Changeset 18357 for branches/3.1/wp-includes/post.php

Timestamp:

06/27/2011 09:38:51 PM (14 years ago)

Author:

ryan

Message:

Sanitize sort_column and sort_order in get_pages(). Escape search_term in WP_User_Search. Cast blog_id to int in get_blog_prefix(). Props duck_. For 3.1.

Location:

branches/3.1

Files:

• . (modified) (1 prop)
• wp-includes/post.php (modified) (1 diff)

branches/3.1/wp-includes/post.php

@@ -3422 +3422 @@
     $where_post_type = $wpdb->prepare( "post_type = '%s' AND post_status = '%s'", $post_type, $post_status );
 
+    $orderby_array = array();
+    $allowed_keys = array('author', 'post_author', 'date', 'post_date', 'title', 'post_title', 'modified',
+                          'post_modified', 'modified_gmt', 'post_modified_gmt', 'menu_order', 'parent', 'post_parent',
+                          'ID', 'rand', 'comment_count');
+    foreach ( explode( ',', $sort_column ) as $orderby ) {
+        $orderby = trim( $orderby );
+        if ( !in_array( $orderby, $allowed_keys ) )
+            continue;
+
+        switch ( $orderby ) {
+            case 'menu_order':
+                break;
+            case 'ID':
+                $orderby = "$wpdb->posts.ID";
+                break;
+            case 'rand':
+                $orderby = 'RAND()';
+                break;
+            case 'comment_count':
+                $orderby = "$wpdb->posts.comment_count";
+                break;
+            default:
+                if ( 0 === strpos( $orderby, 'post_' ) )
+                    $orderby = "$wpdb->posts." . $orderby;
+                else
+                    $orderby = "$wpdb->posts.post_" . $orderby;
+        }
+
+        $orderby_array[] = $orderby;
+
+    }
+    $sort_column = ! empty( $orderby_array ) ? implode( ',', $orderby_array ) : "$wpdb->posts.post_title";
+
+    $sort_order = strtoupper( $sort_order );
+    if ( '' !== $sort_order && !in_array( $sort_order, array( 'ASC', 'DESC' ) ) )
+        $sort_order = 'ASC';
+
     $query = "SELECT * FROM $wpdb->posts $join WHERE ($where_post_type) $where ";
     $query .= $author_query;