Ticket #8284: 8284.patch

src/bp-members/classes/class-bp-signup.php

@@ -121 +121 @@
          * Fetch signups based on parameters.
          *
          * @since 2.0.0
+         * @since 6.0.0 Adds a whitelist of allowed orderby parameters.
          *
          * @param array $args {
          *     The argument to retrieve desired signups.
          *     @type int         $offset         Offset amount. Default 0.
          *     @type int         $number         How many to fetch. Default 1.
          *     @type bool|string $usersearch     Whether or not to search for a username. Default false.
-         *     @type string      $orderby        Order By parameter. Default 'signup_id'.
+         *     @type string      $orderby        Order By parameter. Possible values are `signup_id`, `login`, `email`,
+         *                                       `registered`, `activated`. Default `signup_id`.
          *     @type string      $order          Order direction. Default 'DESC'.
          *     @type bool        $include        Whether or not to include more specific query params.
          *     @type string      $activation_key Activation key to search for.
@@ -158 +160 @@
                         'bp_core_signups_get_args'
                 );
 
-                // @todo whitelist sanitization
-                if ( $r['orderby'] !== 'signup_id' ) {
+                // Whitelist sanitization.
+                if ( ! in_array( $r['orderby'], array( 'login', 'email', 'registered', 'activated' ), true ) ) {
+                        $r['orderby'] = 'signup_id';
+                }
+
+                if ( 'login' === $r['orderby'] || 'email' === $r['orderby'] ) {
                         $r['orderby'] = 'user_' . $r['orderby'];
                 }
 

tests/phpunit/testcases/members/class-bp-signup.php

@@ -195 +195 @@
                 $this->assertEquals( array( $s2, $s1, $s3 ), $ss['signups'] );
         }
 
+        /**
+         * @group get
+         */
+        public function test_get_with_orderby_login_asc() {
+                $s1 = self::factory()->signup->create( array(
+                        'user_login' => 'fghij',
+                ) );
+                $s2 = self::factory()->signup->create( array(
+                        'user_login' => 'abcde',
+                ) );
+                $s3 = self::factory()->signup->create( array(
+                        'user_login' => 'zzzzz',
+                ) );
+
+                $ss = BP_Signup::get( array(
+                        'orderby' => 'login',
+                        'number' => 3,
+                        'order' => 'ASC',
+                        'fields' => 'ids',
+                ) );
+
+                $this->assertEquals( array( $s2, $s1, $s3 ), $ss['signups'] );
+        }
+
+        /**
+         * @group get
+         */
+        public function test_get_with_orderby_registered_asc() {
+                $now = time();
+
+                $s1 = self::factory()->signup->create( array(
+                        'registered' => date( 'Y-m-d H:i:s', $now - 50 ),
+                ) );
+                $s2 = self::factory()->signup->create( array(
+                        'registered' => date( 'Y-m-d H:i:s', $now - 100 ),
+                ) );
+                $s3 = self::factory()->signup->create( array(
+                        'registered' => date( 'Y-m-d H:i:s', $now - 10 ),
+                ) );
+
+                $ss = BP_Signup::get( array(
+                        'orderby' => 'registered',
+                        'number' => 3,
+                        'order' => 'ASC',
+                        'fields' => 'ids',
+                ) );
+
+                $this->assertEquals( array( $s2, $s1, $s3 ), $ss['signups'] );
+        }
+
         /**
          * @group get
          */