Changeset 13147 for trunk/src/bp-members/classes/class-bp-members-invitations-template.php

Timestamp:

11/13/2021 06:40:37 PM (3 years ago)

Author:

espellcaste

Message:

Sanitize all ORDER BY (ASC/DESC) values using the bp_esc_sql_order helper function where possible.

BuddyPress is not consistent on how it escapes ORDER BY (ASC/DESC) values provided by the developers/users. This commit improves that by using the bp_esc_sql_order helper function where possible.

Props imath

Fixes #8576

File:

• trunk/src/bp-members/classes/class-bp-members-invitations-template.php (modified) (3 diffs)

trunk/src/bp-members/classes/class-bp-members-invitations-template.php

@@ -185 +185 @@
 
         // Sort order direction.
-        $orders = array( 'ASC', 'DESC' );
-        if ( ! empty( $_GET['sort_order'] ) && in_array( $_GET['sort_order'], $orders ) ) {
+        if ( ! empty( $_GET['sort_order'] ) ) {
             $r['sort_order'] = $_GET['sort_order'];
-        } else {
-            $r['sort_order'] = in_array( $r['sort_order'], $orders ) ? $r['sort_order'] : 'DESC';
         }
 
@@ -196 +193 @@
         $this->pag_page     = bp_sanitize_pagination_arg( $this->pag_arg, $r['page'] );
         $this->pag_num      = bp_sanitize_pagination_arg( 'num', $r['per_page'] );
+        $this->sort_order   = bp_esc_sql_order( $r['sort_order'] );
         $this->user_id      = $r['user_id'];
         $this->search_terms = $r['search_terms'];
         $this->order_by     = $r['order_by'];
-        $this->sort_order   = $r['sort_order'];
         $this->query_vars   = array(
             'id'            => $r['id'],
@@ -253 +250 @@
      */
     public function has_invitations() {
-        if ( $this->current_invitation_count ) {
-            return true;
-        }
-
-        return false;
+        return ! empty( $this->current_invitation_count );
     }