WordPress.org

Make WordPress Core

Opened 4 years ago

Closed 4 years ago

#19779 closed defect (bug) (fixed)

_edit_attachments_query_helper does not properly preface table name when querying unattached media

Reported by: benbalter Owned by: nacin
Milestone: 3.4 Priority: normal
Severity: minor Version: 3.3.1
Component: General Keywords: has-patch
Focuses: Cc:

Description

If a plugin modifies the media list on upload.php by joining wp_posts on itself (for example, to filter attachments which are children of a certain post type), MySQL throws an error when querying for unattached files because post_parent < 1 in _edit_attachments_query_helper is ambiguous without prefacing the table name (because of the join). All other columns in the query are explicitly named.

Steps to Reproduce:

  1. Hook into posts_join_paged on upload.php and join wp_posts on itself ( e.g., JOIN wp_posts wp_posts2 ON wp_posts2.post_parent = wp_posts.ID)
  2. Navigate to media upload and query for unattached media
  3. Receive an error that post_parent is ambiguous

Attachments (3)

19779.diff (405 bytes) - added by benbalter 4 years ago.
Preface table name
example-filter.php (676 bytes) - added by benbalter 4 years ago.
Example join filter to break upload.php (excluded media attached to pages)
19779-2.diff (399 bytes) - added by benbalter 4 years ago.
Slightly cleaner, wrapped the string in double quotes

Download all attachments as: .zip

Change History (6)

@benbalter4 years ago

Preface table name

@benbalter4 years ago

Example join filter to break upload.php (excluded media attached to pages)

@benbalter4 years ago

Slightly cleaner, wrapped the string in double quotes

comment:1 @scribu4 years ago

  • Keywords 2nd-opinion removed
  • Milestone changed from Awaiting Review to 3.4

Can't see any downsides to this.

comment:2 @nacin4 years ago

  • Owner set to nacin
  • Status changed from new to accepted

comment:3 @nacin4 years ago

  • Resolution set to fixed
  • Status changed from accepted to closed

In [19720]:

Prefix table name against the post_parent field in _edit_attachments_query_helper() to avoid ambiguous queries. props benbalter. fixes #19779.

Note: See TracTickets for help on using tickets.