Make WordPress Core

Opened 8 years ago

Closed 8 years ago

Last modified 8 years ago

#6600 closed defect (bug) (duplicate)

error in function gallery_shortcode (wp-includes/media.php)

Reported by: mhubi Owned by:
Milestone: Priority: high
Severity: major Version: 2.5
Component: General Keywords:
Focuses: Cc:


I found a wrong (escaped) parameter in the variable orderby on line 355 of the file wp-includes/media.php:

$attachments = get_children("post_parent=$id&post_type=attachment&post_mime_type=image&orderby=\"{$orderby}\"");

The parameter will be escaped f.e. so:

post_parent=3&post_type=attachment&post_mime_type=image&orderby=\"menu_order ASC, ID ASC\"

My database returns an error on executing this query which is generated and queried in wp-includes/post.php in line 475:

FROM wp_posts
WHERE 1=1 AND post_type = 'attachment' AND wp_posts.post_parent = 3 AND (post_mime_type LIKE 'image/%')
GROUP BY wp_posts.ID ORDER BY \"menu_order ASC, ID ASC\" DESC

The database error is

#1064 - You have an error in your SQL syntax;
check the manual that corresponds to your MySQL server version for the
right syntax to use near '\"menu_order ASC, ID ASC\" DESC' at line 1 

I think the character \ is the problem.

I also found a workaround. Replace the line 475 in wp-includes/post.php

	$query .= " GROUP BY $wpdb->posts.ID ORDER BY " . $orderby . ' ' . $order;

with this line

	$query .= " GROUP BY $wpdb->posts.ID ORDER BY " . stripslahes($orderby) . ' ' . $order;

But I think this is a security risk.

Sorry for my bad english ;-)

Change History (4)

#1 follow-up: @mhubi
8 years ago

Sorry I forgot to write that I am using PHP Version 5.2.0-8+etch10 with MySQL 5.0.45-Debian_1ubuntu3.3

#2 in reply to: ↑ 1 @noledge
8 years ago

Replying to mhubi:

i have the exact same problem on the same platform (debian 4.0, php 5.2)
i had PHP4 first when i upgraded to WP2.5, which worked fine. after upgrading to PHP5, no gallerys were shown in posts, and the same mysql error was drawn into the logs. the above workaround fixed this for me, though i have no idea why this worked in PHP4.

#3 @ryan
8 years ago

  • Resolution set to duplicate
  • Status changed from new to closed

Duplicate of #6476

#4 @Nazgul
8 years ago

  • Milestone 2.5.1 deleted
Note: See TracTickets for help on using tickets.