Changeset 13147 for trunk/src/bp-groups/classes/class-bp-groups-list-table.php

Timestamp:

11/13/2021 06:40:37 PM (3 years ago)

Author:

espellcaste

Message:

Sanitize all ORDER BY (ASC/DESC) values using the bp_esc_sql_order helper function where possible.

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This commit improves that by using the bp_esc_sql_order helper function where possible.

Props imath

Fixes #8576

File:

• trunk/src/bp-groups/classes/class-bp-groups-list-table.php (modified) (1 diff)

trunk/src/bp-groups/classes/class-bp-groups-list-table.php

@@ -97 +97 @@
         $order = 'DESC';
         if ( ! empty( $_REQUEST['order'] ) ) {
-            $order = ( 'desc' == strtolower( $_REQUEST['order'] ) ) ? 'DESC' : 'ASC';
+            $order = bp_esc_sql_order( $_REQUEST['order'] );
         }