Changeset 13147 for trunk/src/bp-activity/classes/class-bp-activity-activity.php

Timestamp:

11/13/2021 06:40:37 PM (3 years ago)

Author:

espellcaste

Message:

Sanitize all ORDER BY (ASC/DESC) values using the bp_esc_sql_order helper function where possible.

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This commit improves that by using the bp_esc_sql_order helper function where possible.

Props imath

Fixes #8576

File:

• trunk/src/bp-activity/classes/class-bp-activity-activity.php (modified) (1 diff)

trunk/src/bp-activity/classes/class-bp-activity-activity.php

@@ -512 +512 @@
         }
 
-        // Sorting.
+        // Sanitize 'order'.
         $sort = $r['sort'];
-        if ( $sort != 'ASC' && $sort != 'DESC' ) {
-            $sort = 'DESC';
+        if ( 'DESC' !== $sort ) {
+            $sort = bp_esc_sql_order( $sort );
         }