Make WordPress Core


Ignore:
Timestamp:
10/17/2022 12:36:06 PM (17 months ago)
Author:
audrasjb
Message:

Query: Validate relation in WP_Date_Query.

Props dd32, johnjamesjacoby, martinkrcho, ehtis, paulkevan, peterwilsoncc.
Merges [54530] to the 6.0 branch.

Location:
branches/6.0
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/6.0

  • branches/6.0/src/wp-includes/class-wp-date-query.php

    r52652 r54540  
    150150        }
    151151
    152         if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] ) ) {
    153             $this->relation = 'OR';
     152        if ( isset( $date_query['relation'] ) ) {
     153            $this->relation = $this->sanitize_relation( $date_query['relation'] );
    154154        } else {
    155155            $this->relation = 'AND';
     
    219219            $this->validate_date_values( $queries );
    220220        }
     221
     222        // Sanitize the relation parameter.
     223        $queries['relation'] = $this->sanitize_relation( $queries['relation'] );
    221224
    222225        foreach ( $queries as $key => $q ) {
     
    10411044        return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time );
    10421045    }
     1046
     1047    /**
     1048     * Sanitizes a 'relation' operator.
     1049     *
     1050     * @since 6.0.3
     1051     *
     1052     * @param string $relation Raw relation key from the query argument.
     1053     * @return string Sanitized relation ('AND' or 'OR').
     1054     */
     1055    public function sanitize_relation( $relation ) {
     1056        if ( 'OR' === strtoupper( $relation ) ) {
     1057            return 'OR';
     1058        } else {
     1059            return 'AND';
     1060        }
     1061    }
    10431062}
Note: See TracChangeset for help on using the changeset viewer.