Changeset 18350

Timestamp:

06/27/2011 08:47:04 PM (15 years ago)

Author:

ryan

Message:

Sanitize sort_column and sort_order in get_pages(). Escape search_term in WP_User_Search. Cast blog_id to int in get_blog_prefix(). Props duck_

Location:

trunk

Files:

• wp-admin/includes/deprecated.php (modified) (2 diffs)
• wp-includes/post.php (modified) (1 diff)
• wp-includes/wp-db.php (modified) (1 diff)

trunk/wp-admin/includes/deprecated.php

@@ -455 +455 @@
                 _deprecated_function( __FUNCTION__, '3.1', 'WP_User_Query' );
 
-                $this->search_term = $search_term;
+                $this->search_term = stripslashes( $search_term );
                 $this->raw_page = ( '' == $page ) ? false : (int) $page;
                 $this->page = (int) ( '' == $page ) ? 1 : $page;
@@ -486 +486 @@
                         $search_sql = 'AND (';
                         foreach ( array('user_login', 'user_nicename', 'user_email', 'user_url', 'display_name') as $col )
-                                $searches[] = $col . " LIKE '%$this->search_term%'";
+                                $searches[] = $wpdb->prepare( $col . ' LIKE %s', '%' . like_escape($this->search_term) . '%' );
                         $search_sql .= implode(' OR ', $searches);
                         $search_sql .= ')';

trunk/wp-includes/post.php

@@ -3449 +3449 @@
         }
 
+        $orderby_array = array();
+        $allowed_keys = array('author', 'post_author', 'date', 'post_date', 'title', 'post_title', 'modified',
+                                                  'post_modified', 'modified_gmt', 'post_modified_gmt', 'menu_order', 'parent', 'post_parent',
+                                                  'ID', 'rand', 'comment_count');
+        foreach ( explode( ',', $sort_column ) as $orderby ) {
+                $orderby = trim( $orderby );
+                if ( !in_array( $orderby, $allowed_keys ) )
+                        continue;
+
+                switch ( $orderby ) {
+                        case 'menu_order':
+                                break;
+                        case 'ID':
+                                $orderby = "$wpdb->posts.ID";
+                                break;
+                        case 'rand':
+                                $orderby = 'RAND()';
+                                break;
+                        case 'comment_count':
+                                $orderby = "$wpdb->posts.comment_count";
+                                break;
+                        default:
+                                if ( 0 === strpos( $orderby, 'post_' ) )
+                                        $orderby = "$wpdb->posts." . $orderby;
+                                else
+                                        $orderby = "$wpdb->posts.post_" . $orderby;
+                }
+
+                $orderby_array[] = $orderby;
+
+        }
+        $sort_column = ! empty( $orderby_array ) ? implode( ',', $orderby_array ) : "$wpdb->posts.post_title";
+
+        $sort_order = strtoupper( $sort_order );
+        if ( '' !== $sort_order && !in_array( $sort_order, array( 'ASC', 'DESC' ) ) )
+                $sort_order = 'ASC';
+
         $query = "SELECT * FROM $wpdb->posts $join WHERE ($where_post_type) $where ";
         $query .= $author_query;

trunk/wp-includes/wp-db.php

@@ -627 +627 @@
                         if ( null === $blog_id )
                                 $blog_id = $this->blogid;
+                        $blog_id = (int) $blog_id;
                         if ( defined( 'MULTISITE' ) && ( 0 == $blog_id || 1 == $blog_id ) )
                                 return $this->base_prefix;