id summary reporter owner description type status priority milestone component version severity resolution keywords cc focuses 23873 Gallery shortcode orderby does not support multiple column sorting dglingren wonderboymusic "In wp-includes/media.php, function gallery_shortcode, lines 689-694 are: {{{ // We're trusting author input, so let's at least make sure it looks like a valid orderby statement if ( isset( $attr['orderby'] ) ) { $attr['orderby'] = sanitize_sql_orderby( $attr['orderby'] ); if ( !$attr['orderby'] ) unset( $attr['orderby'] ); } }}} The sanitize_sql_orderby function requires commas between multiple column names. If you enter, for example orderby=""menu_order ID"", the lack of a comma causes the parameter to be deleted from the query. Just after this test, on line 698, a multi-column sort without the comma delimiter is used as the default value. If you enter commas to get past the sanitize_sql_orderby test, logic in wp-includes/query.php, function get_posts will not accept the commas (lines 2358 - 2361) and all but the last of the columns are ignored. This issue should be considered along with those raised in #17065 and #16584. Thank you." defect (bug) closed normal 4.1 Gallery 3.5.1 normal fixed has-patch needs-testing