Make WordPress Core


Ignore:
Timestamp:
10/17/2022 05:39:34 PM (18 months ago)
Author:
audrasjb
Message:

Grouped backports to the 5.9 branch.

  • Editor: Bump @wordpress packages for the 5.9 branch,
  • Media: Refactor search by filename within the admin,
  • REST API: Lockdown post parameter of the terms endpoint,
  • Customize: Escape blogname option in underscores templates,
  • Query: Validate relation in WP_Date_Query,
  • Users: Revert use of shared objects for current user,
  • Posts, Post types: Apply KSES to post-by-email content,
  • General: Validate host on "Are you sure?" screen,
  • Posts, Post types: Remove emails from post-by-email logs,
  • Pings/trackbacks: Apply KSES to all trackbacks,
  • Mail: Reset PHPMailer properties between use,
  • Comments: Apply kses when editing comments,
  • Widgets: Escape RSS error messages for display.

Merges [54521-54530] to the 5.9 branch.
Props audrasjb, costdev, cu121, dd32, davidbaumwald, ehtis, johnbillion, johnjamesjacoby, martinkrcho, matveb, oztaser, paulkevan, peterwilsoncc, ravipatel, SergeyBiryukov, talldanwp, timothyblynjacobs, tykoted, voldemortensen, vortfu, xknown.

Location:
branches/5.9
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/5.9

  • branches/5.9/src/wp-includes/class-wp-date-query.php

    r52332 r54545  
    150150        }
    151151
    152         if ( isset( $date_query['relation'] ) && 'OR' === strtoupper( $date_query['relation'] ) ) {
    153             $this->relation = 'OR';
     152        if ( isset( $date_query['relation'] ) ) {
     153            $this->relation = $this->sanitize_relation( $date_query['relation'] );
    154154        } else {
    155155            $this->relation = 'AND';
     
    219219            $this->validate_date_values( $queries );
    220220        }
     221
     222        // Sanitize the relation parameter.
     223        $queries['relation'] = $this->sanitize_relation( $queries['relation'] );
    221224
    222225        foreach ( $queries as $key => $q ) {
     
    10411044        return $wpdb->prepare( "DATE_FORMAT( $column, %s ) $compare %f", $format, $time );
    10421045    }
     1046
     1047    /**
     1048     * Sanitizes a 'relation' operator.
     1049     *
     1050     * @since 6.0.3
     1051     *
     1052     * @param string $relation Raw relation key from the query argument.
     1053     * @return string Sanitized relation ('AND' or 'OR').
     1054     */
     1055    public function sanitize_relation( $relation ) {
     1056        if ( 'OR' === strtoupper( $relation ) ) {
     1057            return 'OR';
     1058        } else {
     1059            return 'AND';
     1060        }
     1061    }
    10431062}
Note: See TracChangeset for help on using the changeset viewer.