Changeset 7593

Timestamp:

04/03/2008 03:06:01 AM (18 years ago)

Author:

markjaquith

Message:

Fix gallery shortcode orderby param for all SQL setups. Sanitize orderby. fixes #6476 for 2.5.1

Location:

branches/2.5/wp-includes

Files:

• formatting.php (modified) (1 diff)
• media.php (modified) (3 diffs)
• post.php (modified) (1 diff)

branches/2.5/wp-includes/formatting.php

@@ -365 +365 @@
 
         return $title;
+}
+
+// ensures a string is a valid SQL order by clause like: post_name ASC, ID DESC
+// accepts one or more columns, with or without ASC/DESC, and also accepts RAND()
+function sanitize_sql_orderby( $orderby ){
+        preg_match('/^\s*([a-z0-9_]+(\s+(ASC|DESC))?(\s*,\s*|\s*$))+|^\s*RAND\(\s*\)\s*$/i', $orderby, $obmatches);
+        if ( !$obmatches )
+                return false;
+        return $orderby;
 }
 

branches/2.5/wp-includes/media.php

@@ -340 +340 @@
         if ( $output != '' )
                 return $output;
-                
+
+        // We're trusting author input, so let's at least make sure it looks like a valid orderby statement
+        if ( isset( $attr['orderby'] ) ) {
+                $attr['orderby'] = sanitize_sql_orderby( $attr['orderby'] );
+                if ( !$attr['orderby'] )
+                        unset( $attr['orderby'] );
+        }
+
         extract(shortcode_atts(array(
                 'orderby'    => 'menu_order ASC, ID ASC',
@@ -352 +359 @@
 
         $id = intval($id);
-        $orderby = addslashes($orderby);
-        $attachments = get_children("post_parent=$id&post_type=attachment&post_mime_type=image&orderby=\"{$orderby}\"");
+        $attachments = get_children("post_parent=$id&post_type=attachment&post_mime_type=image&orderby={$orderby}");
 
         if ( empty($attachments) )
@@ -427 +433 @@
         global $post;
         $post = get_post($post);
-        $attachments = array_values(get_children("post_parent=$post->post_parent&post_type=attachment&post_mime_type=image&orderby=\"menu_order ASC, ID ASC\""));
+        $attachments = array_values(get_children("post_parent=$post->post_parent&post_type=attachment&post_mime_type=image&orderby=menu_order ASC, ID ASC"));
 
         foreach ( $attachments as $k => $attachment )

branches/2.5/wp-includes/post.php

@@ -460 +460 @@
         if (!empty($exclusions))
                 $exclusions .= ')';
+
+        // orderby
+        if ( preg_match( '/.+ +(ASC|DESC)/i', $orderby ) )
+                $order = ''; // orderby has its own order, so we'll use that
 
         $query  = "SELECT DISTINCT * FROM $wpdb->posts ";