4.3
*/
public static function get_adminbar_stats()
{
check_ajax_referer('meta-box-order', 'security');
if (!self::check_ajax_view_capability()) {
return;
}
$wpdb = wp_slimstat::$wpdb;
$table = "{$GLOBALS['wpdb']->prefix}slim_stats";
$is_pro = wp_slimstat::pro_is_installed();
// --- Online count (always fresh — fast indexed query) ---
$online_count = self::query_online_count();
// --- Today stats (transient-cached, 60s TTL) ---
$blog_id = get_current_blog_id();
$transient_key = 'slimstat_adminbar_today_' . $blog_id;
$today_stats = get_transient($transient_key);
if (false === $today_stats) {
$today_start = strtotime('today', current_time('timestamp'));
$yesterday_start = $today_start - DAY_IN_SECONDS;
$yesterday_end = $today_start - 1;
$site_host = parse_url(home_url(), PHP_URL_HOST);
$referer_like = '%' . $wpdb->esc_like($site_host) . '%';
// Sessions + views: 2 queries instead of 4 using conditional aggregates
$row = $wpdb->get_row($wpdb->prepare(
"SELECT
COUNT(DISTINCT CASE WHEN dt >= %d AND visit_id > 0 THEN visit_id END) AS sessions_today,
COUNT(DISTINCT CASE WHEN dt BETWEEN %d AND %d AND visit_id > 0 THEN visit_id END) AS sessions_yesterday,
SUM(CASE WHEN dt >= %d THEN 1 ELSE 0 END) AS views_today,
SUM(CASE WHEN dt BETWEEN %d AND %d THEN 1 ELSE 0 END) AS views_yesterday
FROM {$table}
WHERE dt >= %d",
$today_start,
$yesterday_start, $yesterday_end,
$today_start,
$yesterday_start, $yesterday_end,
$yesterday_start
));
// Referrals: 1 query with conditional aggregates
$ref_row = $wpdb->get_row($wpdb->prepare(
"SELECT
SUM(CASE WHEN dt >= %d THEN 1 ELSE 0 END) AS referrals_today,
SUM(CASE WHEN dt BETWEEN %d AND %d THEN 1 ELSE 0 END) AS referrals_yesterday
FROM {$table}
WHERE dt >= %d AND referer IS NOT NULL AND referer NOT LIKE %s",
$today_start,
$yesterday_start, $yesterday_end,
$yesterday_start,
$referer_like
));
$today_stats = [
'sessions' => (int) ($row->sessions_today ?? 0),
'sessions_yesterday' => (int) ($row->sessions_yesterday ?? 0),
'views' => (int) ($row->views_today ?? 0),
'views_yesterday' => (int) ($row->views_yesterday ?? 0),
'referrals' => (int) ($ref_row->referrals_today ?? 0),
'referrals_yesterday' => (int) ($ref_row->referrals_yesterday ?? 0),
];
$ttl = max(60 - (current_time('timestamp') % 60), 1); // align to next minute boundary
set_transient($transient_key, $today_stats, $ttl);
}
// --- Chart data (uses LiveAnalyticsReport's own 60s transient) ---
$chart_data = null;
if ($is_pro) {
try {
$live_report = new \SlimStat\Reports\Types\Analytics\LiveAnalyticsReport();
$chart_result = $live_report->get_users_chart_data();
$chart_data = [
'data' => $chart_result['data'],
'max_value' => $chart_result['max_value'],
'peak_index' => $chart_result['peak_index'],
];
} catch (\Exception $e) {
// Graceful degradation — return stats without chart data
$chart_data = null;
}
}
// --- Build response ---
$response = [
'online' => [
'count' => $online_count,
'formatted' => number_format_i18n($online_count),
],
'sessions' => [
'count' => $today_stats['sessions'],
'formatted' => number_format_i18n($today_stats['sessions']),
'yesterday' => number_format_i18n($today_stats['sessions_yesterday']),
],
'is_pro' => $is_pro,
];
if ($is_pro) {
$response['views'] = [
'count' => $today_stats['views'],
'formatted' => number_format_i18n($today_stats['views']),
'yesterday' => number_format_i18n($today_stats['views_yesterday']),
];
$response['referrals'] = [
'count' => $today_stats['referrals'],
'formatted' => number_format_i18n($today_stats['referrals']),
'yesterday' => number_format_i18n($today_stats['referrals_yesterday']),
];
$response['chart'] = $chart_data;
}
wp_send_json_success($response);
}
// END: get_adminbar_stats
/**
* Helper function to get icon URL for filter options
*/
private static function get_filter_icon_url($dimension, $value)
{
$icon_url = '';
switch ($dimension) {
case 'country':
// Country flags are SVG files named by country code (lowercase)
$country_code = strtolower($value);
$flag_rel = '/admin/assets/images/flags/' . $country_code . '.svg';
$flag_path = SLIMSTAT_ANALYTICS_DIR . $flag_rel;
if (is_readable($flag_path)) {
$icon_url = SLIMSTAT_ANALYTICS_URL . $flag_rel;
}
break;
case 'browser':
// Browser icons are PNG files named by browser name (lowercase)
$browser_name = strtolower($value);
$browser_rel = '/admin/assets/images/browsers/' . $browser_name . '.png';
$browser_path = SLIMSTAT_ANALYTICS_DIR . $browser_rel;
if (is_readable($browser_path)) {
$icon_url = SLIMSTAT_ANALYTICS_URL . $browser_rel;
}
break;
case 'language':
// Language flags use the last part of the language code (e.g., en-US -> us)
$language_parts = explode('-', $value);
$last_part = strtolower(end($language_parts));
$flag_rel = '/admin/assets/images/flags/' . $last_part . '.svg';
$flag_path = SLIMSTAT_ANALYTICS_DIR . $flag_rel;
if (is_readable($flag_path)) {
$icon_url = SLIMSTAT_ANALYTICS_URL . $flag_rel;
}
break;
case 'platform':
// Platform/OS icons are WEBP files with abbreviated names
$os_map = [
'win' => 'win',
'windows' => 'win',
'mac' => 'mac',
'macosx' => 'mac',
'linux' => 'lin',
'ubuntu' => 'ubu',
'android' => 'and',
'ios' => 'ios',
'chrome os' => 'chr',
'chromeos' => 'chr',
];
$os_lower = strtolower($value);
$os_icon = null;
// Check if exact match exists in map
if (isset($os_map[$os_lower])) {
$os_icon = $os_map[$os_lower];
} else {
// Check if value contains any of the keys
foreach ($os_map as $key => $icon) {
if (strpos($os_lower, $key) !== false) {
$os_icon = $icon;
break;
}
}
}
if ($os_icon) {
$os_rel = '/admin/assets/images/os/' . $os_icon . '.webp';
$os_path = SLIMSTAT_ANALYTICS_DIR . $os_rel;
if (is_readable($os_path)) {
$icon_url = SLIMSTAT_ANALYTICS_URL . $os_rel;
}
}
break;
case 'username':
// For users, we'll use WordPress gravatar
// This will be handled separately in the JavaScript
break;
}
return $icon_url;
}
/**
* AJAX handler to get distinct filter options for a selected dimension
*/
public static function get_filter_options()
{
check_ajax_referer('meta-box-order', 'security');
// If this user is whitelisted, we use the minimum capability
$minimum_capability = 'read';
if (false === strpos(wp_slimstat::$settings['can_view'], (string) $GLOBALS['current_user']->user_login) && !empty(wp_slimstat::$settings['capability_can_view'])) {
$minimum_capability = wp_slimstat::$settings['capability_can_view'];
}
if (!current_user_can($minimum_capability)) {
wp_send_json_error('Insufficient permissions');
return;
}
$dimension = sanitize_text_field($_POST['dimension'] ?? '');
// Validate dimension exists in columns_names
include_once(plugin_dir_path(__FILE__) . 'view/wp-slimstat-db.php');
// We only need the columns_names array, not the full init with filters
if (empty(wp_slimstat_db::$columns_names)) {
wp_slimstat_db::$columns_names = [
'id' => ['ID', 'number'],
'ip' => ['IP', 'varchar'],
'other_ip' => ['Other IP', 'varchar'],
'username' => ['Username', 'varchar'],
'email' => ['Email', 'varchar'],
'country' => ['Country', 'varchar'],
'location' => ['Location', 'varchar'],
'city' => ['City', 'varchar'],
'referer' => ['Referer', 'varchar'],
'resource' => ['Resource', 'varchar'],
'searchterms' => ['Search Terms', 'varchar'],
'notes' => ['Notes', 'varchar'],
'visit_id' => ['Visit ID', 'number'],
'server_latency' => ['Server Latency', 'number'],
'page_performance' => ['Page Performance', 'number'],
'browser' => ['Browser', 'varchar'],
'browser_version' => ['Browser Version', 'varchar'],
'browser_type' => ['Browser Type', 'number'],
'platform' => ['Platform', 'varchar'],
'language' => ['Language', 'varchar'],
'fingerprint' => ['Fingerprint', 'varchar'],
'user_agent' => ['User Agent', 'varchar'],
'resolution' => ['Resolution', 'varchar'],
'screen_width' => ['Screen Width', 'number'],
'screen_height' => ['Screen Height', 'number'],
'content_type' => ['Content Type', 'varchar'],
'category' => ['Category', 'varchar'],
'author' => ['Author', 'varchar'],
'content_id' => ['Content ID', 'number'],
'outbound_resource' => ['Outbound Resource', 'varchar'],
'tz_offset' => ['Timezone Offset', 'number'],
'dt_out' => ['Date Time Out', 'number'],
'dt' => ['Date Time', 'number'],
];
}
if (empty($dimension) || !isset(wp_slimstat_db::$columns_names[$dimension])) {
wp_send_json_error('Invalid dimension');
return;
}
// Resolve the report date picker's window (shared with the goals/funnels
// AJAX handlers so autosuggest, Test, and lazy-load all read one range).
list($time_start, $time_end) = self::resolve_requested_date_range();
// Get distinct values for this dimension via SlimStat\Utils\Query abstraction
$table_name = $GLOBALS['wpdb']->prefix . 'slim_stats';
// Limit results to prevent overwhelming the dropdown (filterable for customization)
$limit = apply_filters('slimstat_filter_options_limit', 500, $dimension);
$limit = absint($limit); // Ensure it's a positive integer
// Enforce reasonable bounds to prevent abuse
if ($limit < 1 || $limit > 5000) {
$limit = 500; // Reset to default if out of reasonable range
}
// Sanitize column name to prevent SQL injection (only allow known columns)
$allowed_columns = array_keys(wp_slimstat_db::$columns_names);
if (!in_array($dimension, $allowed_columns, true)) {
wp_send_json_error('Invalid column');
return;
}
// Additional sanitization layer for column name (defense in depth)
$safe_dimension = esc_sql($dimension);
// Get distinct non-empty values
$column_type = wp_slimstat_db::$columns_names[$dimension][1];
// Optional server-side search (layer 2 of #298). Only applies to varchar
// columns — searching numeric dimensions falls back to the legacy DISTINCT.
$search_raw = $_POST['search'] ?? '';
$search = '';
if (is_string($search_raw)) {
$search = trim(sanitize_text_field($search_raw));
if (strlen($search) < 2 || strlen($search) > 64) {
$search = '';
}
}
if ($column_type !== 'varchar') {
$search = '';
}
// Cache lookup (layer 3 of #298). Key must account for anything that
// changes the result set: blog, DB host (External DB addon), capability
// gate, dimension, hour-bucketed time range, effective limit, and search.
$cache_key = self::build_filter_options_cache_key(
$dimension,
$time_start,
$time_end,
$search,
$limit
);
$cached = self::filter_options_cache_get($cache_key);
if (is_array($cached)) {
wp_send_json_success($cached);
exit();
}
// Build SQL query directly to avoid Query class interference with global filters
$where_clauses = [];
// Apply time range filter
if (!empty($time_start) && !empty($time_end)) {
$where_clauses[] = $GLOBALS['wpdb']->prepare('dt BETWEEN %d AND %d', intval($time_start), intval($time_end));
}
if ($column_type === 'varchar') {
// Exclude NULLs and empty strings for varchar columns
$where_clauses[] = $safe_dimension . ' IS NOT NULL';
$where_clauses[] = $safe_dimension . " <> ''";
} else {
// Exclude NULLs and zeros for numeric columns
$where_clauses[] = $safe_dimension . ' IS NOT NULL';
$where_clauses[] = $safe_dimension . ' <> 0';
}
// Append LIKE filter when a server-side search term was supplied.
if ($search !== '') {
$like_pattern = self::build_filter_search_like($dimension, $search);
$where_clauses[] = wp_slimstat::$wpdb->prepare($safe_dimension . ' LIKE %s', $like_pattern);
}
$where_sql = !empty($where_clauses) ? 'WHERE ' . implode(' AND ', $where_clauses) : '';
// Rank matches by relevance (exact, then prefix, then contains) so the LIMIT
// keeps and orders the values the user actually typed first. (#21)
$order_sql = self::build_filter_search_order($safe_dimension, $search);
$sql = sprintf(
'SELECT DISTINCT %s as value FROM %s %s ORDER BY %s LIMIT %d',
$safe_dimension,
$table_name,
$where_sql,
$order_sql,
$limit
);
// Execute query — use wp_slimstat::$wpdb so External DB addon
// queries the correct database.
$results = wp_slimstat::$wpdb->get_results($sql, ARRAY_A);
// Check for database errors
if (wp_slimstat::$wpdb->last_error) {
wp_send_json_error('Database query failed');
return;
}
// Ensure results is an array
if (!is_array($results)) {
$results = [];
}
// Split multi-value columns into individual values.
// These columns store multiple entries in a single DB field:
// outbound_resource: "url1;;;url2;;;url3"
// notes: "[tag1][tag2][tag3]"
// category: "1,5,12"
$multi_value_separators = [
'outbound_resource' => ';;;',
'category' => ',',
];
if (isset($multi_value_separators[$dimension])) {
$separator = $multi_value_separators[$dimension];
$expanded = [];
foreach ($results as $row) {
if (empty($row['value'])) continue;
foreach (explode($separator, $row['value']) as $val) {
$val = trim($val);
if ($val !== '') $expanded[] = ['value' => $val];
}
}
$results = $expanded;
} elseif ($dimension === 'notes') {
$expanded = [];
foreach ($results as $row) {
if (empty($row['value'])) continue;
preg_match_all('/\[([^\]]+)\]/', $row['value'], $matches);
foreach ($matches[1] as $val) {
$val = trim($val);
if ($val !== '') $expanded[] = ['value' => $val];
}
}
$results = $expanded;
}
// After splitting multi-value rows, re-filter split segments by the
// server-side search term so the caller gets only matching segments,
// not every segment from rows where any sibling matched.
if ($search !== '' && (isset($multi_value_separators[$dimension]) || $dimension === 'notes')) {
$has_mb = function_exists('mb_strtolower');
$needle = $has_mb ? mb_strtolower($search) : strtolower($search);
$is_substring = self::filter_search_is_substring($dimension);
$results = array_values(array_filter($results, function ($row) use ($needle, $is_substring, $has_mb) {
$haystack = $has_mb ? mb_strtolower($row['value']) : strtolower($row['value']);
return $is_substring ? (strpos($haystack, $needle) !== false) : (strpos($haystack, $needle) === 0);
}));
}
// Cap expanded results to prevent explosion from splitting
if (count($results) > $limit) {
$results = array_slice($results, 0, $limit);
}
$options = [];
$seen_values = []; // Track values to prevent duplicates (case-insensitive)
$dimensions_with_icons = ['country', 'browser', 'language', 'platform', 'username'];
$has_icons = in_array($dimension, $dimensions_with_icons, true);
foreach ($results as $row) {
if (!empty($row['value'])) {
// Sanitize output to prevent XSS
$sanitized_value = sanitize_text_field($row['value']);
// Trim whitespace
$sanitized_value = trim($sanitized_value);
// Skip empty values after trimming
if (empty($sanitized_value)) {
continue;
}
// Check for duplicates using case-insensitive comparison
$value_key = strtolower($sanitized_value);
if (isset($seen_values[$value_key])) {
continue; // Skip duplicate
}
// Mark this value as seen
$seen_values[$value_key] = true;
// Limit individual option length to prevent DOM issues
if (strlen($sanitized_value) > 255) {
$sanitized_value = substr($sanitized_value, 0, 255) . '...';
}
if ($has_icons) {
// Return object with value and icon
$icon_url = self::get_filter_icon_url($dimension, $sanitized_value);
// For username, get user gravatar
if ($dimension === 'username' && empty($icon_url)) {
$user = get_user_by('login', $sanitized_value);
if ($user) {
$icon_url = get_avatar_url($user->ID, ['size' => 32]);
} else {
$icon_url = get_avatar_url($sanitized_value, ['size' => 32]);
}
}
$options[] = [
'value' => $sanitized_value,
'label' => $sanitized_value,
'icon' => $icon_url
];
} else {
// Return simple string for backward compatibility
$options[] = $sanitized_value;
}
}
}
self::filter_options_cache_set(
$cache_key,
$options,
self::filter_options_cache_ttl($time_end)
);
wp_send_json_success($options);
exit();
}
/**
* Whether the server-side filter search uses an unanchored (%needle%) LIKE for
* this dimension instead of the default left-anchored prefix (needle%). Single
* source of truth for the search-anchor decision (#298), shared by the SQL LIKE
* builder and the post-split segment re-filter.
*/
private static function filter_search_is_substring(string $dimension): bool
{
return in_array($dimension, self::FILTER_SEARCH_SUBSTRING_DIMENSIONS, true);
}
/**
* Build the escaped, anchored LIKE pattern for a server-side filter search (#298).
* The needle is run through wpdb::esc_like so SQL LIKE metacharacters (% _) are
* matched literally; the caller still passes the result through wpdb::prepare.
*/
private static function build_filter_search_like(string $dimension, string $search): string
{
$escaped = wp_slimstat::$wpdb->esc_like($search);
return self::filter_search_is_substring($dimension) ? '%' . $escaped . '%' : $escaped . '%';
}
/**
* Build the ORDER BY expression for a server-side filter search so matches rank
* by relevance: exact first, then left-anchored prefix, then any other (substring)
* match, alphabetical within each tier. Without this, ORDER BY column-only +
* LIMIT could truncate or bury the exact/prefix values a user typed behind
* incidental contains-matches (e.g. "/pricing" surfacing unrelated paths instead
* of /pricing, /pricing/, /pricing?utm…). The column name is already validated
* against the allowed-columns whitelist by the caller; the term is bound via
* prepare(). (#21)
*/
private static function build_filter_search_order(string $safe_dimension, string $search): string
{
if ('' === $search) {
return $safe_dimension . ' ASC';
}
$prefix_like = wp_slimstat::$wpdb->esc_like($search) . '%';
return wp_slimstat::$wpdb->prepare(
'CASE WHEN ' . $safe_dimension . ' = %s THEN 0 WHEN ' . $safe_dimension . ' LIKE %s THEN 1 ELSE 2 END, ' . $safe_dimension . ' ASC',
$search,
$prefix_like
);
}
/**
* Composite cache key for get_filter_options(). Must include every variable
* that changes the result set: blog (multisite), DB host (External DB addon
* can point to another DB), capability gate (per-role visibility), dimension,
* hour-bucketed time range (increases hit rate for rolling windows), the
* effective limit (respects third-party `slimstat_filter_options_limit`
* consumers), and the search term.
*/
private static function build_filter_options_cache_key(
string $dimension,
?int $time_start,
?int $time_end,
string $search,
int $limit
): string {
$blog_id = function_exists('get_current_blog_id') ? (int) get_current_blog_id() : 0;
$dbhost = '';
if (isset(wp_slimstat::$wpdb) && is_object(wp_slimstat::$wpdb) && isset(wp_slimstat::$wpdb->dbhost)) {
$dbhost = (string) wp_slimstat::$wpdb->dbhost;
}
$dbhost_hash = substr(md5($dbhost), 0, 8);
$can_view = (string) (wp_slimstat::$settings['can_view'] ?? '');
$capability = (string) (wp_slimstat::$settings['capability_can_view'] ?? '');
$capability_hash = substr(md5($capability . '|' . $can_view), 0, 8);
$ts_start_bucket = $time_start ? (int) floor((int) $time_start / 3600) : 0;
$ts_end_bucket = $time_end ? (int) floor((int) $time_end / 3600) : 0;
$search_hash = $search === '' ? '' : substr(md5($search), 0, 8);
return sprintf(
'fopts_%d_%s_%s_%s_%d_%d_%d_%s',
$blog_id,
$dbhost_hash,
$capability_hash,
$dimension,
$ts_start_bucket,
$ts_end_bucket,
$limit,
$search_hash
);
}
private static function filter_options_cache_ttl(?int $time_end): int
{
// Historical data (range ends > 1h ago) never changes — cache it longer.
if ($time_end && (int) $time_end < (time() - 3600)) {
return 3600;
}
return 300;
}
private static function filter_options_cache_get(string $key)
{
if (function_exists('wp_using_ext_object_cache') && wp_using_ext_object_cache()) {
$found = false;
$data = wp_cache_get($key, 'slimstat_filter_options', false, $found);
return $found ? $data : null;
}
$data = get_transient('slimstat_' . $key);
return $data === false ? null : $data;
}
private static function filter_options_cache_set(string $key, $data, int $ttl): void
{
if (function_exists('wp_using_ext_object_cache') && wp_using_ext_object_cache()) {
wp_cache_set($key, $data, 'slimstat_filter_options', $ttl);
return;
}
set_transient('slimstat_' . $key, $data, $ttl);
}
// END: get_filter_options
public static function update_geoip_database()
{
check_ajax_referer('slimstat_geoip_action', 'security');
if (!current_user_can(\wp_slimstat::$settings['capability_can_admin'])) {
wp_send_json_error(__('Permission denied', 'wp-slimstat'));
return;
}
try {
$provider = \wp_slimstat::resolve_geolocation_provider();
if (false === $provider) {
wp_send_json_error(__('Geolocation is disabled.', 'wp-slimstat'));
return;
}
if ('cloudflare' === $provider) {
update_option('slimstat_last_geoip_dl', time());
wp_send_json_success(__('Cloudflare geolocation does not require a database.', 'wp-slimstat'));
return;
}
// License validation is handled by the MaxMind provider; do not pre-check here
$service = new \SlimStat\Services\Geolocation\GeolocationService($provider, []);
$ok = $service->updateDatabase();
if ($ok) {
update_option('slimstat_last_geoip_dl', time());
wp_send_json_success(__('GeoIP Database Successfully Updated!', 'wp-slimstat'));
} else {
// Log the error for debugging
$error_message = __('Failed to update GeoIP Database.', 'wp-slimstat');
if ('maxmind' === $provider) {
$error_message .= ' ' . __('Please check your MaxMind license key and try again.', 'wp-slimstat');
}
$geoip_error = get_option('slimstat_geoip_error', []);
if (!empty($geoip_error) && !empty($geoip_error['error'])) {
$error_message .= ' ' . sprintf(__('Details: %s', 'wp-slimstat'), $geoip_error['error']);
}
wp_send_json_error($error_message);
}
} catch (\Throwable $exception) {
\wp_slimstat::log('GeoIP update AJAX error: ' . $exception->getMessage() . ' in ' . $exception->getFile() . ':' . $exception->getLine(), 'error');
wp_send_json_error(__('An unexpected error occurred while updating the GeoIP database.', 'wp-slimstat'));
}
}
public static function check_geoip_database()
{
check_ajax_referer('slimstat_geoip_action', 'security');
if (!current_user_can(\wp_slimstat::$settings['capability_can_admin'])) {
wp_send_json_error(__('Permission denied', 'wp-slimstat'));
return;
}
try {
$provider = \wp_slimstat::resolve_geolocation_provider();
if (false === $provider) {
wp_send_json_error(__('Geolocation is disabled.', 'wp-slimstat'));
return;
}
if ('cloudflare' === $provider) {
wp_send_json_success(__('Cloudflare geolocation is active. No database to check.', 'wp-slimstat'));
return;
}
$service = new \SlimStat\Services\Geolocation\GeolocationService($provider, []);
$exists = file_exists($service->getProvider()->getDbPath());
$result = [ 'notice' => $exists ? __('GeoIP Database is present and ready.', 'wp-slimstat') : __('GeoIP Database not found.', 'wp-slimstat') ];
wp_send_json_success($result['notice']);
} catch (\Throwable $exception) {
\wp_slimstat::log('GeoIP check AJAX error: ' . $exception->getMessage() . ' in ' . $exception->getFile() . ':' . $exception->getLine(), 'error');
wp_send_json_error(__('An unexpected error occurred while checking the GeoIP database.', 'wp-slimstat'));
}
}
/**
* Contextual help
*/
public static function contextual_help()
{
$screen = get_current_screen();
$screen->add_help_tab(
[
'id' => 'wp-slimstat-definitions',
'title' => __('Definitions', 'wp-slimstat'),
'content' => '
' . __('Pageview', 'wp-slimstat') . ': ' . __('A request to load a single HTML file ("page"). This should be contrasted with a "hit", which refers to a request for any file from a web server. Slimstat logs a pageview each time the tracking code is executed', 'wp-slimstat') . '
' . __('(Human) Visit', 'wp-slimstat') . ': ' . __("A period of interaction between a visitor's browser and your website, ending when the browser is closed or when the user has been inactive on that site for 30 minutes", 'wp-slimstat') . '
' . __('Known Visitor', 'wp-slimstat') . ': ' . __('Any user who has left a comment on your blog, and is thus identified by WordPress as a returning visitor', 'wp-slimstat') . '
' . __('Unique IP', 'wp-slimstat') . ': ' . __('Used to differentiate between multiple requests to download a file from one internet address (IP) and requests originating from many distinct addresses; since this measurement looks only at the internet address a pageview came from, it is useful, but not perfect', 'wp-slimstat') . '
' . __('Originating IP', 'wp-slimstat') . ': ' . __('the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer', 'wp-slimstat') . '
' . __('Direct Traffic', 'wp-slimstat') . ': ' . __('All those people showing up to your Web site by typing in the URL of your Web site coming or from a bookmark; some people also call this "default traffic" or "ambient traffic"', 'wp-slimstat') . '
' . __('Search Engine', 'wp-slimstat') . ': ' . __('Google, Yahoo, MSN, Ask, others; this bucket will include both your organic as well as your paid (PPC/SEM) traffic, so be aware of that', 'wp-slimstat') . '
' . __('Search Terms', 'wp-slimstat') . ': ' . __('Keywords used by your visitors to find your website on a search engine', 'wp-slimstat') . '
' . __('SERP', 'wp-slimstat') . ': ' . __('Short for search engine results page, the Web page that a search engine returns with the results of its search. The value shown represents your rank (or position) within that list of results', 'wp-slimstat') . '
' . __('User Agent', 'wp-slimstat') . ': ' . __('Any program used for accessing a website; this includes browsers, robots, spiders and any other program that was used to retrieve information from the site', 'wp-slimstat') . '
' . __('Outbound Link', 'wp-slimstat') . ': ' . __('A link from one domain to another is said to be outbound from its source anchor and inbound to its target. This report lists all the links to other websites followed by your visitors.', 'wp-slimstat') . '
' . __('IP', 'wp-slimstat') . ': ' . __("Visitor's public IP address", 'wp-slimstat') . '
' . __('Search Terms', 'wp-slimstat') . ': ' . __('Keywords used by your visitors to find your website on a search engine', 'wp-slimstat') . '
' . __('Language Code', 'wp-slimstat') . ': ' . __('Please refer to this language culture page (first column) for more information', 'wp-slimstat') . '
' . __('Operating System', 'wp-slimstat') . ': ' . __('Accepts identifiers like win7, win98, macosx, ...; please refer to this manual page for more information', 'wp-slimstat') . '
' . __('Permalink', 'wp-slimstat') . ': ' . __('URL accessed on your site', 'wp-slimstat') . '
' . __('Referer', 'wp-slimstat') . ': ' . __('Complete address of the referrer page', 'wp-slimstat') . '
' . __("Visitor's Name", 'wp-slimstat') . ': ' . __("Visitors' names according to the cookie set by WordPress after they leave a comment", 'wp-slimstat') . '
' . __('Pageview Attributes', 'wp-slimstat') . ': ' . __('this field is set to [pre] if the resource has been accessed through Link Prefetching or similar techniques', 'wp-slimstat') . '
' . __('Post Author', 'wp-slimstat') . ': ' . __('author associated to that post/page when the resource was accessed', 'wp-slimstat') . '
' . __('Post Category ID', 'wp-slimstat') . ': ' . __('ID of the category/term associated to the resource, when available', 'wp-slimstat') . '
' . __('Originating IP', 'wp-slimstat') . ': ' . __("visitor's originating IP address, if available", 'wp-slimstat') . '
' . __('Resource Content Type', 'wp-slimstat') . ': ' . __('post, page, cpt:custom-post-type, cpt:attachment, singular, post_type_archive, tag, taxonomy, category, date, author, archive, search, feed, home; please refer to the Conditional Tags manual page for more information', 'wp-slimstat') . '
' . __('Visit ID', 'wp-slimstat') . ': ' . __('generally used in conjunction with is not empty, identifies human visitors', 'wp-slimstat') . '
' . __('Date Filters', 'wp-slimstat') . ': ' . __('you can specify the timeframe by entering a number in the interval field; use -1 to indicate to date (i.e., day=1, month=1, year=blank, interval=-1 will set a year-to-date filter)', 'wp-slimstat') . '
' . __('SERP Position', 'wp-slimstat') . ': ' . __('set the filter to Referer contains cd=N&, where N is the position you are looking for', 'wp-slimstat') . '
',
]
);
return null;
}
// END: contextual_help
/**
* Creates a table in the database
*/
protected static function _create_table($_sql = '', $_tablename = '', $_wpdb = '')
{
$_wpdb->query($_sql);
// Let's make sure this table was actually created
foreach ($_wpdb->get_col(sprintf("SHOW TABLES LIKE '%s'", $_tablename), 0) as $a_table) {
if ($a_table == $_tablename) {
return true;
}
}
return false;
}
// END: _create_table
public static function get_template($template, $args = [], $return = false)
{
// Push Args - use EXTR_SKIP to prevent variable overwriting for security
if (is_array($args) && isset($args)) :
extract($args, EXTR_SKIP);
endif;
// Check Load single file or array list
if (is_string($template)) {
$template = explode(' ', $template);
}
// Load File
foreach ($template as $file) {
$template_file = WP_PLUGIN_DIR . sprintf('/wp-slimstat/admin/view/partials/%s.php', $file);
if (!file_exists($template_file)) {
continue;
}
if ($return) {
ob_start();
require $template_file;
return ob_get_clean();
}
// include File
include $template_file;
}
return null;
}
public static function add_lock_export_button($_header_buttons = '', $_report_id = '')
{
// If the pro is active don't show it
$pro_plugin_slug = 'wp-slimstat-pro/wp-slimstat-pro.php';
if (is_plugin_active($pro_plugin_slug)) {
return $_header_buttons;
}
// Define which reports get this new functionality
$callback_args = \wp_slimstat_reports::$reports[$_report_id]['callback_args'] ?? [];
if (empty($callback_args) || !array_key_exists('raw', $callback_args)) {
return $_header_buttons;
}
// A report may declare itself non-exportable (a bool or a presence probe).
// Don't offer an "Export" upgrade link where there's nothing to export —
// a download-styled control that only routes to pricing is bait (FN-7/FN-17).
if (array_key_exists('exportable', $callback_args)) {
$exportable = is_callable($callback_args['exportable'])
? (bool) call_user_func($callback_args['exportable'])
: (bool) $callback_args['exportable'];
if (!$exportable) {
return $_header_buttons;
}
}
$utm_medium = empty($_report_id) ? 'report-unknown' : $_report_id;
return '' . __('Export', 'wp-slimstat-pro') . ' ' . $_header_buttons;
}
/**
* Goals & Funnels: surface the usage pill + CTA inside the postbox header
* (left of the refresh / lock-export icons), and the subtitle directly under
* the
. Card partials no longer render this chrome themselves.
*/
public static function register_goals_funnels_header_hooks(): void
{
add_filter('slimstat_report_header_buttons', [self::class, 'inject_goals_funnels_header_actions'], 20, 2);
add_filter('slimstat_report_header_after_title', [self::class, 'inject_goals_funnels_header_subtitle'], 10, 2);
}
/**
* Prepends the Goals/Funnels usage pill + "+ Add" CTA into the
* .slimstat-header-buttons container so they sit on the LEFT side.
* Empty for the Free locked Funnels branch (render helper returns '').
*/
public static function inject_goals_funnels_header_actions($_header_buttons = '', $_report_id = '')
{
if ('slim_p9_01' === $_report_id) {
$actions = \wp_slimstat_reports::render_goals_card_actions();
return $actions . $_header_buttons;
}
if ('slim_p9_02' === $_report_id) {
$actions = \wp_slimstat_reports::render_funnels_card_actions();
return $actions . $_header_buttons;
}
return $_header_buttons;
}
/**
* Renders the Goals/Funnels card subtitle directly under the postbox
.
* Strings match the previous in-card markup so existing translations carry over.
*/
public static function inject_goals_funnels_header_subtitle($_html = '', $_report_id = '')
{
if ('slim_p9_01' === $_report_id) {
return '
' . esc_html__('A Goal is one question you ask of your traffic.', 'wp-slimstat') . '
';
}
if ('slim_p9_02' === $_report_id) {
return '
' . esc_html__('String 2 to 5 steps into a journey. A funnel shows the conversion rate and exact drop-off at each stage.', 'wp-slimstat') . '
';
}
return $_html;
}
public static function add_header()
{
if (isset($_GET['page']) && ('slimlayout' === $_GET['page'] || 'slimconfig' === $_GET['page'])) {
return self::get_template('header', ['is_pro' => wp_slimstat::pro_is_installed()]);
}
return null;
}
/**
* Index definitions for all AJAX-managed database indexes.
* Each entry maps an AJAX action (nonce) to its index metadata.
*/
private static function get_index_definitions(): array
{
$prefix = $GLOBALS['wpdb']->prefix;
return [
'slimstat_add_country_dt_index' => [
'name' => 'idx_country_dt',
'columns' => 'country, dt',
'option' => 'slimstat_country_dt_indexed',
],
'slimstat_add_dt_screen_index' => [
'name' => 'idx_dt_screen_width_screen_height',
'columns' => 'dt, screen_width, screen_height',
'option' => 'slimstat_dt_screen_indexed',
],
'slimstat_add_dt_browser_index' => [
'name' => 'idx_dt_browser_browser_version',
'columns' => 'dt, browser, browser_version',
'option' => 'slimstat_dt_browser_indexed',
],
'slimstat_add_dt_platform_index' => [
'name' => 'idx_dt_platform',
'columns' => 'dt, platform',
'option' => 'slimstat_dt_platform_indexed',
],
'slimstat_add_dt_out_index' => [
'name' => 'idx_dt_out',
'columns' => 'dt_out',
'option' => 'slimstat_dt_out_indexed',
],
'slimstat_add_dt_visit_index' => [
'name' => $prefix . 'stats_dt_visit_idx',
'columns' => 'dt, visit_id',
'option' => 'slimstat_dt_visit_indexed',
],
];
}
/**
* Generic AJAX handler for ensuring a database index exists.
*/
private static function ajax_ensure_index(string $nonce, string $index_name, string $columns, string $option_key): void
{
check_ajax_referer($nonce);
if (!current_user_can('manage_options')) {
wp_send_json_error(__('Insufficient permissions.', 'wp-slimstat'));
}
$wpdb = wp_slimstat::$wpdb;
$table = $GLOBALS['wpdb']->prefix . 'slim_stats';
$exists = $wpdb->get_results(sprintf("SHOW INDEX FROM %s WHERE Key_name = '%s'", $table, $index_name));
if (!empty($exists)) {
update_option($option_key, 'yes');
wp_send_json_success(__('Index already exists.', 'wp-slimstat'));
}
$result = $wpdb->query(sprintf('CREATE INDEX %s ON %s (%s)', $index_name, $table, $columns));
if (false !== $result) {
update_option($option_key, 'yes');
wp_send_json_success(__('Index added successfully.', 'wp-slimstat'));
}
wp_send_json_error(__('Unable to add index.', 'wp-slimstat'));
}
/**
* Register AJAX hooks for all index management actions.
*/
public static function register_index_hooks(): void
{
foreach (self::get_index_definitions() as $action => $def) {
add_action('wp_ajax_' . $action, function () use ($action, $def) {
self::ajax_ensure_index($action, $def['name'], $def['columns'], $def['option']);
});
}
}
public static function show_indexes_notice()
{
// If new migration system is active, suppress legacy performance notice
if (class_exists(\SlimStat\Migration\Admin\MigrationAdmin::class)) {
return;
}
if (!current_user_can('manage_options')) {
return;
}
$indexes = [
[
'option' => 'slimstat_dt_out_indexed',
'id' => 'dt-out',
'label' => __('Currently Online Reports', 'wp-slimstat'),
'desc' => __('Index on dt_out', 'wp-slimstat'),
'key' => 'idx_dt_out',
'ajax' => 'slimstat_add_dt_out_index',
'btn' => __('Apply', 'wp-slimstat'),
],
[
'option' => 'slimstat_country_dt_indexed',
'id' => 'country-dt',
'label' => __('World Map & Country Reports', 'wp-slimstat'),
'desc' => __('Index on country and dt', 'wp-slimstat'),
'key' => 'idx_country_dt',
'ajax' => 'slimstat_add_country_dt_index',
'btn' => __('Apply', 'wp-slimstat'),
],
[
'option' => 'slimstat_dt_screen_indexed',
'id' => 'dt-screen',
'label' => __('Screen Resolution Reports', 'wp-slimstat'),
'desc' => __('Index on dt, screen_width, screen_height', 'wp-slimstat'),
'key' => 'idx_dt_screen_width_screen_height',
'ajax' => 'slimstat_add_dt_screen_index',
'btn' => __('Apply', 'wp-slimstat'),
],
[
'option' => 'slimstat_dt_browser_indexed',
'id' => 'dt-browser',
'label' => __('Browser Reports', 'wp-slimstat'),
'desc' => __('Index on dt, browser, browser_version', 'wp-slimstat'),
'key' => 'idx_dt_browser_browser_version',
'ajax' => 'slimstat_add_dt_browser_index',
'btn' => __('Apply', 'wp-slimstat'),
],
[
'option' => 'slimstat_dt_platform_indexed',
'id' => 'dt-platform',
'label' => __('Platform Reports', 'wp-slimstat'),
'desc' => __('Index on dt, platform', 'wp-slimstat'),
'key' => 'idx_dt_platform',
'ajax' => 'slimstat_add_dt_platform_index',
'btn' => __('Apply', 'wp-slimstat'),
],
[
'option' => 'slimstat_dt_visit_indexed',
'id' => 'dt-visit',
'label' => __('Visitor Counter Performance', 'wp-slimstat'),
'desc' => __('Index on dt, visit_id', 'wp-slimstat'),
'key' => $GLOBALS['wpdb']->prefix . 'stats_dt_visit_idx',
'ajax' => 'slimstat_add_dt_visit_index',
'btn' => __('Apply', 'wp-slimstat'),
],
];
$pending = array_filter($indexes, function ($idx) {
$db = wp_slimstat::$wpdb;
$exists = $db->get_results(sprintf("SHOW INDEX FROM %sslim_stats WHERE Key_name = '%s'", $GLOBALS['wpdb']->prefix, $idx['key']));
return empty($exists);
});
if ([] === $pending) {
return;
}
$ajax_url = admin_url('admin-ajax.php');
// Generate nonces for each AJAX action
$nonces = [];
foreach ($pending as $idx) {
$nonces[$idx['ajax']] = wp_create_nonce($idx['ajax']);
}
echo '
' . __('To speed up SlimStat reports, please apply the following database optimizations. These changes are safe and will not affect your data.', 'wp-slimstat') . '
';
echo '
';
foreach ($pending as $idx) {
echo '
'
. '
'
. '
' . $idx['label'] . '
'
. '
' . $idx['desc'] . '
'
. '
'
. ''
. ''
. ''
. ''
. '
';
}
echo '
';
echo '
'
. ''
. '
';
echo '';
echo '
' . __('Do not close this tab until all optimizations are complete.', 'wp-slimstat') . '