Ticket #45084: 45084.patch

wp-includes/class-wp-term-query.php

@@ -388 +388 @@
                         }
                 }
 
-                // 'term_order' is a legal sort order only when joining the relationship table.
                 $_orderby = $this->query_vars['orderby'];
-                if ( 'term_order' === $_orderby && empty( $this->query_vars['object_ids'] ) ) {
-                        $_orderby = 'term_id';
+                $_orderby_array = array();
+
+                if ( is_array( $_orderby ) ) {
+                        foreach ( $_orderby as $__orderby => $order ) {
+                                // 'term_order' is a legal sort order only when joining the relationship table.
+                                if ( 'term_order' === $__orderby && empty( $this->query_vars['object_ids'] ) ) {
+                                        $__orderby = 'term_id';
+                                }
+                                $__orderby = addslashes_gpc( urldecode( $__orderby ) );
+                                $parsed = $this->parse_orderby( $__orderby );
+
+                                $_orderby_array[] = $parsed . ' ' . $this->parse_order( $order );
+                        }
+
+                        $_orderby = implode( ', ', $_orderby_array );
+                } else {
+                        $_orderby = addslashes_gpc( urldecode( $_orderby ) );
+                        $order    = $this->parse_order( $this->query_vars['order'] );
+
+                        foreach ( explode( ' ', $_orderby ) as $i => $__orderby ) {
+                                // 'term_order' is a legal sort order only when joining the relationship table.
+                                if ( 'term_order' === $__orderby && empty( $this->query_vars['object_ids'] ) ) {
+                                        $__orderby = 'term_id';
+                                }
+                                $parsed = $this->parse_orderby( $__orderby );
+                                // Only allow certain values for safety.
+                                if ( ! $parsed ) {
+                                        continue;
+                                }
+
+                                $_orderby_array[] = $parsed . ' ' . $order;
+                        }
+                        $_orderby = implode( ', ', $_orderby_array );
                 }
-                $orderby = $this->parse_orderby( $_orderby );
 
-                if ( $orderby ) {
-                        $orderby = "ORDER BY $orderby";
+                $orderby = '';
+                if ( $_orderby ) {
+                        $orderby = "ORDER BY $_orderby";
+                        $order   = '';
                 }
 
-                $order = $this->parse_order( $this->query_vars['order'] );
-
                 if ( $taxonomies ) {
                         $this->sql_clauses['where']['taxonomy'] = "tt.taxonomy IN ('" . implode( "', '", array_map( 'esc_sql', $taxonomies ) ) . "')";
                 }