Changeset 24876 for branches/3.6/wp-admin/includes/ms.php

Timestamp:

07/29/2013 06:18:58 PM (11 years ago)

Author:

duck_

Message:

Fix potential SQLi through improper use of API functions. For 3.6.

Location:

branches/3.6

Files:

• . (modified) (1 prop)
• wp-admin/includes/ms.php (modified) (1 diff)

branches/3.6/wp-admin/includes/ms.php

@@ -372 +372 @@
         _deprecated_argument( __FUNCTION__, '3.1' );
 
-    $wpdb->update( $wpdb->users, array( $pref => $value ), array( 'ID' => $id ) );
+    $wpdb->update( $wpdb->users, array( sanitize_key( $pref ) => $value ), array( 'ID' => $id ) );
 
     $user = new WP_User( $id );