Changeset 54540

Timestamp:

10/17/2022 12:36:06 PM (2 years ago)

Author:

audrasjb

Message:

Query: Validate relation in WP_Date_Query.

Props dd32, johnjamesjacoby, martinkrcho, ehtis, paulkevan, peterwilsoncc.
Merges [54530] to the 6.0 branch.

Location:

branches/6.0

Files:

• . (modified) (1 prop)
• src/wp-includes/class-wp-date-query.php (modified) (3 diffs)
• tests/phpunit/tests/date/query.php (modified) (1 diff)
• tests/phpunit/tests/term/taxQuery.php (modified) (5 diffs)

branches/6.0/src/wp-includes/class-wp-date-query.php

@@ -150 +150 @@
         }
 
-        if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] ) ) {
-            $this->relation = 'OR';
+        if ( isset( $date_query['relation'] ) ) {
+            $this->relation = $this->sanitize_relation( $date_query['relation'] );
         } else {
             $this->relation = 'AND';
@@ -219 +219 @@
             $this->validate_date_values( $queries );
         }
+
+        // Sanitize the relation parameter.
+        $queries['relation'] = $this->sanitize_relation( $queries['relation'] );
 
         foreach ( $queries as $key => $q ) {
@@ -1041 +1044 @@
         return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time );
     }
+
+    /**
+     * Sanitizes a 'relation' operator.
+     *
+     * @since 6.0.3
+     *
+     * @param string $relation Raw relation key from the query argument.
+     * @return string Sanitized relation ('AND' or 'OR').
+     */
+    public function sanitize_relation( $relation ) {
+        if ( 'OR' === strtoupper( $relation ) ) {
+            return 'OR';
+        } else {
+            return 'AND';
+        }
+    }
 }

branches/6.0/tests/phpunit/tests/date/query.php

@@ -1136 +1136 @@
         $this->assertSame( array( $p1, $p2 ), $q->posts );
     }
+
+    /**
+     * @covers WP_Date_Query::get_sql
+     */
+    public function test_relation_in_query_and() {
+        $date_query = array(
+            'relation' => 'AND',
+            array(
+                'before'    => array(
+                    'year'  => 2021,
+                    'month' => 9,
+                    'day'   => 20,
+                ),
+                'after'     => array(
+                    'year'  => 2019,
+                    'month' => 2,
+                    'day'   => 25,
+                ),
+                'inclusive' => true,
+            ),
+            array(
+                'before'    => array(
+                    'year'  => 2016,
+                    'month' => 9,
+                    'day'   => 11,
+                ),
+                'after'     => array(
+                    'year'  => 2014,
+                    'month' => 5,
+                    'day'   => 12,
+                ),
+                'inclusive' => false,
+            ),
+        );
+
+        $q = new WP_Date_Query( $date_query );
+
+        $sql = $q->get_sql();
+
+        $parts = mb_split( '\)\s+AND\s+\(', $sql );
+        $this->assertIsArray( $parts, 'SQL query cannot be split into multiple parts using operator AND.' );
+        $this->assertEquals( 2, count( $parts ), 'SQL query does not contain correct number of AND operators.' );
+
+        $this->assertStringNotContainsString( 'OR', $sql, 'SQL query contains conditions joined by operator OR.' );
+    }
+
+    /**
+     * @covers WP_Date_Query::get_sql
+     */
+    public function test_relation_in_query_or() {
+        $date_query = array(
+            'relation' => 'OR',
+            array(
+                'before'    => array(
+                    'year'  => 2021,
+                    'month' => 9,
+                    'day'   => 20,
+                ),
+                'after'     => array(
+                    'year'  => 2019,
+                    'month' => 2,
+                    'day'   => 25,
+                ),
+                'inclusive' => true,
+            ),
+            array(
+                'before'    => array(
+                    'year'  => 2016,
+                    'month' => 9,
+                    'day'   => 11,
+                ),
+                'after'     => array(
+                    'year'  => 2014,
+                    'month' => 5,
+                    'day'   => 12,
+                ),
+                'inclusive' => false,
+            ),
+        );
+
+        $q = new WP_Date_Query( $date_query );
+
+        $sql = $q->get_sql();
+
+        $this->assertStringContainsString( 'OR', $sql, 'SQL query does not contain conditions joined by operator OR.' );
+
+        $parts = mb_split( '\)\s+OR\s+\(', $sql );
+        $this->assertIsArray( $parts, 'SQL query cannot be split into multiple parts using operator OR.' );
+        $this->assertEquals( 2, count( $parts ), 'SQL query does not contain correct number of OR operators.' );
+
+        // Checking number of occurrences of AND while skipping the one at the beginning.
+        $this->assertSame( 2, substr_count( substr( $sql, 5 ), 'AND' ), 'SQL query does not contain expected number conditions joined by operator AND.' );
+    }
+
+    /**
+     * @covers WP_Date_Query::get_sql
+     */
+    public function test_relation_in_query_unsupported() {
+        $date_query = array(
+            'relation' => 'UNSUPPORTED',
+            array(
+                'before'    => array(
+                    'year'  => 2021,
+                    'month' => 9,
+                    'day'   => 20,
+                ),
+                'after'     => array(
+                    'year'  => 2019,
+                    'month' => 2,
+                    'day'   => 25,
+                ),
+                'inclusive' => true,
+            ),
+            array(
+                'before'    => array(
+                    'year'  => 2016,
+                    'month' => 9,
+                    'day'   => 11,
+                ),
+                'after'     => array(
+                    'year'  => 2014,
+                    'month' => 5,
+                    'day'   => 12,
+                ),
+                'inclusive' => false,
+            ),
+        );
+
+        $q = new WP_Date_Query( $date_query );
+
+        $sql = $q->get_sql();
+
+        $parts = mb_split( '\)\s+AND\s+\(', $sql );
+        $this->assertIsArray( $parts, 'SQL query cannot be split into multiple parts using operator AND.' );
+        $this->assertEquals( 2, count( $parts ), 'SQL query does not contain correct number of AND operators.' );
+
+        $this->assertStringNotContainsString( 'OR', $sql, 'SQL query contains conditions joined by operator OR.' );
+    }
 }

branches/6.0/tests/phpunit/tests/term/taxQuery.php

@@ -336 +336 @@
     /**
      * @ticket 18105
+     * @covers WP_Tax_Query::get_sql
      */
     public function test_get_sql_relation_and_operator_in() {
@@ -382 +383 @@
         $this->assertSame( 3, substr_count( $sql['join'], 'JOIN' ) );
 
+        // Checking number of occurrences of AND while skipping the one at the beginning.
+        $this->assertSame( 2, substr_count( substr( $sql['where'], 5 ), 'AND' ), 'SQL query does not contain expected number conditions joined by operator AND.' );
+
+        $this->assertStringNotContainsString( 'OR', $sql['where'], 'SQL query contains conditions joined by operator OR.' );
+
         _unregister_taxonomy( 'wptests_tax' );
     }
@@ -387 +393 @@
     /**
      * @ticket 18105
+     * @covers WP_Tax_Query::get_sql
      */
     public function test_get_sql_nested_relation_or_operator_in() {
@@ -435 +442 @@
 
         $this->assertSame( 2, substr_count( $sql['join'], 'JOIN' ) );
+        $this->assertSame( 2, substr_count( $sql['where'], 'OR' ), 'SQL query does not contain expected number conditions joined by operator OR.' );
+        $this->assertStringNotContainsString( 'AND', substr( $sql['where'], 5 ), 'SQL query contains conditions joined by operator AND.' );
 
         _unregister_taxonomy( 'wptests_tax' );
@@ -496 +505 @@
         _unregister_taxonomy( 'wptests_tax' );
     }
+
+    /**
+     * @ticket 18105
+     * @covers WP_Tax_Query::get_sql
+     */
+    public function test_get_sql_relation_unsupported() {
+        register_taxonomy( 'wptests_tax', 'post' );
+
+        $t1 = self::factory()->term->create(
+            array(
+                'taxonomy' => 'wptests_tax',
+            )
+        );
+        $t2 = self::factory()->term->create(
+            array(
+                'taxonomy' => 'wptests_tax',
+            )
+        );
+        $t3 = self::factory()->term->create(
+            array(
+                'taxonomy' => 'wptests_tax',
+            )
+        );
+
+        $tq = new WP_Tax_Query(
+            array(
+                'relation' => 'UNSUPPORTED',
+                array(
+                    'taxonomy' => 'wptests_tax',
+                    'field'    => 'term_id',
+                    'terms'    => $t1,
+                ),
+                array(
+                    'taxonomy' => 'wptests_tax',
+                    'field'    => 'term_id',
+                    'terms'    => $t2,
+                ),
+                array(
+                    'taxonomy' => 'wptests_tax',
+                    'field'    => 'term_id',
+                    'terms'    => $t3,
+                ),
+            )
+        );
+
+        global $wpdb;
+        $sql = $tq->get_sql( $wpdb->posts, 'ID' );
+
+        // Checking number of occurrences of AND while skipping the one at the beginning.
+        $this->assertSame( 2, substr_count( substr( $sql['where'], 5 ), 'AND' ), 'SQL query does not contain expected number conditions joined by operator AND.' );
+
+        $this->assertStringNotContainsString( 'UNSUPPORTED', $sql['where'], 'SQL query contains unsupported relation operator.' );
+        $this->assertStringNotContainsString( 'OR', $sql['where'], 'SQL query contains conditions joined by operator OR.' );
+
+        _unregister_taxonomy( 'wptests_tax' );
+    }
 }