Changeset 25138

Timestamp:

08/27/2013 03:19:54 PM (11 years ago)

Author:

nacin

Message:

Don't cast the 'm' query variable to an integer as the value can exceed the range of a 32-bit signed integer.

props Viper007Bond.
fixes #24884.

File:

• trunk/src/wp-includes/query.php (modified) (2 diffs)

trunk/src/wp-includes/query.php

@@ -1446 +1446 @@
         $qv['day'] = absint($qv['day']);
         $qv['w'] = absint($qv['w']);
-        $qv['m'] = absint($qv['m']);
+        $qv['m'] = preg_replace( '|[^0-9]|', '', $qv['m'] );
         $qv['paged'] = absint($qv['paged']);
         $qv['cat'] = preg_replace( '|[^0-9,-]|', '', $qv['cat'] ); // comma separated list of positive or negative integers
@@ -2048 +2048 @@
         // If a month is specified in the querystring, load that month
         if ( $q['m'] ) {
-            $q['m'] = '' . preg_replace('|[^0-9]|', '', $q['m']);
             $where .= " AND YEAR($wpdb->posts.post_date)=" . substr($q['m'], 0, 4);
             if ( strlen($q['m']) > 5 )