Ticket #31122: query.php.patch

query.php

@@ -2230 +2230 @@
                         'post_parent', 'post_type', 'name', 'author', 'date', 'title', 'modified',
                         'parent', 'type', 'ID', 'menu_order', 'comment_count', 'rand',
                 );
+                
+                $allowed_keys = apply_filters( 'allowed_orderby_keys', $allowed_keys );
 
                 $primary_meta_key = '';
                 $primary_meta_query = false;
@@ -2260 +2262 @@
                         case 'ID':
                         case 'menu_order':
                         case 'comment_count':
-                                $orderby = "$wpdb->posts.{$orderby}";
+                                $orderby_clause = "$wpdb->posts.{$orderby}";
                                 break;
                         case 'rand':
-                                $orderby = 'RAND()';
+                                $orderby_clause = 'RAND()';
                                 break;
                         case $primary_meta_key:
                         case 'meta_value':
                                 if ( ! empty( $primary_meta_query['type'] ) ) {
                                         $sql_type = $this->meta_query->get_cast_for_type( $primary_meta_query['type'] );
-                                        $orderby = "CAST($wpdb->postmeta.meta_value AS {$sql_type})";
+                                        $orderby_clause = "CAST($wpdb->postmeta.meta_value AS {$sql_type})";
                                 } else {
-                                        $orderby = "$wpdb->postmeta.meta_value";
+                                        $orderby_clause = "$wpdb->postmeta.meta_value";
                                 }
                                 break;
                         case 'meta_value_num':
-                                $orderby = "$wpdb->postmeta.meta_value+0";
+                                $orderby_clause = "$wpdb->postmeta.meta_value+0";
                                 break;
                         default:
-                                $orderby = "$wpdb->posts.post_" . $orderby;
+                                $orderby_clause = "$wpdb->posts.post_" . $orderby;
                                 break;
                 }
-
-                return $orderby;
+                
+                return apply_filters( 'parse_orderby', $orderby_clause, $orderby );
         }
 
         /**