Changeset 13147 for trunk/src/bp-friends/classes/class-bp-friends-friendship.php

Timestamp:

11/13/2021 06:40:37 PM (3 years ago)

Author:

espellcaste

Message:

Sanitize all ORDER BY (ASC/DESC) values using the bp_esc_sql_order helper function where possible.

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This commit improves that by using the bp_esc_sql_order helper function where possible.

Props imath

Fixes #8576

File:

• trunk/src/bp-friends/classes/class-bp-friends-friendship.php (modified) (2 diffs)

trunk/src/bp-friends/classes/class-bp-friends-friendship.php

@@ -258 +258 @@
      *        @type int    $is_limited        Whether the friendship is limited.
      *        @type string $order_by          Column name to order by.
-     *        @type string $sort_order        ASC or DESC. Default DESC.
+     *        @type string $sort_order        Optional. ASC or DESC. Default: 'DESC'.
      * }
      * @param string $operator Optional. Operator to use in `wp_list_filter()`.
@@ -370 +370 @@
 
         // Adjust the sort direction of the results.
-        if ( 'ASC' === strtoupper( $r['sort_order'] ) ) {
+        if ( 'ASC' === bp_esc_sql_order( $r['sort_order'] ) ) {
             // `true` to preserve keys.
             $friendships = array_reverse( $friendships, true );