Changeset 27439 for trunk/src/wp-includes/ms-load.php

Timestamp:

03/06/2014 06:17:32 PM (11 years ago)

Author:

nacin

Message:

In get_site_by_path(), avoid passing $paths through prepare(). If a path contains a %, we end up with problems. see #27003.

File:

• trunk/src/wp-includes/ms-load.php (modified) (1 diff)

trunk/src/wp-includes/ms-load.php

@@ -351 +351 @@
     if ( count( $paths ) > 1 ) {
         $paths = "'" . implode( "', '", $wpdb->_escape( $paths ) ) . "'";
-        $site = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->blogs
-            WHERE domain = %s AND path IN ($paths) ORDER BY CHAR_LENGTH(path) DESC LIMIT 1", $domain ) );
+        $sql = $wpdb->prepare( "SELECT * FROM $wpdb->blogs WHERE domain = %s", $domain );
+        $sql .= " AND path IN ($paths) ORDER BY CHAR_LENGTH(path) DESC LIMIT 1";
+        $site = $wpdb->get_row( $sql );
     } else {
         $site = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->blogs WHERE domain = %s and path = %s", $domain, $paths[0] ) );