Changeset 13147 for trunk/src/bp-core/bp-core-functions.php

Timestamp:

11/13/2021 06:40:37 PM (3 years ago)

Author:

espellcaste

Message:

Sanitize all ORDER BY (ASC/DESC) values using the bp_esc_sql_order helper function where possible.

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This commit improves that by using the bp_esc_sql_order helper function where possible.

Props imath

Fixes #8576

File:

• trunk/src/bp-core/bp-core-functions.php (modified) (3 diffs)

trunk/src/bp-core/bp-core-functions.php

@@ -93 +93 @@
  * @since 1.2.6
  *
- * @global object $wpdb WordPress database object.
+ * @global wpdb $wpdb WordPress database object.
  *
  * @return string Filtered database prefix.
@@ -384 +384 @@
  * @since 2.1.0
  *
+ * @global wpdb $wpdb WordPress database object.
  * @see wpdb::esc_like() for more details on proper use.
  *
@@ -395 +396 @@
     if ( method_exists( $wpdb, 'esc_like' ) ) {
         return $wpdb->esc_like( $text );
-    } else {
-        return addcslashes( $text, '_%\\' );
-    }
+    }
+
+    return addcslashes( $text, '_%\\' );
 }