Changeset 29797 for trunk/src/wp-includes/date.php

Timestamp:

09/30/2014 02:03:49 PM (10 years ago)

Author:

boonebgorges

Message:

Improve parameter sanitization in WP_Date_Query::build_query().

• Don't run non-numeric values through intval() for sanitization; this transforms them into 1s and 0s, which can cause unintended results.
• Be more generous about numeric array keys (don't require 0 and 1) in BETWEEN and NOT BETWEEN clauses.

Fixes #29801.

File:

• trunk/src/wp-includes/date.php (modified) (2 diffs)

trunk/src/wp-includes/date.php

@@ -314 +314 @@
             case 'IN':
             case 'NOT IN':
-                return '(' . implode( ',', array_map( 'intval', (array) $value ) ) . ')';
+                $value = (array) $value;
+
+                // Remove non-numeric values.
+                $value = array_filter( $value, 'is_numeric' );
+
+                if ( empty( $value ) ) {
+                    return false;
+                }
+
+                return '(' . implode( ',', array_map( 'intval', $value ) ) . ')';
 
             case 'BETWEEN':
             case 'NOT BETWEEN':
-                if ( ! is_array( $value ) || 2 != count( $value ) || ! isset( $value[0] ) || ! isset( $value[1] ) )
+                if ( ! is_array( $value ) || 2 != count( $value ) ) {
                     $value = array( $value, $value );
+                } else {
+                    $value = array_values( $value );
+                }
+
+                // If either value is non-numeric, bail.
+                foreach ( $value as $v ) {
+                    if ( ! is_numeric( $v ) ) {
+                        return false;
+                    }
+                }
 
                 $value = array_map( 'intval', $value );
@@ -326 +345 @@
 
             default;
+                if ( ! is_numeric( $value ) ) {
+                    return false;
+                }
+
                 return (int) $value;
         }