Ticket #4617: 4617.diff

wp-includes/query.php

@@ -972 +972 @@
                         $q['orderby'] = 'post_date '.$q['order'];
                 } else {
                         // Used to filter values
-                        $allowed_keys = array('author', 'date', 'category', 'title', 'modified', 'menu_order');
+                        $allowed_keys = array('author', 'date', 'category', 'title', 'modified', 'menu_order', 'rand');
                         $q['orderby'] = urldecode($q['orderby']);
                         $q['orderby'] = addslashes_gpc($q['orderby']);
                         $orderby_array = explode(' ',$q['orderby']);
@@ -982 +982 @@
                         for ($i = 0; $i < count($orderby_array); $i++) {
                                 // Only allow certain values for safety
                                 $orderby = $orderby_array[$i];
-                                if ( 'menu_order' != $orderby )
+                                if ( 'menu_order' != $orderby && 'rand' != $orderby)
                                         $orderby = 'post_' . $orderby;
+                                if ('rand' == $orderby)
+                                        $orderby = 'RAND()';
                                 if ( in_array($orderby_array[$i], $allowed_keys) )
                                         $q['orderby'] .= (($i == 0) ? '' : ',') . "$orderby {$q['order']}";
                         }