Changeset 31144 for trunk/src/wp-includes/user.php

Timestamp:

01/11/2015 09:59:54 PM (10 years ago)

Author:

wonderboymusic

Message:

In WP_User_Query, only call magic method internals against a whitelist of properties, $compat_fields.

See #30891.

File:

• trunk/src/wp-includes/user.php (modified) (6 diffs)

trunk/src/wp-includes/user.php

@@ -473 +473 @@
      */
     private $total_users = 0;
+
+    private $compat_fields = array( 'results', 'total_users' );
 
     // SQL clauses
@@ -929 +931 @@
      */
     public function __get( $name ) {
-        return $this->$name;
+        if ( in_array( $name, $this->compat_fields ) ) {
+            return $this->$name;
+        }
     }
 
@@ -938 +942 @@
      * @access public
      *
-     * @param string $name  Property to set.
+     * @param string $name  Property to check if set.
      * @param mixed  $value Property value.
      * @return mixed Newly-set property.
      */
     public function __set( $name, $value ) {
-        return $this->$name = $value;
+        if ( in_array( $name, $this->compat_fields ) ) {
+            return $this->$name = $value;
+        }
     }
 
@@ -956 +962 @@
      */
     public function __isset( $name ) {
-        return isset( $this->$name );
+        if ( in_array( $name, $this->compat_fields ) ) {
+            return isset( $this->$name );
+        }
     }
 
@@ -968 +976 @@
      */
     public function __unset( $name ) {
-        unset( $this->$name );
+        if ( in_array( $name, $this->compat_fields ) ) {
+            unset( $this->$name );
+        }
     }
 
@@ -982 +992 @@
      */
     public function __call( $name, $arguments ) {
-        return call_user_func_array( array( $this, $name ), $arguments );
+        if ( 'get_search_sql' === $name ) {
+            return call_user_func_array( array( $this, $name ), $arguments );
+        }
+        return false;
     }
 }