WordPress.org

Make WordPress Core

Ticket #6476: 6476.002.diff

File 6476.002.diff, 2.1 KB (added by markjaquith, 14 years ago)
  • wp-includes/post.php

     
    460460        if (!empty($exclusions))
    461461                $exclusions .= ')';
    462462
     463        // orderby
     464        if ( preg_match( '/.+ (ASC|DESC)/i', $orderby ) )
     465                $order = ''; // orderby has its own order, so we'll use that
     466
    463467        $query  = "SELECT DISTINCT * FROM $wpdb->posts ";
    464468        $query .= empty( $category ) ? '' : ", $wpdb->term_relationships, $wpdb->term_taxonomy  ";
    465469        $query .= empty( $meta_key ) ? '' : ", $wpdb->postmeta ";
  • wp-includes/media.php

     
    339339        $output = apply_filters('post_gallery', '', $attr);
    340340        if ( $output != '' )
    341341                return $output;
    342                
     342
     343        // We're trusting author input, so let's at least make sure it looks like a valid orderby statement
     344        preg_match('/(^([a-z0-9_]+( +(ASC|DESC))?(, +?|$))+|RAND\(\))/i', $attr['orderby'], $obmatches);
     345        if ( !$obmatches[0] )
     346                unset($attr['orderby']);
     347
    343348        extract(shortcode_atts(array(
    344349                'orderby'    => 'menu_order ASC, ID ASC',
    345350                'id'         => $post->ID,
     
    352357
    353358        $id = intval($id);
    354359        $orderby = addslashes($orderby);
    355         $attachments = get_children("post_parent=$id&post_type=attachment&post_mime_type=image&orderby=\"{$orderby}\"");
     360        $attachments = get_children("post_parent=$id&post_type=attachment&post_mime_type=image&orderby={$orderby}");
    356361
    357362        if ( empty($attachments) )
    358363                return '';
     
    426431function adjacent_image_link($prev = true) {
    427432        global $post;
    428433        $post = get_post($post);
    429         $attachments = array_values(get_children("post_parent=$post->post_parent&post_type=attachment&post_mime_type=image&orderby=\"menu_order ASC, ID ASC\""));
     434        $attachments = array_values(get_children("post_parent=$post->post_parent&post_type=attachment&post_mime_type=image&orderby=menu_order ASC, ID ASC"));
    430435
    431436        foreach ( $attachments as $k => $attachment )
    432437                if ( $attachment->ID == $post->ID )