Changeset 12635 for trunk/src/bp-members/classes/class-bp-signup.php

Timestamp:

04/26/2020 03:58:20 AM (5 years ago)

Author:

imath

Message:

BP Signup: add a whitelist of available orderby arguments

The BP Signup::get() method orderby argument's possible values are : signup_id, login, email, registered and activated. The Default value remains signup_id.

Fixes #8284

File:

• trunk/src/bp-members/classes/class-bp-signup.php (modified) (3 diffs)

trunk/src/bp-members/classes/class-bp-signup.php

@@ -122 +122 @@
      *
      * @since 2.0.0
+     * @since 6.0.0 Adds a whitelist of allowed orderby parameters.
      *
      * @param array $args {
@@ -128 +129 @@
      *     @type int         $number         How many to fetch. Default 1.
      *     @type bool|string $usersearch     Whether or not to search for a username. Default false.
-     *     @type string      $orderby        Order By parameter. Default 'signup_id'.
+     *     @type string      $orderby        Order By parameter. Possible values are `signup_id`, `login`, `email`,
+     *                                       `registered`, `activated`. Default `signup_id`.
      *     @type string      $order          Order direction. Default 'DESC'.
      *     @type bool        $include        Whether or not to include more specific query params.
@@ -159 +161 @@
         );
 
-        // @todo whitelist sanitization
-        if ( $r['orderby'] !== 'signup_id' ) {
+        // Whitelist sanitization.
+        if ( ! in_array( $r['orderby'], array( 'login', 'email', 'registered', 'activated' ), true ) ) {
+            $r['orderby'] = 'signup_id';
+        }
+
+        if ( 'login' === $r['orderby'] || 'email' === $r['orderby'] ) {
             $r['orderby'] = 'user_' . $r['orderby'];
         }