Ticket #35692: 35692.2.diff

src/wp-includes/query.php

@@ -2332 +2332 @@
                         $allowed_keys   = array_merge( $allowed_keys, array_keys( $meta_clauses ) );
                 }
 
+                // Sanitize RAND() with a seed value and add to allowed keys.
+                $rand_with_seed = false;
+                if ( preg_match( '/RAND\(([0-9]+)\)/i', $orderby, $matches ) ) {
+                        $orderby = sprintf( 'RAND(%s)', intval( $matches[1] ) );
+                        $allowed_keys[] = $orderby;
+                        $rand_with_seed = true;
+                }
+
                 if ( ! in_array( $orderby, $allowed_keys, true ) ) {
                         return false;
                 }
@@ -2368 +2376 @@
                                         // $orderby corresponds to a meta_query clause.
                                         $meta_clause = $meta_clauses[ $orderby ];
                                         $orderby_clause = "CAST({$meta_clause['alias']}.meta_value AS {$meta_clause['cast']})";
+                                } elseif ( $rand_with_seed ) {
+                                        $orderby_clause = $orderby;
                                 } else {
                                         // Default: order by post field.
                                         $orderby_clause = "$wpdb->posts.post_" . sanitize_key( $orderby );

tests/phpunit/tests/post/query.php

@@ -304 +304 @@
         }
 
         /**
+         * @ticket 35692
+         */
+        public function test_orderby_rand_with_seed() {
+                $q = new WP_Query( array(
+                        'orderby' => 'RAND(5)',
+                ) );
+
+                $this->assertContains( 'ORDER BY RAND(5)', $q->request );
+        }
+
+        /**
+         * @ticket 35692
+         */
+        public function test_orderby_rand_should_ignore_invalid_seed() {
+                $q = new WP_Query( array(
+                        'orderby' => 'RAND(foo)',
+                ) );
+
+                $this->assertNotContains( 'ORDER BY RAND', $q->request );
+        }
+
+        /**
+         * @ticket 35692
+         */
+        public function test_orderby_rand_with_seed_should_be_case_insensitive() {
+                $q = new WP_Query( array(
+                        'orderby' => 'rand(5)',
+                ) );
+
+                $this->assertContains( 'ORDER BY RAND(5)', $q->request );
+        }
+
+        /**
          * Tests the post_name__in attribute of WP_Query.
          *
          * @ticket 33065