Ticket #30064: 30064_gowp1-3.diff

wp-includes/user.php

@@ -600 +600 @@
 
                 // sorting
                 if ( isset( $qv['orderby'] ) ) {
+
+                        /**
+                         * Sanitize and clean up include parameter before checking for contents
+                         * if it ends up empty after checking, we dont want to try to sort on nothing
+                         */
+                        if ( 'include' == $qv['orderby'] && ! empty($qv['include'])) {
+                                $include = is_string( $qv['include'] ) ? explode( ',', $qv['include'] ) : $qv['include'];
+
+                                if ( is_array($include) ) {
+                                        // sanitize array for ID values
+                                        $include = array_map( 'intval', $include );
+                                        // cleaning up the unwanted values:
+                                        // filter out all 0 values
+                                        $include = array_filter( $include );
+                                        // remove possible duplicates
+                                        $include = array_unique( $include );
+
+                                        // please advice: use new variable or put back
+                                        // should the parameters be formatted more globally?
+                                        $qv['include'] = $include;
+                                }
+                        }
+
                         if ( in_array( $qv['orderby'], array('nicename', 'email', 'url', 'registered') ) ) {
                                 $orderby = 'user_' . $qv['orderby'];
                         } elseif ( in_array( $qv['orderby'], array('user_nicename', 'user_email', 'user_url', 'user_registered') ) ) {
@@ -621 +644 @@
                                 $orderby = 'ID';
                         } elseif ( 'meta_value' == $qv['orderby'] ) {
                                 $orderby = "$wpdb->usermeta.meta_value";
-                        } else {
+                        } elseif ( 'include' == $qv['orderby'] && ! empty( $qv['include'] ) ) {
+                                $include = implode( ",", $qv['include'] );
+                                $orderby = "FIELD( {$wpdb->users}.ID, {$include} )";
+            } else {
                                 $orderby = 'user_login';
                         }
                 }