WordPress.org

Make WordPress Core

Changeset 39964


Ignore:
Timestamp:
01/26/2017 01:51:02 PM (5 years ago)
Author:
ocean90
Message:

Query: Ensure that queries work correctly with post type names with special characters.

Merge of [39952] to the 3.9 branch.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/3.9/src/wp-includes/query.php

    r27836 r39964  
    27202720        if ( 'any' == $post_type ) {
    27212721            $in_search_post_types = get_post_types( array('exclude_from_search' => false) );
    2722             if ( empty( $in_search_post_types ) )
     2722            if ( empty( $in_search_post_types ) ) {
    27232723                $where .= ' AND 1=0 ';
    2724             else
    2725                 $where .= " AND $wpdb->posts.post_type IN ('" . join("', '", $in_search_post_types ) . "')";
     2724            } else {
     2725                $where .= " AND {$wpdb->posts}.post_type IN ('" . join( "', '", array_map( 'esc_sql', $in_search_post_types ) ) . "')";
     2726            }
    27262727        } elseif ( !empty( $post_type ) && is_array( $post_type ) ) {
    2727             $where .= " AND $wpdb->posts.post_type IN ('" . join("', '", $post_type) . "')";
     2728            $where .= " AND {$wpdb->posts}.post_type IN ('" . join("', '", esc_sql( $post_type ) ) . "')";
    27282729        } elseif ( ! empty( $post_type ) ) {
    2729             $where .= " AND $wpdb->posts.post_type = '$post_type'";
     2730            $where .= $wpdb->prepare( " AND {$wpdb->posts}.post_type = %s", $post_type );
    27302731            $post_type_object = get_post_type_object ( $post_type );
    27312732        } elseif ( $this->is_attachment ) {
Note: See TracChangeset for help on using the changeset viewer.