Changeset 27439 for trunk/src/wp-includes/ms-load.php

Timestamp:

03/06/2014 06:17:32 PM (13 years ago)

Author:

nacin

Message:

In get_site_by_path(), avoid passing $paths through prepare(). If a path contains a %, we end up with problems. see #27003.

File:

• trunk/src/wp-includes/ms-load.php (modified) (1 diff)

trunk/src/wp-includes/ms-load.php

@@ -351 +351 @@
         if ( count( $paths ) > 1 ) {
                 $paths = "'" . implode( "', '", $wpdb->_escape( $paths ) ) . "'";
-                $site = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->blogs
-                        WHERE domain = %s AND path IN ($paths) ORDER BY CHAR_LENGTH(path) DESC LIMIT 1", $domain ) );
+                $sql = $wpdb->prepare( "SELECT * FROM $wpdb->blogs WHERE domain = %s", $domain );
+                $sql .= " AND path IN ($paths) ORDER BY CHAR_LENGTH(path) DESC LIMIT 1";
+                $site = $wpdb->get_row( $sql );
         } else {
                 $site = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->blogs WHERE domain = %s and path = %s", $domain, $paths[0] ) );