Make WordPress Core

Changeset 37133


Ignore:
Timestamp:
03/30/2016 05:12:08 PM (8 years ago)
Author:
nbachiyski
Message:

Taxonomies: make sure taxonomy functions work correctly with taxonomy names with special characters

The codex says that taxonomy names "should only contain lowercase letters and the underscore character", but that's not enforced. It's too late to enforce it, since some plugins haven't been following it and the official phpdoc doesn't mention this restriction.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/taxonomy.php

    r36962 r37133  
    163163 *
    164164 *     $taxonomies = get_object_taxonomies( 'post' );
    165  * 
     165 *
    166166 * This results in:
    167  * 
     167 *
    168168 *     Array( 'category', 'post_tag' )
    169169 *
     
    748748    $term_ids = array_map('intval', $term_ids );
    749749
    750     $taxonomies = "'" . implode( "', '", $taxonomies ) . "'";
     750    $taxonomies = "'" . implode( "', '", array_map( 'esc_sql', $taxonomies ) ) . "'";
    751751    $term_ids = "'" . implode( "', '", $term_ids ) . "'";
    752752
     
    953953    }
    954954
    955     $term = $wpdb->get_row( $wpdb->prepare( "SELECT t.*, tt.* FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy AS tt ON t.term_id = tt.term_id WHERE $_field = %s $tax_clause LIMIT 1", $value ) );
     955    $term = $wpdb->get_row( $wpdb->prepare( "SELECT t.*, tt.* FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy AS tt ON t.term_id = tt.term_id WHERE $_field = %s", $value ) . " $tax_clause LIMIT 1" );
    956956    if ( ! $term )
    957957        return false;
     
    13581358
    13591359    if ( $taxonomies ) {
    1360         $where_conditions[] = "tt.taxonomy IN ('" . implode("', '", $taxonomies) . "')";
     1360        $where_conditions[] = "tt.taxonomy IN ('" . implode("', '", array_map( 'esc_sql', $taxonomies ) ) . "')";
    13611361    }
    13621362
     
    25452545    $taxonomy_array = $taxonomies;
    25462546    $object_id_array = $object_ids;
    2547     $taxonomies = "'" . implode("', '", $taxonomies) . "'";
     2547    $taxonomies = "'" . implode("', '", array_map( 'esc_sql', $taxonomies ) ) . "'";
    25482548    $object_ids = implode(', ', $object_ids);
    25492549
Note: See TracChangeset for help on using the changeset viewer.