Changeset 58380 for trunk/src/wp-includes/option.php

Timestamp:

06/11/2024 02:29:14 AM (6 months ago)

Author:

peterwilsoncc

Message:

Options, Meta APIs: Add SQL escaping to query loading 'all options'.

Escapes the return value of wp_autoload_values_to_autoload() for use in the database query loading 'all options'. This is a hardening fix to protect against future changes to the options API which may allow developers to further customize the return value of the wp_autoload_values_to_autoload filter.

Follow up to [57920].

Props peterwilsoncc, joemcgill.
Fixes #42441.

File:

• trunk/src/wp-includes/option.php (modified) (1 diff)

trunk/src/wp-includes/option.php

@@ -607 +607 @@
     if ( ! $alloptions ) {
         $suppress      = $wpdb->suppress_errors();
-        $alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options WHERE autoload IN ( '" . implode( "', '", wp_autoload_values_to_autoload() ) . "' )" );
+        $alloptions_db = $wpdb->get_results( "SELECT option_name, option_value FROM $wpdb->options WHERE autoload IN ( '" . implode( "', '", esc_sql( wp_autoload_values_to_autoload() ) ) . "' )" );
 
         if ( ! $alloptions_db ) {