Changeset 24875 for trunk/wp-admin/includes/ms.php

Timestamp:

07/29/2013 06:16:47 PM (11 years ago)

Author:

duck_

Message:

Fix potential SQLi through improper use of API functions.

File:

• trunk/wp-admin/includes/ms.php (modified) (1 diff)

trunk/wp-admin/includes/ms.php

@@ -372 +372 @@
         _deprecated_argument( __FUNCTION__, '3.1' );
 
-    $wpdb->update( $wpdb->users, array( $pref => $value ), array( 'ID' => $id ) );
+    $wpdb->update( $wpdb->users, array( sanitize_key( $pref ) => $value ), array( 'ID' => $id ) );
 
     $user = new WP_User( $id );