WordPress.org

Make WordPress Core


Ignore:
Timestamp:
03/06/2014 06:17:32 PM (6 years ago)
Author:
nacin
Message:

In get_site_by_path(), avoid passing $paths through prepare(). If a path contains a %, we end up with problems. see #27003.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/ms-load.php

    r27407 r27439  
    351351    if ( count( $paths ) > 1 ) {
    352352        $paths = "'" . implode( "', '", $wpdb->_escape( $paths ) ) . "'";
    353         $site = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->blogs
    354             WHERE domain = %s AND path IN ($paths) ORDER BY CHAR_LENGTH(path) DESC LIMIT 1", $domain ) );
     353        $sql = $wpdb->prepare( "SELECT * FROM $wpdb->blogs WHERE domain = %s", $domain );
     354        $sql .= " AND path IN ($paths) ORDER BY CHAR_LENGTH(path) DESC LIMIT 1";
     355        $site = $wpdb->get_row( $sql );
    355356    } else {
    356357        $site = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->blogs WHERE domain = %s and path = %s", $domain, $paths[0] ) );
Note: See TracChangeset for help on using the changeset viewer.