Ticket #5919: 5919.patch

src/bp-core/bp-core-filters.php

@@ -603 +603 @@
  * @return string
  */
 function bp_filter_metaid_column_name( $q ) {
-        return str_replace( 'meta_id', 'id', $q );
+        /*
+         * Replace quoted content with __QUOTE__ to avoid false positives.
+         * This regular expression will match nested quotes.
+         */
+        $quoted_regex = "/'[^'\\\\]*(?:\\\\.[^'\\\\]*)*'/s";
+        preg_match_all( $quoted_regex, $q, $quoted_matches );
+        $q = preg_replace( $quoted_regex, '__QUOTE__', $q );
+
+        $q = str_replace( 'meta_id', 'id', $q );
+
+        // Put quoted content back into the string.
+        if ( ! empty( $quoted_matches[0] ) ) {
+                for ( $i = 0; $i < count( $quoted_matches[0] ); $i++ ) {
+                        $quote_pos = strpos( $q, '__QUOTE__' );
+                        $q = substr_replace( $q, $quoted_matches[0][ $i ], $quote_pos, 9 );
+                }
+        }
+
+        return $q;
 }
 
 /**

src/bp-xprofile/bp-xprofile-filters.php

@@ -200 +200 @@
 /**
  * Filter an Extended Profile field value, and attempt to make clickable links
  * to members search results out of them.
- * 
+ *
  * - Not run on datebox field types
  * - Not run on values without commas with less than 5 words
  * - URL's are made clickable
@@ -335 +335 @@
 function bp_xprofile_filter_meta_query( $q ) {
         global $wpdb;
 
+        $raw_q = $q;
+
+        /*
+         * Replace quoted content with __QUOTE__ to avoid false positives.
+         * This regular expression will match nested quotes.
+         */
+        $quoted_regex = "/'[^'\\\\]*(?:\\\\.[^'\\\\]*)*'/s";
+        preg_match_all( $quoted_regex, $q, $quoted_matches );
+        $q = preg_replace( $quoted_regex, '__QUOTE__', $q );
+
         // Get the first word of the command
         preg_match( '/^(\S+)/', $q, $first_word_matches );
 
         if ( empty( $first_word_matches[0] ) ) {
-                return $q;
+                return $raw_q;
         }
 
         // Get the field type
         preg_match( '/xprofile_(group|field|data)_id/', $q, $matches );
 
         if ( empty( $matches[0] ) || empty( $matches[1] ) ) {
-                return $q;
+                return $raw_q;
         }
 
         switch ( $first_word_matches[0] ) {
@@ -415 +425 @@
                         break;
         }
 
+        // Put quoted content back into the string.
+        if ( ! empty( $quoted_matches[0] ) ) {
+                for ( $i = 0; $i < count( $quoted_matches[0] ); $i++ ) {
+                        $quote_pos = strpos( $q, '__QUOTE__' );
+                        $q = substr_replace( $q, $quoted_matches[0][ $i ], $quote_pos, 9 );
+                }
+        }
+
         return $q;
 }
+
+function bp_xprofile_filter_meta_query_preg_replace_callback( $matches ) {
+
+}

tests/phpunit/testcases/xprofile/functions.php

@@ -473 +473 @@
 
         /**
          * @group xprofilemeta
+         * @group bp_xprofile_update_meta
+         * @ticket BP5919
+         */
+        public function test_bp_xprofile_update_meta_where_sql_filter_keywords_are_in_quoted_value() {
+                $g = $this->factory->xprofile_group->create();
+                $value = "SELECT object_id FROM wp_bp_xprofile_groups WHERE \"foo\" VALUES (foo = 'bar'";
+                bp_xprofile_add_meta( $g, 'group', 'foo', 'bar' );
+                bp_xprofile_update_meta( $g, 'group', 'foo', $value );
+                $this->assertSame( $value, bp_xprofile_get_meta( $g, 'group', 'foo' ) );
+        }
+
+        /**
+         * @group xprofilemeta
+         * @group bp_xprofile_update_meta
+         * @ticket BP5919
+         */
+        public function test_bp_xprofile_update_meta_where_meta_id_is_in_quoted_value() {
+                $g = $this->factory->xprofile_group->create();
+                $value = "foo meta_id bar";
+                bp_xprofile_add_meta( $g, 'group', 'foo', 'bar' );
+                bp_xprofile_update_meta( $g, 'group', 'foo', $value );
+                $this->assertSame( $value, bp_xprofile_get_meta( $g, 'group', 'foo' ) );
+        }
+
+        /**
+         * @group xprofilemeta
          * @group bp_xprofile_add_meta
          */
         public function test_bp_xprofile_add_meta_no_meta_key() {