Changeset 37324 for trunk/src/wp-includes/query.php

Timestamp:

04/29/2016 01:14:18 PM (9 years ago)

Author:

boonebgorges

Message:

Query: Discard non-scalar 'm' instead of attempting to sanitize.

WP_Query discards most non-array date values ('year', 'monthnum', etc) by
casting to integer. Since [25138], the 'm' parameter has been handled
as a string; see #24884. However, the string-handling introduced in [25138]
blindly attempted to handle arrays and other non-scalar types as strings,
resulting in PHP notices and invalid MySQL syntax.

Props vortfu.
Fixes #36718.

File:

• trunk/src/wp-includes/query.php (modified) (1 diff)

trunk/src/wp-includes/query.php

@@ -1594 +1594 @@
         $qv['day'] = absint($qv['day']);
         $qv['w'] = absint($qv['w']);
-        $qv['m'] = preg_replace( '|[^0-9]|', '', $qv['m'] );
+        $qv['m'] = is_scalar( $qv['m'] ) ? preg_replace( '|[^0-9]|', '', $qv['m'] ) : '';
         $qv['paged'] = absint($qv['paged']);
         $qv['cat'] = preg_replace( '|[^0-9,-]|', '', $qv['cat'] ); // comma separated list of positive or negative integers