Ticket #24687: 24687.diff

query.php

@@ -2371 +2371 @@
                         $q['orderby'] = addslashes_gpc($q['orderby']);
 
                         $orderby_array = array();
-                        foreach ( explode( ' ', $q['orderby'] ) as $i => $orderby ) {
+                        $orderby_parts = preg_split( '/[, ]/', $q['orderby'], -1, PREG_SPLIT_NO_EMPTY );
+                        foreach ( $orderby_parts as $i => $orderby ) {
                                 // Only allow certain values for safety
                                 if ( ! in_array($orderby, $allowed_keys) )
                                         continue;
 
+                                // If the next word is ASC or DESC, use it
+                                // for this sort key and cancel $q['order']
+                                $order = '';
+                                if ( isset( $orderby_parts[ $i + 1 ] ) ) {
+                                        $next_part = strtoupper( $orderby_parts[ $i + 1 ] );
+                                        if ( in_array( $next_part, array( 'ASC', 'DESC' ) ) ) {
+                                                $q['order'] = '';
+                                                $order = $next_part;
+                                        }
+                                }
+
                                 switch ( $orderby ) {
                                         case 'menu_order':
                                                 $orderby = "$wpdb->posts.menu_order";
@@ -2400 +2412 @@
                                                 $orderby = "$wpdb->posts.post_" . $orderby;
                                 }
 
-                                $orderby_array[] = $orderby;
+                                $orderby_array[] = trim( "$orderby $order" );
                         }
-                        $orderby = implode( ',', $orderby_array );
+                        $orderby = implode( ', ', $orderby_array );
 
                         if ( empty( $orderby ) )
-                                $orderby = "$wpdb->posts.post_date ".$q['order'];
-                        else
-                                $orderby .= " {$q['order']}";
+                                $orderby = "$wpdb->posts.post_date";
+
+                        $orderby = trim( "$orderby {$q['order']}" );
                 }
 
                 if ( is_array( $post_type ) && count( $post_type ) > 1 ) {