1 | Index: src/wp-includes/query.php |
---|
2 | =================================================================== |
---|
3 | --- src/wp-includes/query.php (revision 38177) |
---|
4 | +++ src/wp-includes/query.php (working copy) |
---|
5 | @@ -1595,7 +1595,15 @@ |
---|
6 | if ( ! empty($qv['robots']) ) |
---|
7 | $this->is_robots = true; |
---|
8 | |
---|
9 | - $qv['p'] = absint($qv['p']); |
---|
10 | + } |
---|
11 | + if ( is_object( $qv['p'] ) || ! is_scalar( $qv['p'] ) || $qv['p'] < 0 ) { |
---|
12 | + $qv['p'] = 0; |
---|
13 | + $qv['error'] = '404'; |
---|
14 | + } else { |
---|
15 | + $qv['p'] = intval( $qv['p'] ); |
---|
16 | + } |
---|
17 | + |
---|
18 | $qv['page_id'] = absint($qv['page_id']); |
---|
19 | $qv['year'] = absint($qv['year']); |
---|
20 | $qv['monthnum'] = absint($qv['monthnum']); |
---|
21 | Index: tests/phpunit/tests/query/parseQuery.php |
---|
22 | =================================================================== |
---|
23 | --- tests/phpunit/tests/query/parseQuery.php (revision 38177) |
---|
24 | +++ tests/phpunit/tests/query/parseQuery.php (working copy) |
---|
25 | @@ -51,4 +51,42 @@ |
---|
26 | |
---|
27 | $this->assertSame( true, $q->query_vars['s'] ); |
---|
28 | } |
---|
29 | + |
---|
30 | + /** |
---|
31 | + * @ticket 33372 |
---|
32 | + */ |
---|
33 | + public function test_parse_query_p_negative_int() { |
---|
34 | + $q = new WP_Query(); |
---|
35 | + $q->parse_query( array( |
---|
36 | + 'p' => -3, |
---|
37 | + ) ); |
---|
38 | + |
---|
39 | + $this->assertSame( -3, $q->query_vars['p'] ); |
---|
40 | + $this->assertSame( '404', $q->query_vars['error'] ); |
---|
41 | + } |
---|
42 | + |
---|
43 | + /** |
---|
44 | + * @ticket 33372 |
---|
45 | + */ |
---|
46 | + public function test_parse_query_p_array() { |
---|
47 | + $q = new WP_Query(); |
---|
48 | + $q->parse_query( array( |
---|
49 | + 'p' => array(), |
---|
50 | + ) ); |
---|
51 | + |
---|
52 | + $this->assertSame( '404', $q->query_vars['error'] ); |
---|
53 | + } |
---|
54 | + |
---|
55 | + /** |
---|
56 | + * @ticket 33372 |
---|
57 | + */ |
---|
58 | + public function test_parse_query_p_object() { |
---|
59 | + $q = new WP_Query(); |
---|
60 | + $q->parse_query( array( |
---|
61 | + 'p' => new stdClass(), |
---|
62 | + ) ); |
---|
63 | + |
---|
64 | + $this->assertSame( '404', $q->query_vars['error'] ); |
---|
65 | + } |
---|
66 | + |
---|
67 | } |
---|