Ticket #8623: 8623.patch

wp-content/plugins/buddypress/bp-xprofile/classes/class-bp-xprofile-field.php

@@ -570 +570 @@
         public function get_children( $for_editing = false ) {
                 global $wpdb;
 
-                // Sanitize 'order_by'.
-                $order_by = bp_esc_sql_order( $this->order_by );
-
                 // This is done here so we don't have problems with sql injection.
-                if ( empty( $for_editing ) ) {
+                if ( true === empty( $for_editing ) && 'custom' !== $this->order_by ) {
+                        // Sanitize 'order_by'.
+                        $order_by = bp_esc_sql_order( $this->order_by );
                         $sort_sql = "ORDER BY name {$order_by}";
+
                 } else {
                         $sort_sql = 'ORDER BY option_order ASC';
                 }