Ticket #10649: query.php.2.diff

wp-includes/query.php

@@ -2021 +2021 @@
                         if ( !empty($q['meta_key']) ) {
                                 $allowed_keys[] = $q['meta_key'];
                                 $allowed_keys[] = 'meta_value';
+                                $allowed_keys[] = 'meta_value_num';
                         }
                         $q['orderby'] = urldecode($q['orderby']);
                         $q['orderby'] = addslashes_gpc($q['orderby']);
@@ -2028 +2029 @@
                         if ( empty($orderby_array) )
                                 $orderby_array[] = $q['orderby'];
                         $q['orderby'] = '';
+
                         for ($i = 0; $i < count($orderby_array); $i++) {
+                                $orderby = $orderby_array[$i];
+
                                 // Only allow certain values for safety
-                                $orderby = $orderby_array[$i];
+                                if ( ! in_array($orderby, $allowed_keys) )
+                                        continue;
+
                                 switch ($orderby) {
                                         case 'menu_order':
                                                 break;
@@ -2044 +2050 @@
                                         case 'meta_value':
                                                 $orderby = "$wpdb->postmeta.meta_value";
                                                 break;
+                                        case 'meta_value_num':
+                                                $orderby = "$wpdb->postmeta.meta_value+0";
+                                                break;
                                         case 'comment_count':
                                                 $orderby = "$wpdb->posts.comment_count";
                                                 break;
                                         default:
                                                 $orderby = "$wpdb->posts.post_" . $orderby;
                                 }
-                                if ( in_array($orderby_array[$i], $allowed_keys) )
-                                        $q['orderby'] .= (($i == 0) ? '' : ',') . $orderby;
+
+                                $q['orderby'] .= (($i == 0) ? '' : ',') . $orderby;
                         }
+
                         // append ASC or DESC at the end
                         if ( !empty($q['orderby']))
                                 $q['orderby'] .= " {$q['order']}";