WordPress.org

Make WordPress Core

Changeset 37324


Ignore:
Timestamp:
04/29/16 13:14:18 (13 months ago)
Author:
boonebgorges
Message:

Query: Discard non-scalar 'm' instead of attempting to sanitize.

WP_Query discards most non-array date values ('year', 'monthnum', etc) by
casting to integer. Since [25138], the 'm' parameter has been handled
as a string; see #24884. However, the string-handling introduced in [25138]
blindly attempted to handle arrays and other non-scalar types as strings,
resulting in PHP notices and invalid MySQL syntax.

Props vortfu.
Fixes #36718.

Location:
trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/query.php

    r37281 r37324  
    15941594        $qv['day'] = absint($qv['day']); 
    15951595        $qv['w'] = absint($qv['w']); 
    1596         $qv['m'] = preg_replace( '|[^0-9]|', '', $qv['m'] ); 
     1596        $qv['m'] = is_scalar( $qv['m'] ) ? preg_replace( '|[^0-9]|', '', $qv['m'] ) : ''; 
    15971597        $qv['paged'] = absint($qv['paged']); 
    15981598        $qv['cat'] = preg_replace( '|[^0-9,-]|', '', $qv['cat'] ); // comma separated list of positive or negative integers 
  • trunk/tests/phpunit/tests/query/date.php

    r35186 r37324  
    259259    } 
    260260 
     261    /** 
     262     * @ticket 36718 
     263     */ 
     264    public function test_non_scalar_m_should_be_discarded() { 
     265        $expected = $this->_get_query_result( ); 
     266        $posts    = $this->_get_query_result( array( 
     267            'm' => array( '1234' ), // ignored 
     268        ) ); 
     269 
     270        $this->assertEquals( $expected, $posts ); 
     271    } 
     272 
    261273    public function test_simple_monthnum_expecting_results() { 
    262274        $posts = $this->_get_query_result( array( 
Note: See TracChangeset for help on using the changeset viewer.