/models files security audit and fixes

.agent/skills/core-development-skill/SKILL.md → .agents/skills/core-development-skill/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: core-development-skill
+description: This skill governs all development, bug fixing, and feature work inside the **Tutor LMS** plugin codebase (`github.com/themeum/tutor`). It covers project structure, namespace conventions, coding patterns, PHPDoc standards, available helpers/utilities, security rules, and AI agent instructions.
+---
+
 # Tutor LMS — Core Development Skill
 
 ## Overview

.agent/skills/wpcs-security-skill/SKILL.md → .agents/skills/wpcs-security-skill/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: wpcs-security-skill
+description: Enforces strict WordPress coding standards (WPCS) and security best practices for PHP, JS, CSS, and HTML.
+---
+
 # WordPress Coding Standards & Security Skill
 
 ## Overview

models/BillingModel.php

@@ -10,7 +10,7 @@
 
 namespace Tutor\Models;
 
-use Tutor\Helpers\QueryHelper;
+use Tutor\Core\DB;
 
 /**
  * Billing model class for performing billing functionalities
@@ -77,12 +77,7 @@ public function get_required_fields() {
 	 * @return int The ID of the inserted row on success, or 0 on failure.
 	 */
 	public function insert( $data ) {
-		global $wpdb;
-
-		return QueryHelper::insert(
-			"{$wpdb->prefix}tutor_customers",
-			$data,
-		);
+		return DB::table( 'tutor_customers' )->insert( $data );
 	}
 
 	/**
@@ -94,13 +89,14 @@ public function insert( $data ) {
 	 * @return bool True on success, false on failure.
 	 */
 	public function update( $data, $where ) {
-		global $wpdb;
+		$column = '';
+		$value  = null;
+		if ( tutor_utils()->count( $where ) ) {
+			$column = array_keys( $where )[0];
+			$value  = $where[ $column ];
+		}
 
-		return QueryHelper::update(
-			"{$wpdb->prefix}tutor_customers",
-			$data,
-			$where,
-		);
+		return DB::table( 'tutor_customers' )->where( $column, $value )->update( $data );
 	}
 
 	/**
@@ -111,15 +107,7 @@ public function update( $data, $where ) {
 	 * @return object|false The billing info as an object if found, or false if not found.
 	 */
 	public function get_info( $user_id ) {
-		global $wpdb;
-
-		$billing_info = QueryHelper::get_row(
-			"{$wpdb->prefix}tutor_customers",
-			array(
-				'user_id' => $user_id,
-			),
-			'id'
-		);
+		$billing_info = DB::table( 'tutor_customers' )->where( 'user_id', $user_id )->first();
 		return $billing_info;
 	}
 

models/CourseModel.php

@@ -10,12 +10,15 @@
 
 namespace Tutor\Models;
 
+defined( 'ABSPATH' ) || exit;
+
 use Tutor\Helpers\DateTimeHelper;
 use TUTOR\Icon;
 use TUTOR\Course;
 use TUTOR\Lesson;
 use Tutor\Ecommerce\Tax;
 use InvalidArgumentException;
+use Tutor\Core\DB;
 use Tutor\Helpers\QueryHelper;
 use TUTOR\User;
 use TUTOR_ASSIGNMENTS\Assignments;
@@ -162,45 +165,21 @@
 	 * @return array|null|object
 	 */
 	public static function get_courses( $excludes = array(), $post_status = array( 'publish' ) ) {
-		global $wpdb;
 
-		$excludes      = (array) $excludes;
-		$exclude_query = '';
+		$excludes    = array_values( array_filter( array_map( 'intval', (array) $excludes ), fn( $id ) => $id > 0 ) );
+		$post_status = array_intersect( $post_status, self::get_status_list() );
 
-		if ( count( $excludes ) ) {
-			$exclude_query = implode( "','", $excludes );
+		if ( empty( $post_status ) ) {
+			$post_status = array( 'publish' );
 		}
 
-		$post_status = array_map(
-			function ( $element ) {
-				return "'" . $element . "'";
-			},
-			$post_status
-		);
-
-		$post_status      = implode( ',', $post_status );
-		$course_post_type = tutor()->course_post_type;
+		$query = DB::table( 'posts' )
+				->select( 'ID', 'post_author', 'post_title', 'post_name', 'post_status', 'menu_order' )
+				->where_in( 'post_status', $post_status )
+				->where( 'post_type', self::POST_TYPE )
+				->where_not_in( 'ID', $excludes );
 
-		//phpcs:disable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
-		$query = $wpdb->get_results(
-			$wpdb->prepare(
-				"SELECT ID,
-					post_author,
-					post_title,
-					post_name,
-					post_status,
-					menu_order
-			FROM 	{$wpdb->posts}
-			WHERE 	post_status IN ({$post_status})
-					AND ID NOT IN('$exclude_query')
-					AND post_type = %s;
-			",
-				$course_post_type
-			)
-		);
-		//phpcs:enable WordPress.DB.PreparedSQL.InterpolatedNotPrepared
-
-		return $query;
+		return $query->get();
 	}
 
 	/**
@@ -749,7 +728,7 @@
 		);
 
 		// Check if the current user is an admin.
-		if ( ! current_user_can( 'administrator' ) ) {
+		if ( ! current_user_can( 'manage_options' ) ) {
 			$args['author'] = $current_user->ID;
 		}
 
@@ -1186,7 +1165,7 @@
 			),
 		);
 
-		$courses = current_user_can( 'administrator' ) ? self::get_courses() : self::get_courses_by_instructor();
+		$courses = current_user_can( 'manage_options' ) ? self::get_courses() : self::get_courses_by_instructor();
 		if ( ! empty( $courses ) ) {
 			foreach ( $courses as $course ) {
 				$course_options[] = array(
@@ -1530,7 +1509,7 @@
 		$args = wp_parse_args( $args, $defaults );
 
 		if ( ! $args['course_id'] || ! $args['current_post_id'] || ! $args['current_post_type'] ) {
 			throw new InvalidArgumentException( __( 'Invalid argument passed', 'tutor' ) );
 		}
 
 		$has_access = false;

models/EnrollmentModel.php

@@ -10,7 +10,10 @@
 
 namespace Tutor\Models;
 
+defined( 'ABSPATH' ) || exit;
+
 use Tutor\Cache\TutorCache;
+use Tutor\Core\DB;
 use TUTOR\Course;
 use Tutor\Helpers\QueryHelper;
 use TUTOR\User;
@@ -280,34 +283,27 @@ public static function get_enrolment_by_enrol_id( $enrol_id = 0 ) {
 	 * @return object|mixed
 	 */
 	public static function get_enrolled_data( $user_id = 0, $course_id = 0, $status = self::STATUS_COMPLETED ) {
-		global $wpdb;
-		$status_clause = $status ? $wpdb->prepare( 'AND post_status = %s ', $status ) : '';
+		$user_id   = absint( $user_id );
+		$course_id = absint( $course_id );
+
+		if ( ! empty( $status ) && ! in_array( $status, array( self::STATUS_COMPLETED, self::STATUS_CANCEL, self::STATUS_PENDING ), true ) ) {
+			return null;
+		}
+
 		// If course ID provided, it will return single row data.
-		if ( $course_id > 0 ) {
-			return $wpdb->get_row(
-				$wpdb->prepare(
-					"SELECT * FROM 	{$wpdb->posts} 
-						WHERE post_type = %s
-						AND post_parent = %d
-						{$status_clause}
-						AND post_author = %d;",
-					self::POST_TYPE,
-					$course_id,
-					$user_id
-				)
-			);
+		if ( $course_id > 0 && in_array( get_post_type( $course_id ), array( tutor()->course_post_type, tutor()->bundle_post_type ), true ) ) {
+			return DB::table( 'posts' )
+					->where( 'post_type', self::POST_TYPE )
+					->where( 'post_parent', $course_id )
+					->where( 'post_author', $user_id )
+					->where( 'post_status', $status ?? self::STATUS_COMPLETED )
+					->first();
 		} else {
-			// Return all enrolled data by user ID.
-			return $wpdb->get_results(
-				$wpdb->prepare(
-					"SELECT * FROM 	{$wpdb->posts} 
-						WHERE post_type = %s
-						{$status_clause}
-						AND post_author = %d;",
-					self::POST_TYPE,
-					$user_id
-				)
-			);
+			return DB::table( 'posts' )
+					->where( 'post_type', self::POST_TYPE )
+					->where( 'post_author', $user_id )
+					->where( 'post_status', $status ?? self::STATUS_COMPLETED )
+					->get();
 		}
 	}
 
@@ -324,22 +320,9 @@ public static function get_enrolled_data( $user_id = 0, $course_id = 0, $status
 	 * @return bool
 	 */
 	public static function update_enrollments( string $status, array $enrollment_ids, bool $trigger_hook = true ): bool {
-		global $wpdb;
-		$enrollment_ids_in = QueryHelper::prepare_in_clause( $enrollment_ids );
-		$status            = 'complete' === $status ? 'completed' : $status;
-		$post_table        = $wpdb->posts;
+		$status = 'complete' === $status ? 'completed' : $status;
 
-		//phpcs:disable
-		$wpdb->query(
-			$wpdb->prepare(
-				"UPDATE {$post_table}
-				SET post_status = %s
-				WHERE ID IN ($enrollment_ids_in)
-			",
-				$status
-			)
-		);
-		//phpcs:enable
+		DB::table( 'posts' )->where_in( 'ID', $enrollment_ids )->update( array( 'post_status' => $status ) );
 
 		if ( $trigger_hook ) {
 			// Run action hook.
@@ -362,13 +345,10 @@ public static function update_enrollments( string $status, array $enrollment_ids
 	 * @return bool
 	 */
 	public static function delete_enrollment_record( int $student_id, int $course_id ): bool {
-		return QueryHelper::delete(
-			'posts',
-			array(
-				'post_author' => $student_id,
-				'post_parent' => $course_id,
-				'post_type'   => self::POST_TYPE,
-			)
-		);
+		return DB::table( 'posts' )
+			->where( 'post_author', $student_id )
+			->where( 'post_parent', $course_id )
+			->where( 'post_type', self::POST_TYPE )
+			->delete();
 	}
 }

models/OrderModel.php

@@ -10,12 +10,11 @@
 
 namespace Tutor\Models;
 
+defined( 'ABSPATH' ) || exit;
+
 use DateTime;
 use Exception;
 use Tutor\Cache\TutorCache;
-use Tutor\Components\Badge;
-use Tutor\Components\Button;
-use Tutor\Components\Constants\Variant;
 use TUTOR\Earnings;
 use Tutor\Ecommerce\BillingController;
 use Tutor\Ecommerce\CheckoutController;
@@ -25,7 +24,6 @@
 use Tutor\Helpers\DateTimeHelper;
 use Tutor\Helpers\QueryHelper;
 use TUTOR\User;
-use TutorPro\Ecommerce\Invoice;
 
 /**
  * OrderModel Class
@@ -421,7 +419,8 @@
 				}
 			}
 		} catch ( \Throwable $th ) {
+			$wpdb->query( 'ROLLBACK' );
 			throw new \Exception( $th->getMessage() );
 		}
 	}
 
@@ -1095,7 +1094,7 @@
 		//phpcs:enable
 
 		if ( $wpdb->last_error ) {
 			throw new \Exception( $wpdb->last_error );
 		} else {
 			$response['results']     = $results;
 			$response['total_count'] = is_array( $results ) && count( $results ) ? (int) $wpdb->get_var( 'SELECT FOUND_ROWS()' ) : 0;
@@ -1393,9 +1392,9 @@
 			);
 			//phpcs:enable
 		} else {
-			$earning_table = $wpdb->tutor_earnings;
+			$earning_table = QueryHelper::prepare_table_name( 'earnings' );
 			if ( $user_id ) {
-				$user_clause = "AND {$user_id} = (SELECT user_id FROM {$earning_table} WHERE user_id = {$user_id} LIMIT 1)";
+				$user_clause = $wpdb->prepare( "AND %d = (SELECT user_id FROM {$earning_table} WHERE user_id = %d LIMIT 1)", $user_id, $user_id ); //phpcs:ignore
 			}
 
 			//phpcs:disable
@@ -1714,7 +1713,7 @@
 				if ( ! is_null( $sale_price ) && $sale_price < $regular_price ) {
 					$item_subtotal = $sale_price;
 					$item_total    = $sale_price;
 				} else {
 					// If there's a discount, apply it to the total price.
 					if ( ! is_null( $discount_price ) && $discount_price >= 0 ) {
 						$item_total = max( 0, $discount_price ); // Ensure total doesn't go below 0.
@@ -1739,7 +1738,7 @@
 			if ( ! is_null( $sale_price ) && $sale_price < $regular_price ) {
 				$item_subtotal = $sale_price;
 				$item_total    = $sale_price;
 			} else {
 				// If there's a discount, apply it to the total price.
 				if ( ! is_null( $discount_price ) && $discount_price >= 0 ) {
 					$item_total = max( 0, $discount_price ); // Ensure total doesn't go below 0.