Changeset 31144

Timestamp:

01/11/2015 09:59:54 PM (12 years ago)

Author:

wonderboymusic

Message:

In WP_User_Query, only call magic method internals against a whitelist of properties, $compat_fields.

See #30891.

File:

• trunk/src/wp-includes/user.php (modified) (6 diffs)

trunk/src/wp-includes/user.php

@@ -473 +473 @@
          */
         private $total_users = 0;
+
+        private $compat_fields = array( 'results', 'total_users' );
 
         // SQL clauses
@@ -929 +931 @@
          */
         public function __get( $name ) {
-                return $this->$name;
+                if ( in_array( $name, $this->compat_fields ) ) {
+                        return $this->$name;
+                }
         }
 
@@ -938 +942 @@
          * @access public
          *
-         * @param string $name  Property to set.
+         * @param string $name  Property to check if set.
          * @param mixed  $value Property value.
          * @return mixed Newly-set property.
          */
         public function __set( $name, $value ) {
-                return $this->$name = $value;
+                if ( in_array( $name, $this->compat_fields ) ) {
+                        return $this->$name = $value;
+                }
         }
 
@@ -956 +962 @@
          */
         public function __isset( $name ) {
-                return isset( $this->$name );
+                if ( in_array( $name, $this->compat_fields ) ) {
+                        return isset( $this->$name );
+                }
         }
 
@@ -968 +976 @@
          */
         public function __unset( $name ) {
-                unset( $this->$name );
+                if ( in_array( $name, $this->compat_fields ) ) {
+                        unset( $this->$name );
+                }
         }
 
@@ -982 +992 @@
          */
         public function __call( $name, $arguments ) {
-                return call_user_func_array( array( $this, $name ), $arguments );
+                if ( 'get_search_sql' === $name ) {
+                        return call_user_func_array( array( $this, $name ), $arguments );
+                }
+                return false;
         }
 }