Changeset 34090

Timestamp:

09/12/2015 09:05:14 PM (11 years ago)

Author:

boonebgorges

Message:

Use stricter sanitization for meta query clause keys.

By forcing all clause keys to be strings, we make it possible to use strict
comparison when validating values of 'orderby' as passed to WP_Query. This
eliminates situations where the presence of numeric clause keys could result
in an improperly validated 'orderby' value.

Props nikolov.tmw.
Fixes #32937.

Location:

trunk/src/wp-includes

Files:

• class-wp-meta-query.php (modified) (1 diff)
• query.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-meta-query.php

@@ -549 +549 @@
                 $clause['cast'] = $meta_type;
 
-                // Fallback for clause keys is the table alias.
-                if ( ! $clause_key ) {
+                // Fallback for clause keys is the table alias. Key must be a string.
+                if ( is_int( $clause_key ) || ! $clause_key ) {
                         $clause_key = $clause['alias'];
                 }

trunk/src/wp-includes/query.php

@@ -2281 +2281 @@
                 }
 
-                if ( ! in_array( $orderby, $allowed_keys ) ) {
+                if ( ! in_array( $orderby, $allowed_keys, true ) ) {
                         return false;
                 }