Changeset 37133

Timestamp:

03/30/2016 05:12:08 PM (8 years ago)

Author:

nbachiyski

Message:

Taxonomies: make sure taxonomy functions work correctly with taxonomy names with special characters

The codex says that taxonomy names "should only contain lowercase letters and the underscore character", but that's not enforced. It's too late to enforce it, since some plugins haven't been following it and the official phpdoc doesn't mention this restriction.

File:

• trunk/src/wp-includes/taxonomy.php (modified) (5 diffs)

trunk/src/wp-includes/taxonomy.php

@@ -163 +163 @@
  *
  *     $taxonomies = get_object_taxonomies( 'post' );
- * 
+ *
  * This results in:
- * 
+ *
  *     Array( 'category', 'post_tag' )
  *
@@ -748 +748 @@
     $term_ids = array_map('intval', $term_ids );
 
-    $taxonomies = "'" . implode( "', '", $taxonomies ) . "'";
+    $taxonomies = "'" . implode( "', '", array_map( 'esc_sql', $taxonomies ) ) . "'";
     $term_ids = "'" . implode( "', '", $term_ids ) . "'";
 
@@ -953 +953 @@
     }
 
-    $term = $wpdb->get_row( $wpdb->prepare( "SELECT t.*, tt.* FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy AS tt ON t.term_id = tt.term_id WHERE $_field = %s $tax_clause LIMIT 1", $value ) );
+    $term = $wpdb->get_row( $wpdb->prepare( "SELECT t.*, tt.* FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy AS tt ON t.term_id = tt.term_id WHERE $_field = %s", $value ) . " $tax_clause LIMIT 1" );
     if ( ! $term )
         return false;
@@ -1358 +1358 @@
 
     if ( $taxonomies ) {
-        $where_conditions[] = "tt.taxonomy IN ('" . implode("', '", $taxonomies) . "')";
+        $where_conditions[] = "tt.taxonomy IN ('" . implode("', '", array_map( 'esc_sql', $taxonomies ) ) . "')";
     }
 
@@ -2545 +2545 @@
     $taxonomy_array = $taxonomies;
     $object_id_array = $object_ids;
-    $taxonomies = "'" . implode("', '", $taxonomies) . "'";
+    $taxonomies = "'" . implode("', '", array_map( 'esc_sql', $taxonomies ) ) . "'";
     $object_ids = implode(', ', $object_ids);