Ticket #4995: 4995.patch

bp-activity-classes.php

@@ -169 +169 @@
 
                 // Searching
                 if ( $search_terms ) {
-                        $search_terms = $wpdb->escape( $search_terms );
-                        $where_conditions['search_sql'] = "a.content LIKE '%%" . like_escape( $search_terms ) . "%%'";
+                        $search_terms = esc_sql( like_escape( $search_terms ) );
+                        $where_conditions['search_sql'] = "a.content LIKE '%%{$search_terms}%%'";
                 }
 
                 // Filtering
@@ -245 +245 @@
                                         $activity_user_ids[] = $activity->user_id;
                         }
 
-                        $activity_user_ids = implode( ',', array_unique( (array) $activity_user_ids ) );
+                        $activity_user_ids = implode( ',', wp_parse_id_list( $activity_user_ids ) );
                         if ( !empty( $activity_user_ids ) ) {
                                 if ( $names = $wpdb->get_results( "SELECT user_id, value AS user_fullname FROM {$bp->profile->table_name_data} WHERE field_id = 1 AND user_id IN ({$activity_user_ids})" ) ) {
                                         foreach ( (array) $names as $name )
@@ -419 +419 @@
         function delete_activity_item_comments( $activity_ids ) {
                 global $bp, $wpdb;
 
-                if ( is_array( $activity_ids ) )
-                        $activity_ids = implode ( ',', array_map( 'absint', $activity_ids ) );
-                else
-                        $activity_ids = implode ( ',', array_map( 'absint', explode ( ',', $activity_ids ) ) );
+                $activity_ids = esc_sql( implode( ',', wp_parse_id_list( $activity_ids ) ) );
 
                 return $wpdb->query( "DELETE FROM {$bp->activity->table_name} WHERE type = 'activity_comment' AND item_id IN ({$activity_ids})" );
         }
@@ -430 +427 @@
         function delete_activity_meta_entries( $activity_ids ) {
                 global $bp, $wpdb;
 
-                if ( is_array( $activity_ids ) )
-                        $activity_ids = implode ( ',', array_map( 'absint', $activity_ids ) );
-                else
-                        $activity_ids = implode ( ',', array_map( 'absint', explode ( ',', $activity_ids ) ) );
+                $activity_ids = esc_sql( implode( ',', wp_parse_id_list( $activity_ids ) ) );
 
                 return $wpdb->query( "DELETE FROM {$bp->activity->table_name_meta} WHERE activity_id IN ({$activity_ids})" );
         }

bp-activity-template.php

@@ -368 +368 @@
         $r = wp_parse_args( $args, $defaults );
         extract( $r );
 
+        // Sanitized in BP_Activity_Activity::get()
         if ( empty( $search_terms ) && ! empty( $_REQUEST['s'] ) )
                 $search_terms = $_REQUEST['s'];