Changeset 53327

Timestamp:

05/02/2022 12:11:48 AM (3 years ago)

Author:

peterwilsoncc

Message:

Users: Validate WP_User_Query's fields argument.

Improve validation of WP_User_Query's fields argument when passed as an array to ensure it only accepts permitted values. This prevents the invalid values being included in the generated database query.

Expand unit tests to include passing invalid values as part of an array, the lower case value id. Correct earlier unit tests to limit database query to one result.

Follow up to [53255].

Props felipeelia.
Fixes #53177.

Location:

trunk

Files:

• src/wp-includes/class-wp-user-query.php (modified) (2 diffs)
• tests/phpunit/tests/user/query.php (modified) (10 diffs)

trunk/src/wp-includes/class-wp-user-query.php

@@ -286 +286 @@
 
         if ( is_array( $qv['fields'] ) ) {
-            $qv['fields'] = array_unique( $qv['fields'] );
+            $qv['fields'] = array_intersect( array_unique( $qv['fields'] ), $allowed_fields );
+
+            if ( empty( $qv['fields'] ) ) {
+                $qv['fields'] = array( 'ID' );
+            }
 
             $this->query_fields = array();
@@ -294 +298 @@
             }
             $this->query_fields = implode( ',', $this->query_fields );
+        } elseif ( 'all' === $qv['fields'] ) {
+            $this->query_fields = "$wpdb->users.*";
         } elseif ( ! in_array( $qv['fields'], $allowed_fields, true ) ) {
-            $this->query_fields = "$wpdb->users.*";
+            $this->query_fields = "$wpdb->users.ID";
         } else {
             $field              = 'ID' === $qv['fields'] ? 'ID' : sanitize_key( $qv['fields'] );

trunk/tests/phpunit/tests/user/query.php

@@ -1983 +1983 @@
         $q       = new WP_User_Query(
             array(
-                'fields'   => $field,
-                'include ' => array( self::$admin_ids[0] ),
+                'fields'  => $field,
+                'include' => array( '1' ),
             )
         );
@@ -2008 +2008 @@
     public function data_returning_fields() {
         return array(
-            'all'           => array(
+            'all'             => array(
                 'field'    => 'all',
                 'expected' => array(
@@ -2014 +2014 @@
                     'user_login'          => 'admin',
                     'user_nicename'       => 'admin',
-                    'user_email'          => 'admin@example.org',
-                    'user_url'            => 'http://example.org',
+                    'user_email'          => WP_TESTS_EMAIL,
+                    'user_url'            => wp_guess_url(),
                     'user_activation_key' => '',
                     'user_status'         => '0',
@@ -2021 +2021 @@
                 ),
             ),
-            'all_with_meta' => array(
+            'all_with_meta'   => array(
                 'field'    => 'all_with_meta',
                 'expected' => array(
@@ -2027 +2027 @@
                     'user_login'          => 'admin',
                     'user_nicename'       => 'admin',
-                    'user_email'          => 'admin@example.org',
-                    'user_url'            => 'http://example.org',
+                    'user_email'          => WP_TESTS_EMAIL,
+                    'user_url'            => wp_guess_url(),
                     'user_activation_key' => '',
                     'user_status'         => '0',
@@ -2034 +2034 @@
                 ),
             ),
-            'ID'            => array(
+            'ID'              => array(
                 'field'    => 'ID',
                 'expected' => array(
@@ -2040 +2040 @@
                 ),
             ),
-            'display_name'  => array(
+            'id'              => array(
+                'field'    => 'id',
+                'expected' => array(
+                    'ID' => '1',
+                ),
+            ),
+            'display_name'    => array(
                 'field'    => 'display_name',
                 'expected' => array(
@@ -2046 +2052 @@
                 ),
             ),
-            'user_login'    => array(
+            'user_login'      => array(
                 'field'    => 'user_login',
                 'expected' => array(
@@ -2052 +2058 @@
                 ),
             ),
-            'user_nicename' => array(
+            'user_nicename'   => array(
                 'field'    => 'user_nicename',
                 'expected' => array(
@@ -2058 +2064 @@
                 ),
             ),
-            'user_email'    => array(
+            'user_email'      => array(
                 'field'    => 'user_email',
                 'expected' => array(
-                    'user_email' => 'admin@example.org',
+                    'user_email' => WP_TESTS_EMAIL,
                 ),
             ),
-            'invalid_field' => array(
+            'invalid_field'   => array(
                 'field'    => 'invalid_field',
                 'expected' => array(
                     '0' => '1',
+                ),
+            ),
+            'valid_array'     => array(
+                'field'    => array( 'ID', 'display_name' ),
+                'expected' => array(
+                    'ID'           => '1',
+                    'display_name' => 'admin',
+                ),
+            ),
+            'semivalid_array' => array(
+                'field'    => array( 'ID', 'display_name', 'invalid_field' ),
+                'expected' => array(
+                    'ID'           => '1',
+                    'display_name' => 'admin',
+                ),
+            ),
+            'invalid_array'   => array(
+                'field'    => array( 'invalid_field' ),
+                'expected' => array(
+                    'ID' => '1',
                 ),
             ),