Changeset 12635 for trunk/src/bp-members/classes/class-bp-signup.php

Timestamp:

04/26/2020 03:58:20 AM (6 years ago)

Author:

imath

Message:

BP Signup: add a whitelist of available orderby arguments

The BP Signup::get() method orderby argument's possible values are : signup_id, login, email, registered and activated. The Default value remains signup_id.

Fixes #8284

File:

• trunk/src/bp-members/classes/class-bp-signup.php (modified) (3 diffs)

trunk/src/bp-members/classes/class-bp-signup.php

@@ -122 +122 @@
          *
          * @since 2.0.0
+         * @since 6.0.0 Adds a whitelist of allowed orderby parameters.
          *
          * @param array $args {
@@ -128 +129 @@
          *     @type int         $number         How many to fetch. Default 1.
          *     @type bool|string $usersearch     Whether or not to search for a username. Default false.
-         *     @type string      $orderby        Order By parameter. Default 'signup_id'.
+         *     @type string      $orderby        Order By parameter. Possible values are `signup_id`, `login`, `email`,
+         *                                       `registered`, `activated`. Default `signup_id`.
          *     @type string      $order          Order direction. Default 'DESC'.
          *     @type bool        $include        Whether or not to include more specific query params.
@@ -159 +161 @@
                 );
 
-                // @todo whitelist sanitization
-                if ( $r['orderby'] !== 'signup_id' ) {
+                // Whitelist sanitization.
+                if ( ! in_array( $r['orderby'], array( 'login', 'email', 'registered', 'activated' ), true ) ) {
+                        $r['orderby'] = 'signup_id';
+                }
+
+                if ( 'login' === $r['orderby'] || 'email' === $r['orderby'] ) {
                         $r['orderby'] = 'user_' . $r['orderby'];
                 }